Paris: For a quarter of a century one principle has governed the internet across the European Union with deceptive simplicity. An online service is regulated by the country where its provider is established, not by every country where its users happen to live. That country of origin rule, written into the Union’s electronic commerce law when the web was young, spared companies the impossible task of complying with twenty-seven separate rulebooks. A judgment from the Union’s highest court has now marked, with unusual clarity, where that principle ends.
The case reached Luxembourg from France, brought by providers established elsewhere in the Union who objected to two French measures. One required pornographic websites to verify the age of their users. The other allowed restrictions on navigation apps that rebroadcast the location of certain police checks to drivers. The companies argued that France had no business imposing its own rules on services governed, under the country of origin principle, by the law of the state where they were based. The court agreed that the French measures did restrict the free movement of those services. Then it explained why France could impose them anyway.
Member states, the judges held, may depart from the country of origin rule where it is genuinely necessary to protect recognised public interests such as public policy, public security or public safety. Shielding minors from pornography through age verification can qualify as a public policy objective. Limiting the rebroadcast of information about police checks can be justified on grounds of public security. The ruling does not tear up the principle that has underpinned the single market for digital services. It confirms that the principle was never absolute, and that a government acting for a serious and legitimate reason retains room to act even against providers headquartered abroad.
The judgment ranges further, into the vexed question of when a platform is a neutral conduit and when it becomes a participant in what it carries. The Union’s law has long granted hosting services a shield from liability for content they merely store on behalf of others. The court found that shield does not extend to a provider that exercises genuine control over information, for instance by using an algorithm to decide the conditions under which content is rebroadcast, how it is presented and in what order of priority. Curation, in other words, can forfeit the immunity that passive hosting enjoys. That reasoning speaks to every service that ranks, filters and promotes what its users see.
Governments across the Union have been reaching for age verification and content restrictions with growing confidence, often in the face of complaints that such rules trespass on the single market. The ruling hands them a firmer footing, provided they can show a real public interest rather than protectionism dressed up as public policy. Providers gain a clearer, if less comfortable, map of the limits of the immunity they have long relied upon. The judgment does not resolve the tension between a borderless internet and the enduring right of nations to govern their own public life, but it draws the boundary with a precision regulators and platforms have sought for years.
