On 2 December 2025, the Court of Justice of the European Union delivered an important judgment (Russmedia, C-492/23) on the responsibility of online platforms for advertisements containing personal data. The ruling shows that platforms may have far-reaching obligations under the General Data Protection Regulation (“GDPR”) when processing such personal data.
On a Romanian online marketplace of Russmedia, an advertisement was posted in which a woman was presented as offering sexual services without her consent, including her photos and phone number. Although the platform quickly removed the advertisement after the woman complained, it had already been spread via other websites. The woman subsequently held the platform liable for (inter alia) the unlawful processing of her personal data.
