How to balance freedom of expression and child protection in the digital age? A comparative legal analysis

Mohammed Abbas Mohsin, PhD in Public Law, Diplomatic advisor 

Photo credit: San Jose Public Library, via Wikimedia Commons

  Abstract

    This blog post presents a comparative legal analysis of the regulatory and judicial frameworks governing the balance between the fundamental right to freedom of expression and the state’s pressing interest in protecting children in the digital age. By examining recent landmark decisions handed down by the Supreme Court of the United States, the Court of Justice of the European Union, the French Council of State, the Italian Regional Administrative Court, and the Supreme Court of England and Wales, this paper analyses how the various judicial authorities in those countries reconcile the requirements for age verification on digital platforms with constitutional safeguards and human rights. This post explores the shift in levels of judicial scrutiny, the extent to which procedural requirements under internal market rules (such as the country-of-origin principle) apply, the unique technical and operational challenges faced by collaborative open-source platforms, and the emerging international consensus that, whilst child protection is of the utmost importance, the regulatory measures employed must remain carefully tailored and procedurally compliant to avoid disproportionate restrictions on adults’ freedom of expression and privacy.

    1. Introduction

    The rapid shift from physical to digital media has led to a radical and evident change in minors’ exposure to sexually explicit content, rendering the traditional restrictions imposed on high-street shops ineffective and unable to keep pace with this problem. Governments around the world have responded by enacting comprehensive age-verification laws targeting online commercial platforms. However, these laws inevitably conflict with the fundamental rights of adult users – who have a constitutional right to access age-restricted content intended for adults – and with digital platforms that rely on the free flow of information.

The key legal conflict lies in determining where the state’s regulatory authority to protect the innocence of minors ends, and where the unlawful restriction of adults’ rights begins.

  This comparative legal analysis examines how various democratic legal systems have addressed this tension. Specifically, it reviews the standard of scrutiny applied to digital age verification laws, the impact of federalism and cross-border economic frameworks, and the unique challenges faced by non-profit cooperative structures in this regard.

 

 

2. The US Constitutional Model: Scrutiny and Incidental Burdens

   The American approach is characterised by the Supreme Court’s strict interpretations of the First Amendment to the Constitution.

  In the case of ‘Freedom of Expression Coalition v. Paxton 2005 ’, the US Supreme Court considered an apparent constitutional challenge to Texas House Bill 1181 (H.B. 1181), which requires commercial entities that distribute sexually explicit content harmful to minors to implement reasonable age verification measures .

   The central constitutional debate in the Paxton case centred on the appropriate level of judicial scrutiny to be applied by the Supreme Court.

   Traditionally, regulations concerning content protected by freedom of expression are subject to strict scrutiny, the most stringent standard in constitutional law, which requires the government to demonstrate that the law is the least restrictive means of achieving a compelling .

   However, the majority opinion, delivered by Justice Thomas, held that Bill No. 1181 was subject only to intermediate scrutiny. in its ruling, the Supreme Court held that the state possesses the traditional authority to prevent minors from accessing speech which it deems obscene from its own perspective; consequently, adults are not entitled, under the First Amendment to the US Constitution, to access such speech without first providing proof of their age.

    Based on the principle established by the Supreme Court in United States v O’Brien, 1968 the majority described the age verification requirement as an ‘incidental burden’ on adults’ right to protected freedom of expression, rather than an outright prohibition

   Under the intermediate standard of judicial review (the intermediate constitutional scrutiny standard), the law was upheld because it advances a substantial government interest unrelated to the suppression of freedom of expression, and does not impose a greater burden on freedom of expression than is necessary.

    The Supreme Court noted that the requirement for age verification is a traditional, widespread and legitimate means of enforcing age restrictions, similar to the purchase of alcohol or firearms

  In a sharp dissenting opinion, Justice Elena Kagan—joined by Justices Sonia Sotomayor and Ketanji Brown Jackson—criticised this analysis, describing it as “entirely circular”. Rather than asking the correct constitutional question —“Does this law impose an unjustified burden on protected adult rights?”—

   the majority defined the constitutional right of adults from the outset as “a right subject to age verification”, and then logically concluded that the law did not violate that right; this is a clear circular logical fallacy that assumes the validity of the conclusion to be proven in order to evade the application of the strict scrutiny standard.

       The dissenting opinion (written by Justice Kagan) held that Texas House Bill 1181 imposes unjustified restrictions on the constitutional rights of adults by virtue of its communicative content—as a direct, content-based regulation—and must therefore be subject to strict scrutiny, in accordance with decades of case law, including the cases of Sable,  Playboy,  Reno and Ashcroft II.

  Justice Kagan emphasised that requiring adults to provide sensitive personal information in order to access controversial content imposes an unacceptable ‘chilling effect’, particularly on the internet, where users fear for their reputation, The dissenting opinion was written and drafted by Justice Elena Kagan and joined by Justices Sonia Sotomayor and Kay Tang Brown Jackson. It held that the law must be subject to strict scrutiny, with Justice Kagan and her colleagues arguing that the Texas law (H.B. 1181) for age verification constitutes a direct content-based restriction on adults’ constitutionally protected freedom of expression, thereby requiring it to be subject to the highest standard of judicial scrutiny in order to protect fundamental rights. Consequently, the dissenting opinion affirmed that if there is a less restrictive alternative (such as user-side content filtering) that could protect children to the same extent, the state must adopt it rather than unnecessarily burdening adult expression .

