CJEU to decide whether Facebook is liable for user posts its algorithm promotes

On 27 October 2026, Germany’s Federal Court of Justice (Bundesgerichtshof, BGH) stayed case VI ZR 64/24, brought by politician Renate Künast against Meta Platforms, and referred six questions to the Court of Justice of the European Union. The answers will determine whether a social network with an algorithmic feed keeps the hosting safe harbour, whether it can be ordered to find and manually assess “equivalent” unlawful posts on its own, and whether hosting status shields it from damages claims under the GDPR.

The problem

EU law on the liability of online intermediaries is built on the model of a passive host. Article 14 of the E-Commerce Directive (2000/31/EC) exempts a provider from liability for third-party information as long as it has no knowledge of its illegality and removes it expeditiously once notified. Article 15 of the same Directive bars any general monitoring obligation. The Digital Services Act (Regulation (EU) 2022/2065, DSA) carried both rules over into Articles 6 and 8.

The model assumes that a host merely stores content and has no say in how it spreads. Facebook’s feed does not work that way. Meta’s algorithm decides which post a user sees, in what order and how often. That raises the first legal question: does such a service remain the “neutral intermediary” the safe harbour was designed for?

The second question sits at the intersection with data protection law. Article 2(4) GDPR states that the Regulation is without prejudice to the liability rules for intermediaries. Article 1(5)(b) of the E-Commerce Directive and Article 2(4)(g) DSA, for their part, leave data protection law untouched. Each instrument defers to the other, and for years it was unclear which prevails when a user’s post contains a third party’s personal data.

The third question is practical. A fake quote lives on a social network in dozens of variants. If the victim has to report every copy separately, judicial protection becomes a formality. If the platform has to find every copy itself, it risks the very general monitoring that EU law prohibits.

The facts

Renate Künast is a member of the Bundestag for Alliance 90/The Greens and a former federal minister. A meme circulating on Facebook combines her photograph, her name, her party’s name and a quote she never said: “Integration begins with you, as a German, learning Turkish!” The meme was uploaded and shared under different URLs and in different variants. Some variants carry captions that comment on the image or distance themselves from it, but in the examples before the court insults directed at the claimant predominate.

Ms Künast notified Meta of the original meme and 8 equivalent ones, giving the URL of each. The company removed them over time, and these 9 posts are no longer part of the claim. The claimant seeks an injunction against all identical and equivalent memes on the platform, without having to name new URLs each time, plus at least €10,000 in compensation for non-material damage. The court found that similar memes can be detected automatically, but whether a given captioned variant conveys the impression that the quote is the claimant’s cannot be determined by purely automated means.

Meta argues that, as a neutral hosting provider, it must remove only posts specifically identified to it and need not search the platform for further infringements, since establishing equivalence requires a manual review of every post.

On 8 April 2022, the Regional Court of Frankfurt am Main (case 2-03 O 188/21) granted the claim in full. On 25 January 2024, the Higher Regional Court of Frankfurt (case 16 U 65/22) upheld the injunction but rejected the compensation claim, citing a legal question that was still unresolved at the time. Both parties appealed on points of law. After a hearing on 18 February 2025, the BGH stayed the proceedings pending the CJEU’s judgment in Russmedia. Once that judgment was delivered, it held a second hearing on 27 October 2026 and made its own reference.

The lower courts relied on Sections 1004 and 823 of the German Civil Code, the classic German tools of injunctive relief and tort liability. The BGH pointed out to the parties that Articles 17 and 82 GDPR and Articles 6(4) and 8 DSA may also apply. The Senate does not question that the claimant’s rights were violated. The dispute is about who must stop the violation, and to what extent.

CJEU precedents

L’Oréal v eBay (C-324/09, 2011). The Court tied the safe harbour to the provider’s neutral role. An operator that optimises the presentation of offers or promotes them plays an active role and cannot rely on Article 14 of the Directive.

Glawischnig-Piesczek v Facebook Ireland (C-18/18, 3 October 2019). The claimant was an Austrian Green politician; the defendant was Facebook. The Court allowed national courts to order a host to remove not only identical but also equivalent information, provided that the differences in wording do not require the provider to carry out an independent assessment of the content and that it can rely on automated search tools. That condition is the crux of the Künast case, because captioned memes cannot be told apart without human judgment.

YouTube and Cyando (C-682/18 and C-683/18, 22 June 2021). The Court held that automatic indexing of uploaded content does not, by itself, give a platform specific knowledge of infringements. The test for the safe harbour remained knowledge of specific unlawful content.

