Hosting providers' liability: evolving criteria for assessing content moderation
The European Directive of June 8, 2000, on electronic commerce established a limited liability regime for hosting providers, based on the absence of a general obligation to monitor content. With the development of proactive moderation measures, whether automated or human, to what extent can a hosting provider control user-generated content without losing the benefit of this regime?
The 2022 Digital Services Act (DSA) and recent case law of the Court of Justice of the European Union (CJEU) examine this question through the evolving role of hosting providers, the moderation measures recognized under the DSA, and the limits imposed on content controls.
1. The E-Commerce Directive: the passive role of hosting providers
1.1 A limited liability regime based on the absence of a general monitoring obligation
The E-Commerce Directive of June 8, 2000, established a specific liability regime for hosting service providers. (1)
Article 14 provided an exemption from liability for information stored at the request of service users, provided that the hosting provider had no actual knowledge of its illegal nature or acted expeditiously to remove or disable access to the information upon obtaining such knowledge. In the case of claims for damages, the provision also took into account awareness of facts or circumstances from which the illegality was apparent.
Article 15 prohibited Member States from imposing a general obligation on intermediary service providers to monitor stored information or actively seek illegal activities.
These provisions were based on an essentially passive concept of hosting: the provider technically stores user-generated content without being required to systematically monitor it. However, they did not exclude voluntary detection measures or certain targeted removal obligations.
In France, the Directive was transposed into national law by the Law of June 21, 2004, on Confidence in the Digital Economy (LCEN).
1.2 Reactive moderation and the YouTube and Cyando judgment
Reactive moderation is based on the notice-and-takedown mechanism established by the Directive: when content is reported as illegal, the hosting provider must review the information submitted and, if it becomes aware of the content's illegality, act expeditiously to remove it or disable access to it.
The CJEU reiterated the conditions governing this liability regime in its judgment of June 22, 2021, in the YouTube and Cyando cases. (2) Both cases concerned the unauthorized availability of copyright-protected works on the YouTube platform and the Uploaded file-sharing service.
The Court recalled that the exemption under Article 14 of the Directive requires the provider to perform a purely technical, automatic and passive activity, without knowledge of or control over the stored information. However, it clarified that technical measures designed to detect copyright infringements are not, in themselves, sufficient to establish an active role incompatible with this exemption. The Court also distinguished between general awareness of potentially illegal content on a platform and knowledge of specific infringements.
This judgment confirms that a hosting provider may voluntarily seek out illegal content without automatically losing the benefit of the liability exemption, provided that it acts expeditiously to remove such content once it becomes aware of it.
2. The DSA: recognition of voluntary measures to moderate illegal content
2.1 Recognition of proactive moderation
To detect potentially illegal content, such as content glorifying terrorist acts, inciting racial hatred, or relating to criminal activities such as pimping or the sexual exploitation of minors, without waiting for users to report it, proactive control measures may be implemented before or after publication. Such moderation may be automated, using algorithms or keyword filters, or performed by human moderation teams responsible for reviewing suspicious content.
The Digital Services Act (DSA) of October 19, 2022, deleted Articles 12 to 15 of the E-Commerce Directive, while retaining and supplementing their underlying principles. (3)
Article 6 of the DSA maintains the conditional exemption from liability for internet intermediary service providers, including hosting service providers. Article 8 retains the prohibition on imposing a general monitoring obligation.
Article 7 provides clarification regarding proactive moderation. Providers of intermediary services “shall not be deemed ineligible for the exemptions from liability solely because they, in good faith and in a diligent manner, carry out voluntary own-initiative investigations into, or take other measures aimed at detecting, identifying and removing, or disabling access to, illegal content.”
The DSA therefore protects the principle of voluntary moderation without guaranteeing a general exemption from liability. Providers remain subject to the conditions set out in Article 6, particularly when they become aware of illegal content.
2.2 The WebGroup Czech Republic judgment: limits of algorithmic control
In its judgment of June 16, 2026, delivered in the joined WebGroup Czech Republic and Coyote System cases, the Grand Chamber of the CJEU clarified the criteria for assessing the control exercised over stored information. (4)
The disputes concerned two French regulatory measures: the obligation to verify the age of visitors to pornographic websites and the temporary prohibition on rebroadcasting certain information relating to roadside checks through a driving assistance service.
In the case involving Coyote, the Court had to determine whether a service provider could benefit from the hosting regime established under Article 14 of the E-Commerce Directive when its algorithm controlled how information submitted by users was disseminated, without human intervention for each item of content.
The CJEU clarified that knowledge of and control over content constitute two separate and alternative criteria. A provider may therefore exercise control over stored information without having individual knowledge of each item.
