CJEU rules online marketplaces responsible for ad data under GDPR

Online marketplaces are now responsible for personal data appearing in advertisements on their platforms, following a ruling by the Court of Justice of the European Union (CJEU) on Tuesday. The decision mandates that platforms must obtain consent from individuals whose data is featured in ads and verify these advertisements before they are published, particularly when sensitive information is involved, as reported by The Cyber Express.

The ruling stems from a 2018 incident in Romania where a fake advertisement on publi24.ro falsely depicted a woman offering sexual services, using her photos and phone number without consent. Although the ad was removed within an hour, it had already been copied elsewhere. The CJEU has now clarified that operators like the one in this case are considered data controllers under the General Data Protection Regulation (GDPR) for personal data within ads. This means platforms must proactively check ads for personal or sensitive data, verify the identity of the advertiser or obtain explicit consent from individuals featured, and refuse ads that lack proper verification or consent. They must also implement measures to prevent ads from being copied and reposted on other sites.

This CJEU decision significantly impacts data protection across the 27 EU member states, establishing a new standard for compliance. Online marketplaces can no longer rely on hosting service exemptions and must integrate robust data verification and consent mechanisms into their operational processes. The ruling increases operational risks for these platforms, necessitating stronger risk management strategies. 

Source: The Cyber Express