  

3. The Organisational Structure of the European Union: Market Integration and the Country of Origin Principle

   Unlike the dualistic framework based on the principle of separation between freedom of expression and the state’s freedom in the US Supreme Court’s case law, the European Union’s approach is closely intertwined with the rules of the internal market.

  Under Directive 2000/31/EC (the E-Commerce Directive), the ‘country of origin’ principle ensures that information society services are regulated exclusively by the Member State in which the provider is established, thereby preventing the targeted Member States from imposing additional regulatory burdens.

    In its landmark judgment delivered by the Grand Chamber on 16 June 2026, in the case of WebGroup Czech Republic and Others (joined cases C-188/24 and C-190/24), the Court of Justice of the European Union clarified the limits of Member States’ authority to regulate the protection of minors in the digital sphere.

    The Court of Justice of the European Union held that Articles 2(h) and 3 of Directive 2000/31/EC preclude any Member State from imposing a general and abstract obligation under criminal law to prevent minors from accessing pornographic content from service providers established in other Member States.

     These sweeping criminal obligations undermine the country-of-origin principle by going beyond the procedural and substantive safeguards set out in the Directive.

   These sweeping criminal obligations undermine the country-of-origin principle by going beyond the procedural and substantive safeguards set out in the Directive.

  However, the Court of Justice of the European Union has ruled that, provided there is strict compliance with Article 3(4) of Directive 2000/31/EC, Member States are not precluded from adopting measures requiring specific service providers to establish age-verification systems, provided that those providers have not implemented ,appropriate preventive measures under Article 28b of the Audiovisual Media Services Directive .

     These individual exceptions must be interpreted in the light of Article 1 (human dignity) and Article 24 (rights of the child) of the Charter of Fundamental Rights of the European Union .

   In doing so, the Court of Justice of the European Union established a regulatory framework: general, unilateral restrictions on targeted countries are prohibited, but age verification orders directed at specific platforms may be issued provided that the requirements for procedural consultation and notification are met.

  

4. Transposition of laws and litigation between Member States: France and Italy

   The practical contradiction between protection policies in the target countries and the European Union’s Internal Market legislation is clearly illustrated by recent administrative proceedings in Italy and France.

 4.1 The French Council of State (Conseil d’État)

   France has transposed the requirements for the protection of minors through amendments to Article 10 of Law No. 2004-575 on strengthening confidence in the digital economy, empowering the French national regulatory authority (Arcom) to impose age verification standards.

    In the case of Webgroup Czech Republic and NKL Associates (10 June 2025), the Council of State considered a priority constitutional question (QPC) challenging Article 10-2 of this Act.

   The applicants argued that the Act violates the principle of the personal nature of penalties because it penalises publishers for failures in the age verification system caused by third-party ‘trusted identity’ providers who operate the ‘double anonymisation’ protocol .

   For its part, the Council of State refused to refer the request for approval of age verification to the Constitutional Council, considering that the obligation to ensure age verification in accordance with the law remains a personal responsibility incumbent upon platform operators, and that the exclusion of third-party service providers from the direct scope of Arcom’s enforcement does not raise a fundamental constitutional issue.

    Shortly afterwards, in the case of Hami Media Ltd (xHamster) v Minister of Culture (15 July 2025), the Council of State quashed a court order that had suspended the ministerial decree

subjecting the xHamster website (hosted in Cyprus) to French age verification legislation.

   The Cypriot provider claimed that French law would cause severe economic losses as a result of user migration and a breach of the privacy rights of adult users.

    Under Article L. 521-1 of the Code of Administrative Justice, the suspension of a licence requires proof of an ‘emergency situation’ that outweighs the public interest. The Council of State held that the commercial and privacy-related objections did not satisfy this condition when weighed against the overriding public interest in protecting children from explicit pornographic material .

  

  4.2 The Italian Regional Administrative Court (TAR Lazio)

  In Italy, the Caivano Decree (Article 13-bis of Legislative Decree 123/2023) a general obligation for age verification on pornography platforms operating in Italy, delegating the technical rules to the Italian Communications Authority (AGCOM) .

    The Italian Communications Authority (AGCOM) issued Circular No. 96/25/CONS and subsequent lists of platforms subject to the obligation, thereby extending the age verification requirements to include EU service providers based abroad, including Aylo Freesites Ltd (registered in Cyprus) .

   As a result of this  Aylo challenged the proceedings on several grounds, including breaches of the data minimisation principle set out in the General Data Protection Regulation (GDPR) and the country of origin rule.

   The Lazio Administrative Court of Appeal dismissed the complaints relating to the General Data Protection Regulation and the substantive complaints, concluding that the Communications and Information Technology Authority’s ‘technologically neutral’ standards, adopted following consultation with the Data Protection Authority, respect the principle of data minimisation by prohibiting the retention of identity documents.

   However, the court annulled the automatic extension of the requirements to foreign platforms established in the European Union, as the Italian Communications Authority (AGCOM) had completely disregarded the mandatory procedural requirements laid down in Article 3(4)(b) of Directive 2000/31/EC .

   Under this rule, before any Member State can restrict an information society service from another Member State, it must first formally request the home Member State (Cyprus) to take precautionary measures and notify the European Commission. 

