EU Court of Justice ruling may have just radically changed social media regulation

The rule exempting internet service providers from liability as a publisher is the foundation of modern social networks, but the court said it doesn't apply where an algorithm is used

In a recent EU Court of Justice judgment, concerning French laws which require age verification for pornographic websites and ban re-broadcast of information about police traffic stops, the EU court said first of all that member states could take such measures under the EU’s e-commerce directive. File picture

Has the EU Court of Justice just transformed social media regulation? At first sight, it certainly looks like it has. 

In a recent judgement, concerning French laws which require age verification for pornographic websites and ban re-broadcast of information about police traffic stops, the EU court said first of all that member states could take such measures under the EU’s e-commerce directive. 

According to the court, although in principle the directive bans member states from placing restrictions on online services, there are exceptions which allow restrictions on grounds of public policy and public security — which can justify the French rules relating to access to pornography and information about traffic stops.

Secondly, the court answered another question about the French restriction on the traffic stop information. Did that French law also breach the rule in the e-commerce directive that exempted internet service providers from liability, as long as they had no knowledge or control of what they were posting? 

This rule (along with its American equivalent, known as ‘section 230’) has been the foundation of modern social networks, exempting them from the liability that traditional publishers or broadcasters have for what they publish or broadcast — as regards defamatory comments, for example.

Crucially, the court ruled that the exemption from liability did not apply where an internet service provider uses an algorithm in respect of the information it transmits, if that goes beyond merely indexing that information. Since internet service providers often use algorithms, the court’s judgement seems to have exploded their business model.

Or has it? The judgement makes no mention of the EU’s Digital Services Act, which, since 2024, has re-stated the rules on exemption from liability, alongside creating a detailed system for regulating the online world. 

This includes basic rules for all platforms, plus extra obligations, enforced by the EU Commission, for "very large online platforms" — which include the two porn sites involved in this case. (The traffic information site is only subject to the basic rules, which are enforced by national regulators). 

Among other things, the bigger platforms have to assess the risks to society caused by their content, and they can be fined and ordered to change their practices if the commission finds that they have failed to do so.

There is a perception that as regards American internet giants in particular, such as Meta, the commission is hesitating to apply the Digital Services Act out of fear of reaction from the Trump administration, which objects to other countries regulating its digital behemoths. File picture: AP/Thibault Camus

So in the (likely) event that someone sues another website for liability after the EU court's judgement, the website may argue that the ruling is redundant, because the Digital Services Act has created a whole new system for regulating websites that should now apply instead. 

Either the EU court will agree with that reasoning, in which case the initial reaction to the judgement will look like a storm in a teacup. Or the court will stick to its judgement, in which case the impact of the loss of exemption from liability will overshadow the possible effect of the regulatory system set up by the Digital Services Act.

After all, the effect of the Digital Services Act has been modest so far. The EU Commission has convinced some internet platforms to change their ways, but it has only fined X and Temu for breach of the act. 

Many investigations have taken months, or are still ongoing, for instance as regards the ‘nudification’ AI app that was integrated into X. There is a perception that as regards American internet giants in particular, the commission is hesitating to apply the act out of fear of reaction from the Trump administration, which objects to other countries regulating its digital behemoths.

The reactions to the judgement have been mixed. Some believe that the removal of liability for internet service providers has been crucial to the growth of the internet, which they see as an essential part of modern societies. 

Professor Steven Peers: 'Even if future case law limits its effect by saying that the Digital Services Act restrains member state governments from regulation of bigger platforms (assigning that role to the commission) but not individuals from suing those platforms, that would still be very expensive for those platforms.'

Others, more critical of the impact of the internet (and the billionaires it has enriched) upon society, and dubious of the effectiveness of the Digital Services Act at curbing those harms so far, have welcomed it.

It remains to be seen if the judgement has as big an impact as it first appears. Even if future case law limits its effect by saying that the Digital Services Act restrains member state governments from regulation of bigger platforms (assigning that role to the commission) but not individuals from suing those platforms, that would still be very expensive for those platforms. 

The judges, like many others, may be exasperated with the relative passivity of EU internet regulation in practice; but blowing up the internet in frustration seems a disproportionate response.

• Professor Steve Peers, Royal Holloway University of London