CJEU: Grand Chamber clarifies age verification obligations, the country-of-origin principle and intermediary liability

IRIS 2026-7:1/15

Helena Sousa

Communication and Society Research Centre, University of Minho

On 16 June 2026, the Grand Chamber of the Court of Justice of the European Union (CJEU) delivered its judgment in Joined Cases C-188/24 (WebGroup Czech Republic a.s. and NKL Associates s.r.o. v. Ministre de la Culture and Premier ministre) and C-190/24 (Coyote System), following requests for preliminary rulings from the French Council of State (Conseil d'État). The judgment addresses several questions of broad relevance for the regulation of online services within the European Union, notably the scope of the country-of-origin principle, the conditions under which member states may impose restrictions on service providers established elsewhere in the Union, and the extent of the hosting liability exemption under Directive 2000/31/EC (the e-Commerce Directive).

The proceedings arose from two separate disputes concerning French legislation. The first concerned measures adopted to strengthen the protection of minors online. Under Article 227-24 of the French Criminal Code, pornographic content may not be made accessible to minors. To ensure compliance in the online environment, the French audiovisual and digital regulator, (Autorité française de régulation de l’audiovisuel et du numérique - Arcom), was empowered to issue formal notices requiring operators of pornographic websites to implement age verification systems capable of preventing access by minors. WebGroup Czech Republic and NKL Associates, companies established in the Czech Republic operating pornographic websites accessible in France, challenged those measures before the State Council. They argued that France could not impose such obligations on providers established in another member state without infringing the country-of-origin principle guaranteed by the e-Commerce Directive.

The second dispute concerned French rules governing geolocation-based driving assistance services. Under the French Highway Code, certain information relating to roadside police checks may not be rebroadcast where disclosure could interfere with investigations connected to serious criminal offences. Coyote System challenged the implementing measures, arguing, inter alia, that they were incompatible with the protections afforded to intermediary service providers under EU law and with the prohibition against imposing general monitoring obligations.

In its judgment, the Court first examined whether the French measures fell within the “coordinated field” governed by the e-Commerce Directive. The Court adopted a broad interpretation of that concept, confirming that it is not limited to rules specifically regulating online services. Requirements arising from general national legislation, including criminal law or road traffic legislation, may also fall within the coordinated field where they govern access to, or the exercise of, information society services. As a result, the measures at issue constituted restrictions on the free movement of information society services and had to be assessed in light of the directive’s country-of-origin principle.

The Court nevertheless reaffirmed that Article 3(4) of the directive allows member states to derogate from that principle in certain circumstances. Such derogations must pursue recognised objectives, including public policy and public security, and must be proportionate to those objectives. The Court found that the protection of minors against access to pornographic content falls within the concept of public policy, while restrictions designed to prevent the dissemination of information capable of compromising serious criminal investigations may be justified on grounds of public security.

The judgment also clarifies that derogating measures must target specific information society services whose activities are capable of prejudicing the objectives pursued. Measures should therefore take the form of individual decisions, such as notices or prohibitions directed at identified operators, rather than general and abstract obligations applicable indiscriminately to all providers established in other member states. Furthermore, except in cases of urgency, the member state wishing to adopt such measures must first request the member state of establishment to intervene and must notify both that state and the European Commission before acting. Compliance with these conditions remains for the referring court to verify.

The Court also addressed the hosting liability exemption under Article 14 of the e-Commerce Directive. According to the judgment, a provider may only benefit from that exemption where it lacks both knowledge of and control over the information stored at the request of users. The Court held that a provider which determines, through algorithmic processes, the conditions under which user-generated information is disseminated, including the manner and order of its rebroadcasting, exercises a degree of control over that information. In such circumstances, the provider may no longer be regarded as a neutral intermediary and may therefore be unable to rely on the hosting exemption.

The ruling provides important guidance for national regulators and digital service providers across the European Union. In particular, it clarifies the legal framework applicable to national age verification measures, an area that has become increasingly significant as member states seek to strengthen protections for minors online. At the same time, the judgment offers further insight into the limits of intermediary liability protections in cases where platforms exercise an active role in the organisation, prioritisation or dissemination of user-generated content. Its findings are likely to be relevant beyond the specific facts of the cases and may influence the developing relationship between the e-Commerce Directive framework and the regulatory obligations introduced by the Digital Services Act.