  As the Italian Communications Authority (AGCOM) had not followed this procedure, the Italian court partially annulled the measure, emphasising that host states may not unilaterally impose restrictions on freedom of expression across the borders of the European Union without due regard for the rule of law.

 

5. The United Kingdom and the dynamics of collaborative platforms:

The Online Safety Act 2023

    The ongoing debate in the United Kingdom highlights how broad legislative definitions of digital technologies can inadvertently threaten non-profit digital infrastructures that serve the public interest.

   Under the UK’s Online Safety Act 2023 (OSA), ‘Category 1’ online services are subject to extensive legal obligations, including a duty to ‘empower users’ under Section 15 to allow users to filter out content from unverified accounts .

     In the case of Wikimedia Foundation and Others v Secretary of State for Science, Innovation and Technology (11 August 2025), the host of the Wikipedia website challenged the threshold regulations set out in the Online Safety Act. The Wikimedia Foundation argued that Wikipedia’s collaborative editing model – in which anonymous and attributed edits are dynamically merged – is functionally incompatible with an identity verification mechanism.

    Isolating edits from unverified users would render the encyclopaedia unusable, which would constitute a breach of Article 10 (freedom of expression) of the European Convention on Human Rights.

  The High Court, presided over by Judge Johnson, dismissed the European Convention on Human Rights claims as premature.

   Applying the strict ‘victim status’ criteria reaffirmed by the European Court of Human Rights in the case of ‘Swiss Anti-Espionage Association v. Switzerland’, the court ruled that, as the Office of Communications (Ofcom) had not finalised the Category 1 listing or classification of Wikipedia, the applicants had failed to establish a ‘risk of a future breach’ with sufficient concreteness.

     As regards the substance of the challenges relating to the interpretation and rationality of the law, the court upheld the Secretary of State’s regulations, ruling that the Secretary of State had acted rationally in relying on high-quality research carried out by Ofcom, and that the legislature was entitled to set objective and broad criteria rather than ad hoc decisions.

 

6. Comparative Analysis and Judicial Interpretation

    Comparative analysis and judicial interpretation reveal differing legal classifications of the same legal issue and the technical burden involved.

   In the United States, age verification is considered an incidental, content-neutral burden and is assessed under moderate judicial constitutional scrutiny, thereby reducing the constitutional obstacles facing the states .

   While in the European Union, whilst the substantive right to the protection of minors is highly valued, the legal system focuses on the country-of-origin rule and the strict two-tier procedural approach under Article 3(4) of the E-Commerce Directive . 

  Administrative cases in France and Italy show that platforms established in EU Member States (such as Cyprus) are protected from abuses by the host state, unless those states fully comply with the requirements for notification and consultation.

   Finally, the UK’s experience serves as a warning that a failure by legislative bodies to narrow the scope of definitions may ensnare non-commercial collaborative platforms serving the public interest, such as Wikipedia, thereby threatening to fragment the open internet under the guise of safety.

 

7. Conclusion

Striking a balance between freedom of expression and child protection in the digital age is not merely a technical challenge, but a matter central to the constitutional framework.

 Recent judicial consensus agrees on the urgent need to protect minors. However, the legal approaches taken vary considerably: the United States applies a lenient standard of scrutiny with regard to ‘incidental’ restrictions, whilst the European Union imposes a strict procedural framework to preserve the single digital market; administrative courts exercise close oversight of regulatory compliance.

  As digital platforms continue to evolve, the challenge remains to implement verification systems that are secure, privacy-preserving and procedurally sound, protecting children without fragmenting the global flow of knowledge or restricting adults’ freedom of expression online.

 

The End of Immunity for Internet Service Providers? C-188/24 WebGroup Czech Republic and NKL Associates and C-190/24 Coyote System, judgment 16 June 2026

 

Lorna Woods, Professor Emerita, University of Essex

Photo credit: TodayTesting.com, via Wikimedia Commons   

This recent CJEU judgment has been flagged in some quarters as upholding the French rules requiring age verification for porn sites. In others, it has been seen as stripping intermediary immunity from social media sites. Based on the e-Commerce Directive, however, is this just a transient discussion, fading away as the Digital Services Act (DSA) becomes the relevant law?

 

The Facts

 

The national cases in Case C-188/24 concern French rules requiring porn operators to implement technical age verification mechanisms to prevent minors from accessing those sites.  The companies were each the subject of a formal notice pursuant to Decree No 2021/1306 implementing Law No 2020-936 and Article 227-24 of the Criminal Code which prohibits any person from broadcasting a pornographic message likely to be seen by a minor. The rules in Coyote System concern the restriction on the broadcasting of information to drivers about roadside checks (eg in relation to speed or drunk driving). The relevant implementing measures were also derived from the French criminal code. These measures were subject to judicial challenge before the French Conseil d’État. The companies in question were not established in France and questioned the applicability of the French rules.

 

The Issues

 

The first question the CJEU had to address was whether the measures fell within the coordinated field of the  e-Commerce Directive (Directive 2000/31) and would therefore be caught by Article 3, which provides for the country of origin principle (COOP). Recital 22 which states that ‘information society services should be supervised at the source of the activity’. This means that services in general comply with the domestic law of the State in which they are established and do not have to comply with the laws of the States in which their services are capable of being accessed.  Article 3(3) excludes certain areas from the coordinated field and Article 3(4) et seq provide for limited grounds of derogation from the COOP and provide conditions with which the receiving State must comply to access the derogation.   The COOP applies only to laws falling within the coordinated field. Here the relevant laws were not sector specific measures targeting information society services in particular, but the general criminal law. The referring court questioned whether the provisions in issue fell within the coordinated field and referred the issue to the CJEU.

