What the Court actually decided
On 16 June 2026, the CJEU's Grand Chamber ruled in Joined Cases C-188/24 (WebGroup Czech Republic and NKL Associates) and C-190/24 (Coyote System), on a reference from France's Conseil d'État. The dispute was narrow on its face: Czech-based pornography site operators challenged French age-verification obligations enforced by audiovisual regulator Arcom, while French driving-assistance service Coyote System challenged a ban on broadcasting the real-time locations of roadside police checks. Both providers argued France had no authority to regulate them because, under the E-Commerce Directive's country-of-origin principle, jurisdiction belongs to the member state where a digital service is established — not where its users are.
The Court held that both French measures fall within the Directive's "coordinated field" under Article 3(2), meaning they are, in principle, restrictions the home state alone should police. But it also confirmed that Article 3(4)(a) lets a host state derogate where a measure is necessary for public policy, health, security or consumer protection; targeted at a specific service that "actually prejudices" or presents a "serious and grave risk" to those interests; and proportionate — provided the state first sought action from the home state and formally notified the Commission. Crucially, the Court blessed individualized regulatory orders against a named provider while ruling out blanket, abstract-general laws. That is the operative shift: not the end of the country-of-origin principle, but a clearer, court-sanctioned map for when another capital can act despite it (EUR-Lex case notice; analysis via Baker McKenzie).
Why this lands on Dublin's desk
The judgment never mentions Ireland. But the country-of-origin principle it interprets is the exact mechanism that makes Coimisiún na Meán — established under the Online Safety and Media Regulation Act 2022 — the Digital Services Coordinator responsible for supervising DSA compliance by providers established in Ireland, a group that includes YouTube, TikTok and X's European operations (Coimisiún na Meán, DSA application page). The DSA's one-stop-shop architecture, modelled on GDPR's, exists precisely so platforms answer to a single home regulator instead of 27 parallel enforcement tracks. Coimisiún na Meán already has active DSA cases underway: it opened investigations into TikTok and LinkedIn in December 2025 over illegal-content-reporting tools, with fines of up to 6% of global turnover on the table (Coimisiún na Meán press release).
That enforcement pace is also the vulnerability the new ruling exposes. Reporting has documented Brussels-level frustration with Ireland's "lackluster performance as Europe's de facto tech regulator," including allegations that political intervention delayed a separate Google fine (Tech Policy Press). Until now, a member state that judged Coimisiún na Meán too slow had little recourse beyond complaining through DSA cooperation channels. The Grand Chamber has now confirmed a second path: a targeted, individualized order against a specific Dublin-headquartered platform for a specific, demonstrable harm, so long as the intervening state can show proportionality and clears the procedural bar of notifying the Commission and Ireland first.
The case for letting other capitals act
There is a real argument here, and it deserves to be stated plainly rather than waved away. When a platform's illegal-content-reporting tool is genuinely broken — failing to let users flag child sexual abuse material anonymously, say — a child in Paris or Berlin is not well served by a rule that says only Dublin may act, however overloaded Coimisiún na Meán's docket happens to be. Rigid deference to a single home regulator, with no safety valve, risks turning "country of origin" into a shield against accountability rather than a coordination tool. France's underlying justification in this case — protecting minors from pornography — is exactly the kind of concrete, individualized harm the Court's proportionality test was designed to accommodate, and Ireland's own framework does not dispute that such harms warrant fast action.
Why the fix should not be a judicial workaround
The problem is that "proportionate and individualized" is a standard, not a bright line, and it will now be interpreted independently by courts and regulators in up to 27 member states. That is precisely the fragmentation the E-Commerce Directive's country-of-origin principle was built in 2000 to prevent, and which the DSA's one-stop-shop model was designed to extend into the platform-governance era. If every capital that finds Coimisiún na Meán insufficiently aggressive believes it now has a court-endorsed shortcut — provided it dresses an intervention as a targeted order rather than a categorical ban — Dublin-based platforms face the prospect of parallel, possibly conflicting orders from Paris, Berlin and Rome addressing the same underlying practice. That is compliance chaos, not accountability, and it falls hardest on smaller platforms that chose an Irish or EU establishment specifically to avoid facing 27 different rulebooks at once.
The better remedy for a slow home regulator is not a judicially improvised bypass but the DSA's own machinery: joint Commission-coordinator investigations, published enforcement timelines, and political pressure on Coimisiún na Meán's resourcing. Ireland has both the incentive and the obligation to make that machinery credible — its position as Europe's platform-regulation chokepoint depends on it.
What to watch
- Whether France or another member state actually tests the ruling with a new individualized order against a Dublin-based VLOP in the coming months.
- Whether Coimisiún na Meán accelerates its TikTok and LinkedIn cases in response to the implicit pressure.
- Whether the Commission treats a rise in unilateral national orders as evidence the one-stop-shop needs reinforcing, or as tolerable pressure-release valve.