Where an algorithm determines, in the interest of the provider or its service, the conditions, manner or order of priority in which information is disseminated, going beyond mere categorization or indexing, the service cannot qualify as hosting within the meaning of Article 14 of the Directive. Automated processing therefore does not, in itself, guarantee the provider's neutrality.
The scope of this judgment must nevertheless be clearly defined, as it concerns algorithmic control over the dissemination of information (such as promoting certain content for commercial purposes, for example), rather than a system exclusively intended to detect illegal content.
Although delivered in 2026, the judgment interprets Articles 14 and 15 of the E-Commerce Directive, rather than Article 7 of the DSA, which expressly protects certain voluntary moderation measures. Automated filtering designed to prevent illegal activities cannot therefore be equated, without further examination, with control over the dissemination of information exercised in the provider's commercial interests.
3. Liability exemptions and commercially motivated content controls
3.1 The AGCOM v Google Ireland judgment: knowledge acquired through a commercial contract
In a judgment of July 16, 2026, the CJEU examined the consequences of content review conducted pursuant to a commercial contract. (5)
The case concerned videos published on YouTube promoting online gambling, in violation of Italian regulations. The Italian communications regulatory authority (AGCOM) had imposed a €750,000 fine on Google Ireland and ordered the removal of several videos.
The creator of these videos had entered into an advertising revenue-sharing agreement with Google. Before entering into this contract, Google had reviewed the channel's main subject matter, certain videos and their metadata.
The question referred to the CJEU was whether Google could benefit from the liability exemption under Article 14 of the E-Commerce Directive despite such prior review.
The Court distinguished between ordinary technical measures for detecting illegal content and the review conducted as part of a commercial contract. It considered that the latter gave the platform operator specific knowledge of the essential content of the videos concerned, which was incompatible with a purely technical, automatic and passive activity. Article 14 of the Directive was therefore inapplicable to the operator in the circumstances examined. However, this exclusion did not mean that the operator was automatically liable, as its liability remained to be assessed by the national court.
3.2 Distinguishing commercial control from compliance-related moderation
The AGCOM judgment distinguishes the detection of illegal content from a specific review conducted as part of its commercial exploitation and highlights the importance of the nature and purpose of platforms' interventions. However, a commercial purpose is not, in itself, sufficient to exclude the benefit of the liability exemption. The nature and extent of the control exercised, as well as the knowledge it provides to the service provider, must also be taken into account.
Like the WebGroup judgment, the AGCOM decision interprets Article 14 of the E-Commerce Directive, rather than the DSA. Their implications must therefore be assessed in light of Article 7 of the DSA, which protects certain voluntary initiatives aimed at combating illegal content.
A distinction must therefore be drawn between measures aimed at detecting and removing illegal content for legal compliance purposes, on the one hand, and interventions through which the provider exercises more extensive control over content or the manner in which it is disseminated for commercial purposes, on the other.
4. What are the implications for digital platforms?
Hosting service providers may implement reactive or proactive moderation mechanisms without automatically losing the benefit of the limited liability regime.
However, they must distinguish measures designed to detect illegal content from interventions aimed at selecting or promoting certain content, and be able to justify the purpose and methods of their content controls.
The handling of alerts and notices remains critical. When a hosting provider becomes aware of illegal content, it must act expeditiously to remove it or disable access to it. Content that escapes an automated filter does not automatically trigger the provider's liability, but a sufficiently precise notice may be taken into account when assessing the provider's knowledge of its illegality.
Finally, Article 14 of the DSA requires providers to inform users, in their terms and conditions, of the content moderation policies, procedures and tools they use, including algorithmic decision-making and human review.
For our previous articles on the DSA, see DSA compliance: key obligations for hosting providers, platforms and marketplaces (Part 1) and DSA compliance: key obligations for hosting providers, platforms and marketplaces operating in the EU (Part 2).
* * * * * * * * * * *
(1) Directive 2000/31/EC of June 8, 2000, on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market ("Directive on electronic commerce" or "E-Commerce Directive"), see Articles 14 and 15.
(2) CJEU, June 22, 2021, YouTube and Cyando, Joined Cases C-682/18 and C-683/18.
(3) Regulation (EU) 2022/2065 of October 19, 2022, on a Single Market For Digital Services and amending Directive 2000/31/EC ("Digital Services Act" or "DSA"), see Articles 3(t), 6 to 8, 14 and 16.
(4) CJEU, June 16, 2026, WebGroup Czech Republic and Others, joined cases C-188/24 and C-190/24.
(5) CJEU, July 16, 2026, AGCOM v Google Ireland, case C-421/24.
Bénédicte DELEPORTE
Avocat
Deleporte Wentz Avocat
October 2026