 

The ban on transmission in Coyote System was, according to the applicant, contravening the prohibition on general monitoring found in Article 15 e-Commerce Directive. This application of this article is dependent on the information society services in question falling within one of the categories of service found in Articles 12-14 e-Commerce Directive (mere conduit, caching services or hosting services respectively). The Court thus then had to consider whether the service in Coyote System was a hosting service within the meaning of Article 14 e-Commerce Directive. Article 14(1) provides:

 

Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that:

 

(a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or

(b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information.

 

Judgment

 

The Coordinated Field

 

The Court emphasised that the coordinated field

 

covers all requirements laid down by the legal systems of the Member States relating to the taking up or pursuit of the activity of an information society service, … that definition does not make the coordinated field subject to the condition that only matters harmonised by that directive are covered. [para 52]

 

Following the Advocate General (at para 56 of his Opinion), it remarked that Article 3 is of particular importance precisely for the areas of law not harmonised. The mere fact that the laws apply generally cannot remove them from the coordinated field. Moreover, the Directive excludes certain areas from the scope of the Directive, so the question of exclusion had been taken into account in the Directive. Taking a different approach would undermine the purpose of the Directive.

 

The Court confirmed that requiring age verification sets the conditions for access to the information society services and is a requirement concerning the pursuit of an activity within Article 2(h)(i) (see Case C-649/18 A (Advertising and sale of medicinal products online)). For the roadside broadcasts, the Court took the view that the prohibition constituted a requirement relating to the content of the service. Both sets of measures therefore fall within the coordinated field.

 

The COOP and Derogation

 

The key question for the application of the COOP was whether the measures restricted the free movement of the services. This question the Court answered in the affirmative before considering whether the derogation in Article 3(4) could be used.

 

The derogation has substantive and procedural conditions. Substantively, the measure must be necessary in the interests of one of more of: public policy; protection of public health; public security; or protection of consumers. Further, those measures should be taken against an information society service which actually prejudices those objectives or presents a serious and grave risk to those objectives. Finally, the measures must be proportionate to the objectives. In procedural terms, the recipient Member State must first have issued an unsuccessful request to the host Member State to fix the issue and, secondly, notified the Commission.  A failure to comply renders the obligations unenforceable (Case C-390/18 Airbnb Ireland – following long established case law).

 

General rules applying without distinction do not satisfy the second of the substantive conditions. The rules, however, provided for the issuing of individual notices which satisfy this requirement [para 90]. The third substantive element – that of proportionality – was satisfied in relation to the protection of human dignity and the rights of the child as regards the broadcasting of pornography [para 94] and, without much elaboration, the prohibition on rebroadcasting is also proportionate [para 96]. 

 

So in principle, the national rules could meet the substantive criteria but it was for the referring court to determine whether the procedural rules were satisfied.

 

General Monitoring

 

Hosting

 

As noted above, the possibility of relying on Article 15 depends on whether the service in issue – here the service in Coyote System - is a host within the scope of Article 14 [see para 105]. The Court noted that the definition of hosting did not automatically preclude a service which also has elements of broadcasting from being a host, referring to long-standing caselaw as well as more recent (Case C-360/10 SABAM; Case C-682/18 YouTube and Cyanado and Case C-401/19 Poland v Parliament and Council). Conversely, just because a service includes the storage of information does it mean that the service is a host for the purposes of Article 14. The Court reiterated the limitations arising from Recital 42 – that the services should be of a mere technical, automatic and passive nature. This implies, according to the Court’s case law (Case C-324/09 L’Oréal and Case C-682/18 YouTube and Cyanado), “the information society service provider has neither knowledge of nor control over the information which is transmitted or stored” [para 108].  The Court underlined that “those two conditions requiring knowledge and control should be understood as being alternative to and independent of each other” [para 110].  The Court then held that

 

if, beyond the mere categorisation and indexation of information for the purpose of improving its accessibility, the algorithm used determines, in the interest of the operator or its service, under what conditions, how and in which order of priority that information is or is not be broadcast, that operator exercises control over that information, with the result that the service it offers cannot be classified as an ‘information society service … that consists of the storage of information provided by a recipient of the service’ [para 112].

 

Impact on Article 14(3) and Article 15

 

If a service exercises control over content, it does not fall within Article 14 and therefore the restrictions imposed on Member States by Article 15 are not applicable to such are service. The questions were for the national court to determine.

 

On the assumption that the service were found to be neutral, the national court must decide whether the prohibition on rebroadcasting the information on roadside checks is permitted by Article 14(3) which concerns orders requiring a neutral host to terminate any infringement on the part of the recipient of the service due to, inter alia, the presence of illegal information stored on its website or on its platform by removing or blocking access to that information.

 

Considering Article 15, the Court referred to Recital 47 e-Commerce Directive, which clarifies that Article 15 does not apply to monitoring in specific cases. Referring to the test laid down in Glawischnig-Piesczek (Case C-18/18), paras 46 and 47, the Court noted in this case that the information targeted by the prohibitions “is circumscribed in such a way that its rebroadcasting may be automatically prevented by the operator concerned” [para 121].