Russmedia Digital (C-492/23, Grand Chamber, 2 December 2025). An anonymous user posted an advert on a Romanian classifieds site that offered sexual services in a woman’s name, with her photographs and phone number. Departing from the Advocate General’s opinion, the Court held that the operator was a controller of the personal data in the advert within the meaning of Article 4(7) GDPR, even though it did not know the post was unlawful. Such an operator cannot invoke the hosting safe harbour to escape its obligations under Articles 5, 24-26 and 32 GDPR. The Court also derived preventive duties: to identify adverts containing sensitive data before publication, to check whether the person posting them is the data subject or has that person’s consent, and to prevent copying. The Court resolved the clash between the GDPR and the intermediary rules in favour of the GDPR. The data protection commissioners of Berlin and Hamburg stressed that the judgment requires hosts to establish and verify the identity of those who publish content in advance.

WebGroup Czech Republic and Coyote System (C-188/24 and C-190/24, Grand Chamber, 16 June 2026). Coyote is a French app that collects drivers’ reports of roadside checks and passes them on to other drivers. The Court ruled that an operator whose algorithm, beyond mere categorisation and indexing, determines the conditions, manner and priority of disseminating information in the interest of the operator or its service exercises control and loses the hosting protection. The absence of manual intervention and the lack of knowledge of the content owing to automation are irrelevant. Knowledge and control are independent grounds, each sufficient on its own to defeat the safe harbour. An operator that controls the information also cannot rely on the general monitoring prohibition in Article 15 of the Directive.

AGCOM v Google (C-421/24, 16 July 2026). The Italian regulator fined Google Ireland €750,000 over YouTube videos advertising gambling. The Court denied Google the safe harbour for videos by a creator with whom the company had concluded a YouTube Partner Programme agreement, because before signing it Google had reviewed the channel’s theme, its most viewed and newest videos and their metadata, thereby acquiring specific knowledge of the essential content. The judgment restated the Coyote formula on algorithms as a form of control.

The BGH’s six questions

The Senate doubts that the findings in Russmedia and Coyote can be transposed mechanically to a social network. Russmedia concerned a classifieds site whose operator reserved the right to make commercial use of the content posted. Coyote concerned a service that aggregates drivers’ reports into a new body of information. Advocate General Maciej Szpunar, in his opinion in Coyote, expressly distinguished such services from social networks, but, as critics of the judgment note, the Court did not carry that distinction into its ruling. Karlsruhe is therefore asking specifically about social networks.

The first question concerns the GDPR. Is the operator of a social network that merely stores users’ posts and makes them available, without first taking note of them or exercising editorial control, fully responsible for the processing within the meaning of Article 4(7) GDPR? A yes would extend the Russmedia logic, with all of a controller’s obligations, to Facebook.

The second question concerns the E-Commerce Directive. Can such an operator benefit from the safe harbours in Articles 12-15 of the Directive if its algorithm deliberately selects, orders, presents or recommends posts, doing more than categorising and indexing them, while the operator itself, owing to automation, has no knowledge of their content?

The third question asks the same about the DSA. Under what conditions is a social network a hosting service within the meaning of Article 3(g)(iii) and Article 6 DSA, and does algorithmic curation affect that classification?

The fourth question concerns Article 15 of the Directive. Does it permit an obligation on the operator not only to search automatically for variants with minor differences, but also to assess the content of potentially equivalent posts independently and manually, including determining the meaning of a statement?

The fifth question asks the same about Article 8 DSA, which prohibits any general obligation to monitor or to actively seek facts indicating illegal activity.

The sixth question concerns damages. Do Article 14(1) of the Directive and/or Article 6(1) DSA apply to claims for compensation under Article 82 GDPR?

The questions are interlinked. If the CJEU answers the second and third against Meta, then under the Coyote logic the company also loses the right to invoke the general monitoring prohibition, and the fourth and fifth questions effectively fall away for it. If Facebook remains a host, the answers to the fourth and fifth questions will decide whether a court can demand human judgment from a platform, not just a working filter.

Assessment

The weakest point in Meta’s position is that, after Coyote, ignorance of content no longer helps. Facebook does not need to know what a meme says to decide whom to show it to and how often, and that decision is exactly what the CJEU called control. Meta’s terms of use also require users to grant the company a licence to host, use and distribute their content, so the distance between the social network and the classifieds site in Russmedia is smaller than it might seem.

Meta’s strongest argument lies in the DSA itself. Article 27 requires online platforms to disclose the main parameters of their recommender systems. Article 38 requires the largest platforms to offer at least one feed option not based on profiling. Article 7 guarantees that voluntary own-initiative checks do not cost a provider its protection. Under the DSA, an online platform is by definition a type of hosting service, so the legislature assumed that a host can run a recommender system without losing its status. Applying the Coyote formula literally to every recommendation feed would set the Regulation against itself. The CJEU will have to draw the line within algorithms rather than between services with and without one. Coyote already supplies the criteria: whose interest the algorithm serves, and whether it decides what users see and how prominently.

