On 2 December 2025, the Court of Justice of the European Union (CJEU) adopted an important decision in case C-492/23 Russmedia Digital, regarding the liability of online marketplace operators for advertisements containing personal data shared by users.
The case involves a situation where an unidentified person posted an advertisement for sexual services on a Romanian website, including photos and a telephone number of a woman without her consent. Although the operator of the Russmedia Digital platform removed the advertisement within an hour of receiving the report, it had already been distributed to other websites, where it remains accessible.
The CJEU ruled that an online marketplace operator qualifies as a personal data controller under the General Data Protection Regulation (GDPR), even when an advertisement is posted by a user. This is because the advertisement is accessible on the internet only through the platform, and the operator processes the personal data for its own commercial purposes.
According to the decision, it is essential that online marketplace operators implement appropriate technical and organizational measures to identify, before publication, advertisements containing sensitive personal data. In such cases, the operator must verify whether the person whose data appears in the advertisement has given their consent and, if not, refrain from publishing it.
Online platforms are also required to take measures to prevent the copying and unlawful publication of advertisements containing sensitive personal data on other websites.
If you operate an online marketplace or require advice on personal data protection, GDPR compliance, or the responsibilities of online platforms, you can reach out to our experts.