 

 

Comment

 

Coordinated Field and COOP

 

The Court has taken a typical approach here, a broad approach to the areas covered: criminal law rules and public policy rules can fall within the scope of the directive, provided they impose requirements on the access or conduct of an information society service. Furthermore, none of the criminal law in general, public policy and public security measures appear on any of the exclusions from the scope of the directive. The Court’s ruling makes explicit that this absence from the exclusions is deliberate. This position is in the interests of ensuring that a service is not subject to multiple regulation, but it can lead to unevenness and gaps in protection from the viewpoint of a person expecting the rules of the member state in which they reside to apply to services providers providing services in that self-same Member State. This is especially the case when the aspect potentially taking the national rule outside the derogation regime is about its form, not its substance.  The COOP principle has long given rise to concerns about forum shopping and a race to the bottom (as can be seen also in the broadcasting sector and the Audiovisual Media Services Directive) but has been re-affirmed as a central tenet of the EU regime (see eg Case C-769/22 Commission v Hungary (Values of the European Union)). 

 

It is also worth noting that the Court in principle accepted that both sets of rules in the cases referred were aimed at achieving legitimate aims and were proportionate. The Court drew on the fact that the AVMSD requires age verification in relation to pornography to reach this latter assessment. In so doing, the Court engaged in a joining up the dots activity between different piece of EU digital legislation. 

 

In this ruling, the Court underlined both the importance of the right to human dignity and the rights of the child.

 

Impact on Article 14

 

The headline news from this ruling is the impact on Article 14 and the test for neutral intermediary. The hosting safe harbour in Article 14 was always meant for neutral, passive intermediaries – entities whose activity is “purely technical, automatic and passive”, implying that the provider “has no knowledge of or control over” the information stored (Recital 42 e-Commerce Directive). This has been the standard position since the early case law – for example L’Oreal.  What this means, and in particular the impact of automated tools, has been the subject of some discussion. In a different context (copyright infringement), the Court even if an operator automatically indexes infringing content to recommended videos based on each users’ use did not necessarily mean that the host had specific knowledge of the infringing content, and the Court determined that this sort of specific knowledge was what was required. This could be seen as quite a generous view towards the hosting services and the scope of immunity. It might almost be said that there was an assumption that platforms would benefit from Article 14 (provided they responded to notices). In Coyote there is a shift of focus.

 

The first point to note is the Court’s statement that hosting services do not automatically benefit from Article 14. While this is not new – and, indeed, can be seen the Court’s previous jurisprudence – the reminder feels significant, especially in the light of the rest of the ruling. The Court here confirmed that a service has to satisfy both the knowledge and the control tests, a point not laboured in previous judgments. The Court (at para 110) makes this really clear: if a service exercises control, even if it has no knowledge, it will fall outside the intermediary immunity provision.

 

Whereas Cyanado dealt with knowledge, System Coyote looks at control. Significantly, the Court held that algorithmic curation constitutes “control”.  The Court (following its Advocate General) held (para 111):

 

it is, inter alia, by means of the algorithm used that such an operator exercises control over the information stored. So long as it has predetermined, by means of that algorithm, the conditions under which such information may or may not be broadcast, it is irrelevant that that operator does not itself carry out additional interventions which have the effect of promoting, modifying or deleting information stored with a view to it being broadcast.

 

In other words, when a service which stores information uses an algorithm to determine – in its own interest or that of its service – under what conditions, in what manner, and in what order of priority information is or is not disseminated it has control (see para 112). It does not matter that this is automatic. So creating the algorithmic system is exercising control.  In focussing on control, the Court avoids outright conflict with its earlier position (for example in Cyanado), but it certainly signals a change in emphasis and (in line with thinking underpinning parts of the DSA) a recognition that the algorithm is not necessarily neutral.

 

Not all categorisation or prioritising satisfies the control test. Simple categorisation and indexing of information to improve its accessibility do not on their own constitute control. Essentially, the Court is trying to draw the line between a neutral index, or chronological feed, and something more editorial (and it is telling to remember that the services themselves have claimed first amendment rights – is relating to their speech – in relation to how results are provided). 

 

Nonetheless, this ruling will affect a wide range of services based on curating user generated content, from social networks, video-sharing services and – of course – services that rebroadcast user reports (eg about police checks), as well as recommended products on a marketplace. The judgment could be read as stripping most (if not all) of the large social media platforms of their immunity (though this does not mean they will automatically be liable in all cases – that will depend on national law and the facts in individual cases). It could also be said to follow a similar path to the Russmedia decision (Case C-492/23), discussed here, which also took a narrow view of immunity (hosting defence does not apply to liability under the GDPR).

 

Impact on Article 15

 

The prohibition on general monitoring only relates to those services covered by intermediary immunity. Although this follows the language of Article 15(1) there had been some dispute as to who could claim the protection of Article 15. The answer is now clear: fall outside Article 14 (or 12 or 13) and Article 15 does not apply. 

 

The Court also reiterates its position on the distinction between general and specific monitoring and highlighting the possibility of using automated techniques to identify particular types of content. This could be relevant for Member States’ ability to impose monitoring or filtering obligations (in services of some public interest) – these (in relation to copyright infringements, e.g. SABAM, above) had been thought problematic in the relatively early days of the e-Commerce Directive, and platforms have often challenged such obligations as constituting general monitoring. The Court’s discussion here is focussed tightly on content; it does not discuss behavioural monitoring or profiling (which might be techniques by services to reduce the incidence of illegal content or behaviour across their services). It will be interesting to see how this line of case law joins up with the jurisprudence under the e-Privacy directive on collection of metadata and intrusions into communications privacy (see eg Case C-746/18 Prokurator).

