GDPR Liability For Online Marketplaces: No Safe Harbour Under The E-Commerce Directive

On 2 December 2025, the Court of Justice of the European Union (CJEU) clarified the scope of GDPR liability for online marketplaces in its judgment X vs Russmedia Digital SRL and Inform Media Press SRL (Case C-492/23), confirming that online marketplace operators may incur liability under the GDPR where they fail to take appropriate steps to verify, moderate and prevent the unlawful dissemination of advertisement containing personal data.

A key aspect of the judgement is the Court's finding that the operator of an online marketplace may be classified as a data controller for the purpose of the General Data Protection Regulation (GDPR). Importantly, the Court also held that such operators cannot rely on the liability exemption under Article 14¹ of Directive 2000/31 (E-Commerce Directive) to avoid the responsibility for breaches of their obligations under the GDPR.