On 2 December 2025, the CJEU handed down judgment in case C-492/23 which related to a personal advertisement having been placed on an online marketplace including a picture of an individual who had not consented to the use of the picture.
The CJEU held that the operator of the online marketplace is a data controller for personal data contained in adverts and so such operators must, before publication, identify where adverts contain sensitive personal data, check whether the person submitting the advert is the data subject and if not, check whether the data subject has given their explicit consent to the publication of the advert or that a relevant exemption provided for in the GDPR applies. The CJEU added that the marketplace operator must also ensure adverts cannot be copied and unlawfully published on other sites and that the exemption from liability under the e-commerce directive does not relieve online marketplace operators of these obligations.
The press release in relation to the judgment can be found here.