 

Impact on DSA

 

Article 6 DSA, which replaces Article 14 e-Commerce Directive, provides that hosting providers are not liable for information stored at the request of a recipient of the service, provided that they do not have actual knowledge of illegal activity or content, unless the recipient acts under the authority  “or control” of the provider. It has been assumed given the similarity in the text, that the case law on Article 14 is relevant for understanding Article 6 DSA, including as regards the threshold condition of neutral. The wording of the relevant recitals in the DSA differ, however, from the text in the e-Commerce Directive (noted above) – and the Court has relied heavily on that text in its interpretation of Article 14.  Indeed, Article 14 itself does not refer to control. Recital 22 DSA specifies:

[i]n order to benefit from the exemption from liability for hosting services, the provider should, upon obtaining actual knowledge or awareness of illegal activities or illegal content, act expeditiously to remove or to disable access to that content. … The provider can obtain such actual knowledge or awareness of the illegal nature of the content, inter alia, through its own-initiative investigations or through notices submitted to it by individuals or entities in accordance with this Regulation in so far as such notices are sufficiently substantiated to allow a diligent economic operator to reasonably identify, assess and, where appropriate, act against the illegal content. However, such actual knowledge or awareness cannot be considered to be obtained solely on the ground that the provider is aware, in a general sense, of the fact that its service is also used to store illegal content. Furthermore, the fact that the provider automatically indexes information uploaded to its service, that it has a search function or that it recommends information on the basis of profiles or preferences of the recipients of the service is not a sufficient ground for considering that provider to have ‘specific’ knowledge of illegal activities carried out on that platform or of illegal content stored on it. [emphasis added]

 

At first glance, the recital seems to contradict the ruling in Coyote System. The wording of the recital seems to follow the approach the Court adopted in Cyanado and like that judgment deals with the question of knowledge. We have noted earlier, the Court’s sidestep in this case, to talk about control. The recital says nothing about control and is therefore not inconsistent with the approach in Coyote System.  Of course, this means that there is no reference to “control” in the text of the DSA because Article 6, like its predecessor Article 14, is silent on the point. It is far from clear, however, that the change in wording in the recital was intended to mark a change in meaning from Article 14 resulting in an expansion of the scope of immunity. Rather it seems an intention to align the DSA with the case law on Article 14 e-Commerce Directive. Presumably, there will be much litigation on this point as well as the linked question as to where the boundary between control and “mere categorisation and indexation of information” [para 112].

EU Media Freedom Act: the convolutions of the new legislation

 

Samira Asmaa Allioui, research and tutorial fellow at the Centre d'études internationales et européennes de l'Université de Strasbourg

 

Photo credit: Bin im Garten, via Wikimedia Commons

 

Journalists are under pressure in different ways. Throughout the last few years, media freedom and especially media pluralism are in peril.

On December 15, 2023, the European Council and the European Parliament struck a deal on rules to safeguard media freedom, media pluralism and editorial independence in the European Union. The EU Media Freedom Act (EMFA) promised increased transparency about media ownership and safeguards against government surveillance and the use of spyware against journalists. The agreement comes after numerous revisions of the Audiovisual Media Services Directive (AMSD) and new regulations such as the Digital Market Act (DMA) and Digital Services Act (DSA). As a reminder, the EMFA builds on the DSA.

The aim of this contribution is to present an overview of the EMFA and specifically to analyse to what extent its rules still contribute to the limitation of freedom of speech, the erosion of trust, the breach of democratic processes, disinformation, and legal uncertainty.

The EMFA requires EU countries to respect editorial freedom, no spyware, no political interference, stable funding for public media, protection of online media and transparent state advertising.  It established a European watchdog: a new independent European Board for Media Services to fight interference from inside and outside the EU.

Nevertheless, this new EU legislation tries to set boundaries for the journalists’ actions through Article 18 EMFA on the protection of media content on very large online platforms (VLOPs), and the potential detrimental effects of introducing something akin to a media exemption. But the most significant ambiguity is addressed by Article 2 of the EMFA on the definition of ‘media service’ which appears to be the problem everyone acknowledges. This raises the question of who the EMFA is protecting. Are democracy and the possibility for people to get impartial and unbiased information really strengthened? Not forgetting that for the European Parliament elections, there is a potential danger of political interference by extra-European countries that will try to take advantage of democratic elections to influence the media illegally, by creating fake social media accounts and by launching a massive propaganda campaign to disseminate conflict-ridden content.

 

THE ACCURACY OF INFORMATION

The EMFA focuses on two main points regarding VLOPs. First, it asserts that platforms limit users’ access to reliable content when they apply their terms and conditions to media companies that practice editorial responsibility and create news conforming with journalistic standards. First, the Regulation takes aim at VLOPs’ gatekeeping power over access to media content. To do so, the EMFA aims to remould the relationship between media and platforms. Media service providers that exercise editorial responsibility for their content have a primary role in the dissemination of information and in the exercise of freedom of information online. In exercising this editorial responsibility, they are expected to intervene diligently and provide reliable information that complies with fundamental rights, in accordance with the regulatory or self-regulatory requirements to which they are subject in the Member States.

