The protection of children online has gained a powerful new legal foundation across the European Union. On 16 June 2026, the Grand Chamber of the Court of Justice of the European Union ruled that a member state may compel pornographic platforms registered in another EU country to verify the age of their users, even though those operators would normally answer only to the regulator in their home market.
The judgment, handed down in the joined cases C-188/24 and C-190/24, cuts to the heart of one of the internet’s founding bargains in Europe. Under the country-of-origin principle in the e-commerce directive, an online service established in one member state is generally policed by that single state, allowing it to trade freely across the bloc without facing twenty-seven separate rulebooks. The applicants, Czech-registered operators WebGroup Czech Republic and NKL Associates, argued that France could not lawfully impose its own age-verification regime on platforms based abroad.
The Court disagreed, but it did not tear the principle up. Instead, it confirmed that protecting minors counts as a legitimate public-policy objective capable of justifying national action against services established elsewhere in the Union. The reasoning matters as much as the result. Judges insisted that any such measure must be proportionate and narrowly aimed at the specific services that actually cause harm, rather than a blanket clampdown on a whole sector. Except in urgent cases, a government must first ask the provider’s home state to act, then notify both that state and the European Commission before switching on its own rules.
That procedural choreography is the quiet centre of the ruling. It hands national capitals a usable tool while trying to stop the single market from fracturing into a patchwork of competing demands. A government cannot simply assert that children are at risk; it must show targeted necessity and submit to oversight from the Commission. The derogation route, long treated as a narrow exception, has been given real operational weight.
The practical consequences will travel well beyond adult content. Age assurance has become a defining battleground of European digital policy, sitting alongside the Digital Services Act and a wider push to make platforms accountable for what minors encounter. By validating France’s approach, the Court has effectively signalled that other member states may follow, provided they respect the same guardrails. Regulators in several capitals have already drafted similar measures.
Critics will warn of the costs. Verifying age reliably tends to mean collecting sensitive data or routing users through third-party checks, raising privacy questions the judgment does not fully resolve. Industry groups argue that divergent national schemes erode the very predictability the single market was built to provide, and that determined teenagers will find workarounds regardless. Civil-liberties advocates fear function creep, where tools justified by child protection are later repurposed for broader surveillance of lawful adult activity.
Yet the political momentum runs the other way. Public anxiety about children’s exposure to extreme content has hardened into legislative action, and courts are increasingly unwilling to let cross-border technicalities trump child welfare. The Luxembourg judges have drawn a line that lets governments act, but only on terms they can defend. Whether that balance holds will depend less on the text of the ruling than on how aggressively capitals now choose to use it.
