On 16 June 2026, the Court of Justice of the European Union's Grand Chamber handed down its judgment in Joined Cases C-188/24 (WebGroup Czech Republic and NKL Associates) and C-190/24 (Coyote System). The ruling answers a question that has shadowed the EU single market since the e-Commerce Directive of 2000: when may one member state impose its own rules on an online service lawfully established in another? The Court's answer is narrow, procedural, and — for once — encouraging to anyone who values both child protection and the open internet.
The fight ARCOM picked
France has a real problem. According to ARCOM, the country's audiovisual and digital regulator, roughly 2.3 million under-18s visit pornographic websites every month. The SREN law of 21 May 2024 gave ARCOM the power to issue formal notices, levy fines, and order administrative blocking or delisting of sites that fail to keep minors out.
The difficulty was jurisdictional. The largest adult platforms targeting French users are not established in France. WebGroup Czech Republic and NKL Associates are registered in Prague. Under the e-Commerce Directive's country-of-origin principle, an information-society service is supposed to be regulated by the member state where it is established — not by every country where it has an audience. The Czech operators argued, with the backing of France's own Conseil d'État, that ARCOM's enforcement and the underlying criminal prohibition in Article 227-24 of the French Criminal Code were exactly the kind of unilateral national interference the Directive forbids.
The strongest case for France
It is worth stating the regulator's case at full strength before quarrelling with it. The country-of-origin rule, applied mechanically, creates an obvious loophole: any platform can route around a member state's child-protection regime simply by incorporating in the most permissive jurisdiction available. If Prague will not act, the argument runs, French children are left unprotected by an accident of corporate domicile. The harm is concrete and the affected population cannot consent. That is a serious argument, and the Court took it seriously.
What the Court actually held
The Grand Chamber did not hand France a blank cheque. It drew a sharp line between two ways of regulating a foreign service.
First, the Court confirmed that the country-of-origin principle's "coordinated field" extends even to criminal-law rules governing online conduct. A member state cannot escape the Directive simply by writing its restriction into a penal code. As the Baker McKenzie analysis puts it, conduct-governing rules "fall within the country-of-origin principle regardless of whether they appear in criminal or civil statutes." That alone disposed of France's reliance on a general statutory ban.
Second — and this is the operative holding — a member state may still derogate, but only through a genuinely individual measure. A blanket prohibition applying uniformly to every provider "does not constitute an individual measure" and cannot invoke the Directive's Article 3(4) exception. Only a targeted order against a specific, named service qualifies. ARCOM may therefore compel a particular publisher to verify ages, but it cannot enforce an abstract criminal rule against the world.
Third, the procedure is exacting. Before acting against an EU-established provider, France must first ask the provider's home member state to act, and must notify the European Commission and that home state of its intended measure (with after-the-fact notification permitted only in genuinely urgent cases). The ruling, as reported by PPC Land, preserves the home state's first move and the Commission's supervisory role over every cross-border intervention.
Why proportionate enforcement won here
This is the right outcome, and not a grudging one. The single market for digital services only works if companies can build to one rulebook rather than twenty-seven. The country-of-origin principle is the load-bearing wall of that architecture; the moment any destination state can impose criminal liability on a foreign service through a general statute, the wall comes down and the smallest, least-resourced operators — not the dominant platforms with EU-wide legal teams — are the ones who cannot navigate the fragmentation.
The Court's individual-measure requirement keeps the wall standing while leaving a real door for child protection. It forces regulators to do the unglamorous work of identifying a specific service, demonstrating a serious risk, consulting the home state, and notifying Brussels. Each of those steps is a check against the reflex to govern the entire internet by decree. Notably, the Court also held that the Audiovisual Media Services Directive's recognition of age verification strengthens the proportionality case against a provider that has done nothing to protect minors — so the operators who actually deploy reasonable age assurance are the ones least exposed to destination-state enforcement. That is exactly the incentive structure a proportionate regime should create.
The question the Court ducked
One large issue remains open. The judgment pointedly declined to decide whether the Digital Services Act now displaces national youth-protection laws altogether. As France, Spain, and others push national age-verification mandates, the unresolved tension between fully harmonised DSA rules and member-state child-safety statutes is the next battle. For now, the Grand Chamber has given regulators a usable but disciplined tool: act on foreign services if you must, but do it one notice at a time, with your homework done and the Commission watching.