Secondly, it asserts that the quality of the media may fight against disinformation. To consider this problem, the EMFA’s objective is to adjust the connection between platforms and media. According to Article 2 EMFA, ‘media service’ means ‘a service as defined by Articles 56 and 57 [TFEU], where the principal purpose of the service or a dissociable section thereof consists in providing programmes or press publications, to the general public, under the editorial responsibility of a media service provider, by any means, in order to inform, entertain or educate’  A ‘media service’ has some protections under the Act.  According to Joan Barrata, the media definition under EMFA is an overly “limited” definition, which is not “aligned” with international and European human rights standards, and “discriminatory”, as it excludes “certain forms of media and journalistic activity”. The DSA classifies platforms or search engines that have more than 45 million users per month in the EU as VLOPs or Very Large Online Search Engines (VLOSEs). As an illustration, according to Article 18 EMFA, media service providers will be afforded special transparency and contestation rights on platforms. In addition to that, according to Article 19 EMFA, media service providers will have the opportunity to engage in a constructed dialogue with platforms on concepts such as disinformation. Under the agreement, VLOPs will have to inform media service providers that they plan to remove or restrict their content and give them 24 hours to answer (except in the event of a crisis as defined in the DSA).

Article 18 of the EMFA enforces a 24-hour content moderation exemption for media, effectively making platforms host content by force. By making platforms host content by force, this rule prevents large online platforms from deleting media content that violates community guidelines. Nevertheless, not only it could threaten marginalised groups, but it could also undermine equality of speech and fuel disinformation. This is a vicious circle between the speaker planting false information on social media, the media platform spreading the false speech thanks to amplifying algorithms or human-simulating bots, and the recipients who view the claims and spread them.

According to the EMFA provides that, before signing up to a social media platform, platforms must create a “special/privileged communication channel” to consider content restrictions with “media service providers”, defined as “a natural or legal person whose professional activity is to provide a media service and who has editorial responsibility for the choice of the content of the media service and determines the manner in which it is organised “. In other words, instead of being forced to host any content, online platforms should provide special privileged treatment to certain media outlets.

However, not only does this strategy impede platforms’ autonomy in enforcing their terms of use (nudity, disinformation, self-harm) but it also imperils the protection of marginalised groups who are frequently the main targets of disinformation and hate speech. Politics remains fertile ground for hate speech as well as disinformation. Online platforms and social media have played a key role in amplifying the spread of hate speech and disinformation. As proof, recent reports reveal the widespread abuse of these platforms by political parties and governments. Indeed, it turns out that more than 80 countries around the world have engaged in political disinformation campaigns.

This could also permit misleading information to remain online which allows sufficient time to see the information transmitted and disseminated, hindering one of the key objectives of EMFA - to give more reliable sources of information to citizens.

ABUSIVE REGULATORY INTERVENTION AND DETERIORATION OF TRUST

Primarily, one can only be concerned about any regulatory intervention by governments on issues such as freedom of expression or media freedom. Through their EU Treaty competencies in security and defence matters, EU Member States seem to be winning because their options to spy on reporters have been reaffirmed. However, according to the final text (April 11, 2024), the European Parliament added important guarantees to allow the use of spyware, which will only be possible on a case-by-case basis and subject to authorization from an investigating judicial authority as regards serious offenses punishable by a sufficiently long custodial sentence.

Furthermore, it must be emphasized that even in these cases the subjects will have the right to be informed after the surveillance and will be able to challenge it in court. It is also specified that the use of spyware against the media, journalists and their families is prohibited. In the same vein, the rules specify that journalists should not be prosecuted for having protected the confidentiality of their sources.

The law restricts possible exceptions to this for national security reasons which fall within the competence of member states or in cases of investigations into a closed list of crimes, such as murder, child abuse or terrorism. Only in such situations or cases of neglect, the law makes it very clear that this must be duly justified, on a case-by-case basis, in accordance with the Charter of Fundamental Rights, in circumstances where no other investigative tool would be adequate.

In this regard, the law therefore allows for new concrete guarantees at EU level in this regard. Any journalist concerned would have the right to seek effective judicial protection from an independent court in the Member State concerned. In addition to that, each Member State will have to designate an independent authority responsible for handling complaints from journalists concerning the use of spyware against them. These independent authorities provide, within three months of the request, an opinion on compliance with the provisions of the law on media freedom.

Some governments in Europe have tried to interfere in the work of journalists recently which is a blatant demonstration of how far politicians can go against media using national security as an excuse. To avoid an erosion of trust, media service providers must be totally transparent about their ownership structures. That is why, in its final version (April 2024), the EMFA enhances transparency of media ownership, responding to rising concerns in the EU about this issue. The EMFA broadens the scope of the requirements of transparency, providing for rules guaranteeing the transparency of media ownership and preventing conflicts of interest (Article 6) as well as the creation of a coordination mechanism between national regulators in order to respond to propaganda from hostile countries outside the EU (Article 17).

To do that, there is a need to deepen safeguards to shield all media against economic capture by private owners to avoid media capture. It can be worse when no official intervention can mean non-transparent and selective support for pro-government media. As a matter of fact, it demonstrates that a combination of political pressure and corruption can be risky for the free press.

