The question of how Europe shields children from online pornography moved from political slogan to binding legal precedent this week. Sitting as a Grand Chamber, the Court of Justice of the European Union ruled on 16 June in joined cases C-188/24 and C-190/24 that a member state may compel pornographic platforms established in another EU country to verify the age of their users, provided it follows a narrow and carefully justified path.
The dispute reached Luxembourg from the French Conseil d’Etat, which had been asked to assess two national decrees obliging adult-content operators to deploy technical safeguards keeping minors out. Several large platforms based elsewhere in the Union argued that the e-Commerce Directive’s country-of-origin principle shielded them from French rules entirely. Under that long-standing logic, an online service answers chiefly to the regulator of the country where it is established, not to every market it reaches.
The Court declined to treat that principle as an impenetrable wall. It confirmed that the directive’s coordinated field can extend to measures rooted in criminal law and public policy, and that the protection of minors falls squarely within the public-interest grounds a government may invoke. What a state cannot do, the judges stressed, is impose sweeping general obligations on foreign operators as though they were domestic ones. The country-of-origin rule still bars blanket national regimes applied automatically to services lawfully based abroad.
Instead, the ruling carves out a middle route. A member state may issue individualised enforcement notices against specific platforms, requiring age-verification systems where the strict conditions of Article 3(4) of Directive 2000/31 are met. Those conditions demand necessity, proportionality and prior procedural steps, including notifying the Commission and the operator’s home state. The effect is to give national authorities a usable instrument while forcing them to act case by case rather than legislating against the entire foreign sector at once.
The practical consequences will be felt quickly. France has led a European push for stricter age assurance, and its regulator has already pressed several sites to introduce verification or face blocking. The judgment effectively validates that targeted approach and offers a template other capitals can copy. Expect Italy, Spain and others weighing similar measures to study the proportionality test closely, because the Court has made the procedure, not the ambition, the decisive factor.
Two tensions remain unresolved. The first is technical: reliable age verification that does not turn into mass surveillance or identity harvesting is still a work in progress, and privacy regulators will scrutinise whatever systems platforms adopt. The second is jurisdictional. By accepting that public-policy measures can pierce the country-of-origin shield in individual cases, the Court has nudged open a door that other policy areas, from gambling to disinformation, may eventually try to widen.
For now, the message to operators is clear. Being established in a permissive jurisdiction no longer guarantees immunity from a determined national regulator acting through the proper channels. The ruling does not hand governments a blank cheque, but it confirms that child protection can justify reaching across borders, one targeted notice at a time.




