A Narrow Dispute, a Sweeping Test
On 16 June 2026 the Court of Justice of the European Union's Grand Chamber ruled in joined cases C-188/24 (WebGroup Czech Republic and NKL Associates) and C-190/24 (Coyote System) — two disputes that, on their face, had nothing to do with social media. WebGroup and NKL are pornographic-site operators contesting French decrees requiring age verification to keep minors out. Coyote System makes a driving-assistance app that French law bars from rebroadcasting the location of police roadside checks. Both companies argued France's rules violated the 'country of origin' principle in the e-Commerce Directive, which lets a service established in one member state operate EU-wide under its home country's rules (CJEU judgment page).
The Court's answer on jurisdiction was almost a side note next to what it said about liability. At paragraph 112, the Grand Chamber held that where "the algorithm used determines, in the interest of the operator or its service, under what conditions, how and in which order of priority" information is broadcast, the operator "exercises control over that information" (EU Law Analysis). Paragraph 110 goes further: control and knowledge are "alternative to and independent of each other" — meaning a platform can lose hosting immunity through algorithmic control alone, with no awareness of specific illegal content required. Simple categorisation or indexing to aid searchability is still safe; ranking content to serve the platform's own interest is not.
Why the Court Might Have a Point
The steelman case for this ruling is straightforward. Regulators have spent a decade watching platforms claim to be neutral pipes while running engagement-optimised ranking systems that actively amplify certain content — sometimes including exactly the illegal material (child sexual abuse material, terrorist content, unlawfully circumvented safety rules) that hosting immunity was never meant to shield. If an algorithm is built to serve the platform's commercial interest by deciding what users see and in what order, treating that as passive storage strains the ordinary meaning of 'hosting.' The Digital Services Act itself reflects this concern: it imposes recommender-system transparency duties on every platform and lets very large platforms' users opt out of profiling-based feeds — an acknowledgment that ranking is an editorial act with consequences, not a neutral technical function.
Why the Test Goes Too Far
The problem is that the DSA already built a considered answer to that concern, and this ruling could unravel it. Brussels' co-legislators chose disclosure and choice for recommenders — publish the main ranking parameters, let users switch them off — precisely so that using a ranking algorithm would not, by itself, convert a platform into a publisher stripped of Article 6 hosting protection (successor to e-Commerce Directive Article 14) and Article 8's ban on general monitoring obligations (successor to Article 15). As the IPKat's analysis of the judgment notes, the ruling narrows both provisions together, since the monitoring ban only protects providers who still qualify for the hosting exemption in the first place (IPKat).
EFF's Christoph Schmon frames the risk correctly: nearly every mainstream platform — social feeds, marketplaces, video sites, even search — ranks content by relevance or engagement in the operator's commercial interest. Read expansively, paragraph 112 sweeps in all of them, reopening exactly the exposure the DSA's tiered, ex-ante compliance model was designed to replace with predictable rules (EFF Deeplinks). The likely platform response to that exposure is not more careful curation — it's blunter, faster takedowns of anything remotely contestable, since erring toward removal is now the cheaper legal bet. That is a bad trade for lawful speech that happens to be adjacent to a grey area.
What Should Happen Next
The facts underlying C-188/24 and C-190/24 are genuinely narrow — an age-verification mandate and a ban on rebroadcasting police-check locations, not a recommender feed accused of amplifying disinformation. National courts and the Commission should read the control test in that light: tied to a platform's own operational interest in suppressing specific legally mandated disclosures, not as a general indictment of ranking by relevance. Absent that restraint, expect a wave of national litigation testing whether Instagram's feed, Amazon's search results, or YouTube's recommendations now fall outside Article 6 — precisely the fragmentation the DSA's harmonised regime was built to avoid. The European Commission, which owns DSA enforcement, has an interest in clarifying quickly that recommender transparency under the DSA — not loss of hosting status — remains the operative framework for ranking algorithms.