Secondly, the EMFA’s content moderation provisions could ruin public trust in media and endanger the integrity of information channels. Online platforms moderate illegal content online. Moderation provisions include: a solution-orientated conversation between the parties (VLOPs, the media and civil society) to avoid unjustified content removals; obligatory annual reporting (reports on content moderation which must include information about the moderation initiative, including information relating to illegal content, complaints received under complaints-handling systems, use of automated tools and training measures) by very large online platforms (VLOPs); any complaint lodged under complaints-handling systems by media service providers must be processed with priority; and additional protection against the unjustified removal by VLOPs of media content produced according to professional standards. These platforms will need to take every precaution to communicate the reasons for suspending content to media service providers before the suspension becomes effective. The process consists of a series of safeguards to ensure that this rapid alert procedure is consistent with the European Commissions’ priorities such as the fight against disinformation. In this regard, the Electronic Frontier Foundation states that « By creating a special class of privileged self-declared media providers whose content cannot be removed from big tech platforms, the law not only changes company policies but risks harming users in the EU and beyond ».

MEDIA COMPANIES AND PLATFORMS BARGAINING CONTENT

Yet the EMFA still does not deal with the complex issue of who would oversee controlling the self-declarations (Article 18(1) EMFA). More precisely, according to Article 18 EMFA “Providers of [VLOPs] shall provide a functionality allowing recipients of their services to declare” that they are media service providers. This self-declaration can be done, mainly, according to three criteria: if public service media providers fulfill the definition of Article 2 EMFA; if public service media providers “declare that they are editorially independent from Member States, political parties, third countries and entities owned or controlled by third countries”; and if public service media providers “declare that they are subject to regulatory requirements for the exercise of editorial responsibility in one or more Member States” or adhere “to a co-regulatory or self-regulatory mechanism governing editorial standards that is widely recognised and accepted in the relevant media sector in one or more Member States”. According to Article 18(4), when a VLOP decides to suspend its services regarding the content provided by a self-declared media service provider, “on the grounds that such content is incompatible with its terms and conditions”, it must “communicate to the media service provider concerned a statement of reasons” accompanying that decision “prior to such a decision to suspend or restrict visibility taking effect”.

Aside from that, Article 18 EMFA  splits the rules implemented by the Digital Services Act (DSA), a horizontal instrument that aims to create and ensure a more trustworthy online environment by putting in place a multilevel framework of responsibilities targeted at different types of services and by proposing a set of asymmetric obligations harmonized at EU level with the aim of ensuring regulatory oversight of the EU transparency, online space and accountability. Those rules covering all services and all types of illegal content, including goods or services are set by the DSA. This implies that media regulators will be enrolled in the cooperation mechanisms that will be set up for the aspects falling under their mandate. The inception of a specific “structured cooperation” mechanism is intended to contribute to strengthening robustness, legal certainty, and predictability of cross-border regulatory cooperation. This entails enhanced coordination and more precisely collective deliberation between national regulatory authorities (NRAs) which can bring significant added value to the application of the EMFA. This implies that media regulators will be involved in the cooperation mechanisms that will be set up for the aspects falling under their remit, even if it is still unclear how this will look in practice.

Above all, how will the new legislation be applied in practice and how will it work to ensure that it neither undermines the equality of speech and democratic debate nor endangers vulnerable groups? Excluding the fact that Article 18 of the EMFA incorporates safeguards about AI-generated content, details about which remain undisclosed as of now (see also Hajli et al on ‘Social Bots and the Spread of Disinformation in Social Media’ and Vaccari and Chadwick on ‘Deepfakes and Disinformation’), there is clearly reason to be concerned about the use of generative AI to promote disinformation and deep fakes. In an era where new technologies dominate, voluntary guidelines are not enough. Stronger measures are urgently needed to balance free speech and to have control over AI systems. It is admitted that while AI can be an excellent tool for journalists, it can also be used for bad purposes.

 

INEQUALITY BETWEEN MEDIA PROVIDERS: THE ATTRIBUTION OF A SPECIAL STATUS

In terms of platforms and media companies negotiating content, since not all media providers (media companies negotiating content) will receive a special status, it creates inequality. Platforms will have to guarantee that most of the reported information is publicly accessible. The main privilege resulting from this special status is that VLOP providers are more restricted in the way they moderate the content, but not in the sense of a ban on acting against this content but rather in the form of advanced transparency and information towards the information provider concerned. This effectively leads to an uncertain negotiation situation in which influential media and platforms negotiate over what content remains visible. This is especially true since the media have financial interests in seeking a rapid means of communication and in ensuring that their content remains visible even if it is at the expense of small providers.

CONCLUSION

As a conclusion, the risk to tamper with public opinion by disguising disinformation and propaganda as legitimate media content is still reflected in Article 18’s self-proclamation mechanism. In top of that, the risk of establishing two categories of freedom of speech arises from the fragmentation of legislation, not aligning with the DSA. Then, our capacity to create informed decisions could be undermined by Article 18 EMFA, an article that allows self-proclaimed media entities to operate with insufficient oversight. Furthermore, our democratic processes risk to be severely damaged by the unregulated spread of disinformation. Finally, the opacity of Article 18 in the determination of the authenticity of self-proclaimed media engenders problems of compliance enforcement.

The elements recalled here highlight the underside of the new legislation and corroborates that efforts must be made in the future to remedy the critical situation of press freedom within the EU.