The Ruling
On 16 June 2026, the Court of Justice of the European Union's Grand Chamber issued judgment in Joined Cases C-188/24 (WebGroup Czech Republic and NKL Associates) and C-190/24 (Coyote System), on a reference from France's Conseil d'État (curia.europa.eu). The underlying disputes were narrow — Czech pornography-site operators challenging French age-verification rules, and Coyote System, a French driving-assistance app, challenging a ban on rebroadcasting user-submitted roadside police-check locations. But buried inside the judgment is a holding with far broader reach: a platform that uses an algorithm to determine "the conditions, manner and order of priority" in which user content is displayed thereby exercises control over that content — and control, the Court held, disqualifies a platform from the hosting-liability exemption in Article 14 of the E-Commerce Directive, the direct predecessor of Article 6 of the Digital Services Act (eur-lex.europa.eu).
What "Control" Now Means
Until now, EU intermediary-liability law turned mainly on knowledge: a host keeps its immunity as long as it has no actual awareness of illegal content and removes it expeditiously once notified. The Grand Chamber added a second, independent trigger. Per the judgment, an operator loses the exemption even if it never becomes aware of specific illegal content, so long as its algorithm predetermines whether and how that content circulates. Not every algorithm is disqualifying: as Osborne Clarke's analysis notes, "the Court expressly maintained that mere categorisation and indexation of content by means of algorithms do not, in themselves, deprive an operator of hosting-provider status" (osborneclarke.com). But once a system actively decides what a given user sees, in what order and under what conditions, the platform is no longer treated as a neutral pipe.
The Case For the Court's Approach
The Court's underlying instinct isn't unreasonable. A recommendation engine tuned to maximise engagement, or a ranking system built around a platform's commercial interest, is doing something categorically different from a server that simply stores what users upload. The DSA itself already singles out recommender systems as a distinct risk vector — very large platforms must disclose recommender parameters and assess the systemic risks those systems create. If an algorithm is actively shaping what an audience sees, there's a coherent argument that "we just host it" shouldn't be a complete defense to everything that algorithm chooses to surface.
Where the Test Overreaches
The trouble is that the test as articulated doesn't clearly separate engagement-optimised amplification from the basic ranking almost every platform needs to function — spam filters, relevance sorting, a "most recent" feed with light deduplication. EFF's Christoph Schmon warns the ruling risks "equating algorithmic organisation with content control," making the hosting exemption "largely meaningless" for the modern web, and could push platforms toward "proactive monitoring of user speech" to limit exposure (eff.org). Commentary on the IPKat blog reaches a similar conclusion, suggesting the decision could sweep in most modern user-generated-content platforms, not just the handful of dominant recommender-driven apps the ruling appears aimed at (ipkitten.blogspot.com).
That overbreadth matters because of what follows from losing the exemption. It isn't just liability exposure — the DSA's ban on imposing general monitoring obligations (Article 8) protects only platforms that qualify for a liability exemption in the first place. A platform pushed outside Article 6 by an ordinary ranking function loses that protection too, creating exactly the incentive EU lawmakers spent years trying to avoid: pre-emptive, algorithmic over-removal of lawful but borderline speech rather than risking a lawsuit. That falls hardest on mid-sized platforms without the legal budget to litigate a test case — the opposite of the DSA's size-tiered design.
Already Spreading
The doctrine didn't stay confined to a pornography site and a traffic app. One month later, on 16 July 2026, the CJEU applied the same reasoning in AGCOM v Google Ireland, holding that Google could not invoke the hosting exemption for YouTube videos on a channel it had reviewed before admitting the creator to its revenue-sharing partner programme — a case arising from a €750,000 fine Italy's communications regulator imposed over gambling-ad content. The judgment cites the WebGroup/Coyote reasoning repeatedly (ppc.land), confirming platforms should expect national courts to extend the "control" test well beyond the facts that produced it.
What Brussels Should Do Next
The DSA's Recital 22 already says automated indexing, search functions, or recommendation systems are not, by themselves, sufficient to establish actual knowledge of illegal content. But that recital speaks to knowledge, not control — leaving open exactly the gap the Grand Chamber has now filled with a considerably blunter instrument. The European Commission should move quickly to issue interpretive guidance, or if necessary propose a targeted clarification, distinguishing relevance-based ranking and spam filtering from genuine editorial control, reserving loss of the exemption for platforms that demonstrably intervene to shape outcomes for their own commercial benefit. Absent that, a ruling meant to catch algorithmically weaponised platforms risks catching nearly everyone who runs one.