On equivalent content, the parties are closer than they appear. The Glawischnig-Piesczek test allows automated searching and rules out independent assessment of content. In the Künast case, a court has already found the statement itself to be unlawful, so human review would not involve legal classification, only checking whether a given meme reproduces the same fake quote. Yet this is where the greatest risk to free expression lies. Manual review is expensive, and the cheapest way for a platform to avoid liability is to delete anything that looks like the banned content, including memes that debunk the fake. Lawyer Maximilian Wagner warns of significant liability risks and collateral damage to freedom of opinion and information.

On compensation, the two regimes differ fundamentally. Under German law, monetary compensation for violations of personality rights is awarded only for serious violations that cannot be remedied any other way, and that is where the claimant lost on appeal. The GDPR works differently. In Österreichische Post (C-300/21, 4 May 2023), the CJEU held that compensation requires damage but that there is no seriousness threshold for non-material damage. The same Sixth Civil Senate of the BGH, in its Facebook data scraping case VI ZR 10/24 on 18 November 2024, recognised that even a brief loss of control over one’s own data can constitute non-material damage, and considered an amount of around €100 appropriate. A fake quote carrying a person’s photograph and name is a processing of that person’s personal data. Article 82(3) GDPR lets a controller escape liability only if it proves that it is not in any way responsible for the event giving rise to the damage. A platform whose own algorithm displayed and promoted the post will find that hard to prove.

Conclusion

After Russmedia, Coyote and AGCOM, the direction of the CJEU’s case law is clear. The 2000 safe harbour rested on ignorance: the platform does not know what it stores, so it is not liable for it. The CJEU has replaced that criterion with one of control and has taken GDPR obligations outside the safe harbour. The Künast case will determine how far this logic extends to social networks. In the author’s view, the most likely outcome is not a complete loss of Facebook’s hosting status but a narrowing of it: protection would remain for the platform’s neutral functions and would not cover what the platform itself selects and promotes in its own interest. A model in which the profit from a viral fake stays with the platform while the cost of tracking it down falls on the victim is losing its legal footing.

Until the CJEU answers, which in preliminary reference proceedings usually takes more than a year, the Frankfurt judgments are not final, and no obligation on Meta to find and remove every variant of the meme on its own has been established.

Practical implications

For victims and their lawyers. Until the CJEU rules, a notice to the platform with specific URLs remains the only reliable way to trigger the removal obligation under Article 6 DSA, so each copy should be documented and reported separately. At the same time, it already makes sense to base claims not only on national defamation and personality-rights rules but also on Articles 17 and 82 GDPR, citing Russmedia, since that basis offers a chance of compensation without proving a serious violation. The circumstances of distribution are also worth recording: whether the platform showed the post in recommendations and how widely it spread. After Coyote, these facts bear directly on whether the platform can invoke the safe harbour.

For platforms. The risk is shifting from individual posts to service design. Recommender system parameters, licence terms for user content, notice-handling procedures and measures under Articles 24, 25 and 32 GDPR are now a matter of liability, not just compliance. A chronological feed, or one configured by the user, stands a better chance of keeping protection than one ranked in the service’s interest to maximise engagement. The question of Article 82 GDPR claims remains open: if the safe harbour does not block them, every fake quote using someone’s face and name becomes a potential compensation claim.

For Ukraine. Ukraine, an EU candidate country, does not yet have its own equivalent of the DSA. The Research Service of the Verkhovna Rada, Ukraine’s parliament, notes in a briefing on digital services legislation that liability for illegal content is scattered across the laws on advertising, copyright, electronic communications, information, access to public information and media, and that the Law on Electronic Commerce follows the logic of the 2000 Directive without reflecting the DSA. Law No. 3321-IX on Digital Content and Digital Services covers only consumer contracts. The briefing’s authors describe draft law No. 13608 of 7 August 2025 as fragmentary, while the GDPR-based draft law on personal data protection, No. 8153, is still being prepared for its second reading. Gradual implementation of the DSA is among Ukraine’s obligations on the path to EU membership. Ukraine will therefore be adopting not only the text of the 2022 Regulation but also the interpretation the CJEU is shaping in Russmedia, Coyote, AGCOM and now Künast. Its rules on platform liability should be written with the control test in mind, rather than the passive-server model reproduced in the current Law on Electronic Commerce.

Renate Künast sent Meta her 8 URLs. The CJEU will now decide whether she should have had to send them at all.