From Notice-and-Take Down to Upload-Level Due Diligence: Platform Obligations under EU Law After Russmedia

Abstract This paper examines the Court of Justice of the European Union’s (CJEU) December 2025 judgment in Russmedia , which marks a significant shift in EU platform regulation. Departing from the reactive, notice-level due diligence model established in L’Oréal v eBay and Google Spain , the Court imposes proactive, upload-level obligations on online marketplace operators, grounding them in the GDPR provisions on special categories of personal data and data protection by design. The paper unpacks the Court’s three-step reasoning in what appears to be a wicked case: its expansive characterisation of the marketplace operator as a data controller, its imposition of pre- and post-publication obligations, and its literal interpretation of the relationship between the E-Commerce Directive and the GDPR. It argues that while the judgment responds to legitimate concerns about serious online harms to third parties, it imposes hybrid adjudicative know-your-user duties that raise significant proportionality and fundamental rights concerns. The paper further evaluates Russmedia ’s compatibility with the Digital Services Act, contending that the emerging principle of lex complementaria offers a more balanced framework. It concludes that upload-level due diligence obligations should be understood as design-based obligations, not blanket monitoring or adjudicative requirements.