6 min read1 hour ago

–

Imagine today you start your day. It’s a day like any other, you have a lot of work to do. You open your computer, you start checking your emails, and you put your phone a little further away on the table so you can concentrate. Then you start receiving notifications — your phone lights up — but you don’t have time, you really need to get on with your work. So you ignore it and continue working.

But you receive more and more notifications, and it becomes really unusual — you can’t ignore it anymore. So you tell yourself that you’re going to check what’s going on anyway — maybe it’s an emergency, maybe there’s a problem at work, maybe there’s a problem in your family. You grab your phone and start to feel a little stressed, wondering what could be happening.

And that’s when you see that you’re receiving lots of notifications from phone numbers you don’t know. It’s very strange, and the content of the messages is weird. They seem to know you, but at the same time they don’t address you in a familiar way. And then you realize that this is inappropriate, you start to see the pattern. There are people who want to meet you, they know your name, they know your city, they have your phone number, and they think you’re there to offer sexual services.

That’s when things start to get blurry — your heart rate quickens, and everything seems to slow down. The world around you seems unstable and stretches out into infinity. You don’t know what to do — you feel ashamed and afraid. And when you look back at one of those messages, you realize that there must be an ad on Craiglist, so you go back to your computer, open Craiglist, and start frantically searching the site. Every page. Everything is blurry. Your heartbeat seems extremely loud, slow and fast at the same time. You frantically go from ad to ad, trying to understand.

Then you come across the ad. The ad that concerns you. The one you supposedly posted, with your photos, your information, your name, and offering your “services.” Your whole world collapses. Your worst fears are confirmed. Your phone keeps ringing and vibrating in the background. You don’t know what to do, you feel like you’re losing your footing. You’re frozen in place by this ad.

Press enter or click to view image in full size

And suddenly you come back to reality and you decide to contact Craiglist’s customer service, and demand they immediately remove the ad that claims to be yours. You keep receiving nasty calls. You feel dirty. Your privacy has been violated, and the vicious cycle has only just begun. Craiglist removes the ad within the hour. However, that’s not the end of your worries because in the meantime, other sites have reposted the ad. It has been copied all over the internet, and even though Craiglist acted very quickly, the information and photos are still online. It’s impossible to completely remove all the ads circulating online with your information that make you look like a prostitute.

This didn’t happen to you today, but it happened to a woman in Romania seven years ago. The website wasn’t Craigslist: it was Publi24, operated by Russmedia. Her life was ruined. Her community would never see her the same way again. She was publicly humiliated and suffered from severe social stigma.

Round One: A Glimmer of Hope

Faced with the devastating impact of these events on her life, she decided to take Russmedia to court. She sued them on the grounds that her personal data had been used illegally, without her consent, and had also been misappropriated, damaging her honor and reputation. In short, they had violated her rights in so many different ways, and she blamed Russmedia for not exercising control over what was posted on their website.

In the first instance, the court ruled in favor of the plaintiff and awarded her €7,000. The court recognized Russmedia as the data controller and criticized the platform for failing to verify the advertiser’s identity, failing to check sensitive data before publishing the ads, and failing to apply security measures. It rejected Russmedia’s arguments that they were merely hosting providers and therefore had no obligation to the plaintiff.

Round Two: When Everything Collapsed

However, in a reversal of the situation, on appeal, the court completely overturned the first instance judgment and recognized that Russmedia had the status of a simple hosting service. The Court held it had acted in a completely reasonable and prompt manner since it had removed the advertisement in less than an hour and that it was not responsible for content published by users. In short, the court ruled that they were completely passive and had no obligation towards our plaintiff and owed her nothing.

Final Round: The Last Chance

As one can imagine, her world collapsed. She was completely desperate. Years had passed since the events, and the plaintiff seemed to have no recourse against the platform. She decided to continue the fight.

Press enter or click to view image in full size

The Questions That Would Change Everything

The Romanian judges were stuck. They had two contradictory laws: one protecting platforms as neutral hosts, another demanding strict protection of personal data. They couldn’t reconcile them. So they did something rare: they asked Europe’s highest court for help. For two years, the legal world waited. The stakes were enormous.

In February 2025, the Advocate General (a senior legal advisor to the CJUE) issued his opinion where he sided with Russmedia on almost everything. According to him platforms were just subcontractors. They had no obligation to check content before publication. They had no duty to prevent copying. Big Tech companies celebrated. The woman from Romania braced for another defeat.

December 2, 2025: The Earthquake

The Court rejected the Advocate General’s conclusions entirely. Not partially. Not with nuances. Entirely. The decision ultimately delivered a complete and unexpected reversal that gave her a total victory and completely changed the current regime for platforms similar to Craiglist/Publi24 in Europe.

The CJEU held Russmedia responsible for data processing and found it jointly responsible with the user for everything posted on the website. As such, it must verify the identity of advertisers before publishing an ad, ensure that it is indeed the person concerned who is posting sensitive data, check for consent, and refuse publication if necessary. Content control has therefore become mandatory in Europe before posting. It also forced platforms to implement anti-copying measures to prevent other websites from simply copying ads published on their platforms, meaning that there are no longer any neutral/passive hosts in Europe.

Why This Changes Everything

This is a major shift in the economic model for these platforms in Europe: the end of free and anonymous publishing for sensitive content, a probable increase in fees to finance compliance, a restriction on the categories of advertisements that will be accepted, and probably the outsourcing of moderation to specialized providers. This also means increased legal risks in terms of lawsuits, administrative sanctions, and joint liability with users, and we could even see class actions in the future.

The Price of Freedom vs. The Cost of Safety

As far as users are concerned, this now limits their freedom to post anonymously and freely, which raises questions in terms of freedom of expression and the eternal question of the balance to be found between security and freedom. This ruling forces us to confront an uncomfortable truth: we can’t have both complete anonymity and complete safety. Not anymore. Whistleblowers, activists in authoritarian regimes, abuse survivors sharing their stories: they all rely on anonymous platforms. But so do abusers, scammers, and people who destroy lives for sport.

The CJEU chose safety. The question now is: at what cost?

This woman’s life was turned upside down seven years ago, but her resilience and determination turned an entire industry upside down with her. Her life will never be the same, but she took the impunity of the online advertising industry down with her. Her name remains protected. Her face, unknown. But her impact is now written into the law of an entire continent. Sometimes, the most powerful revolutions start with a single person refusing to stay silent.

About the Author

Lea Leu is a tech and privacy lawyer specializing in AI governance, IP licensing, and data protection. Licensed in New York, she advises on navigating GDPR, CCPA/CPRA, and the EU AI Act.

📧 Email: lealeu@pm.me 🔗 LinkedIn: Connect with Lea

Feel free to reach out.