From intermediary immunity to data controller responsibility: the CJEU’s functional approach to online marketplace liability in X v Russmedia (Case C-492/23)

This commentary examines the CJEU’s judgment in X v Russmedia Digital and Inform Media Press (Case C-492/23), clarifying the status of online marketplace operators hosting user-generated advertisements under the GDPR. The Court adopted a functional approach, holding that a marketplace operator may qualify as a joint controller of personal data contained in advertisements published on its platform, even without active involvement in their content. It further held that an operator cannot circumvent its obligations under the GDPR by relying on the E-Commerce Directive’s liability exemptions, as this would undermine the Regulation’s protective aim. The judgment strengthens platform accountability and reinforces data protection principles within the EU media and digital regulatory landscape. However, it raises important concerns: unclear limits of platforms’ liability as data controllers, heightened exposure under the sensitive-data regime and the resulting risk of systematic over-removal, preventive compliance obligations without clear boundaries, and insufficient regard for freedom of expression.