DSA hosting exemption after WebGroup and Coyote: where is the line?
In short: The EU DSA hosting exemption protects an online intermediary from liability from what its users store, but only while it stays neutral. On 16 June 2026, in Case C-190/24 Coyote System, the Court of Justice held that an intermediary whose algorithm decides how and in what order user content is disseminated, in its own interest, exercises control and loses that protection in the EU. Indexation to help users find content does not. The Court did not say where the line falls.
The hosting safe harbour protects an online intermediary from liability for the content its users post, but only for as long as the intermediary stays neutral. In Case C-190/24 Coyote System the Court of Justice of the European Union has narrowed what neutrality means in the EU: an algorithm that decides how and in what order user material circulates, in the provider’s own interest, takes the provider outside the protection, while indexation and categorisation that make the same content easier to find keep it inside. What the Court did not decide is where one ends and the other begins.
Where the DSA hosting exemption comes from
Intermediary liability rests on a set of exemptions. The e-Commerce Directive (Directive 2000/31/EC), and now the Digital Services Act (Regulation (EU) 2022/2065), gives three: mere conduit, caching and hosting. This case concerns the hosting exemption, the Article 6 DSA rule, which carries forward in near-identical words the old Article 14 of the E-Commerce Directive. An online intermediary that merely stores content supplied by its users keeps that exemption only while it stays neutral, with neither knowledge of nor control over what it stores. The activity has to be, in the Court’s long-standing phrase, of a mere technical, automatic and passive nature.
That neutrality test is not new. It underlies Google France (Case C-236/08), L’Oreal v eBay (Case C-324/09) and YouTube and Cyando (Joined Cases C-682/18 and C-683/18), each of which asked whether a provider had taken an active role that gave it knowledge of or control over user content.
The reference came from the French Conseil d’Etat in two joined cases, WebGroup Czech Republic and NKL Associates (C-188/24) and Coyote System (C-190/24). The hosting-exemption question arose in Coyote.
What the EU DSA hosting exemption now depends on
A provider that determines, by means of an algorithm, under what conditions, how and in which order of priority user information is or is not disseminated exercises control over that information, and loses that exemption. That was the Grand Chamber’s holding on 16 June 2026, in the joined WebGroup and Coyote cases on an opinion from Advocate General Szpunar. The control point arose on the facts of C-190/24 Coyote System, the French navigation service prohibited from rebroadcasting user reports of certain roadside checks. Automation is no answer: the design of the ranking system is itself the control, even if no human ever intervenes on a given item.
The Court drew one express line. Mere categorisation and indexation aimed at improving accessibility, the classic functions of search and navigation, do not remove the exemption. What removes it is an algorithm that decides, in the provider’s own interest or that of its service, whether and how prominently user content surfaces. On the wrong side of that line, the service is no longer one that consists of storing information provided by a user, and the neutral-host label falls away.
What the Court did not do is explain how this will apply to other providers. It did not say how much ordering, weighting or personalisation tips a feed from accessibility into control. That gap is the practical difficulty, and it is why the maximalist reading, that every recommender feed has lost protection, overstates what the judgment decides.
Inside or outside the hosting exemption: factors to consider
The judgment gives factors, not a formula. The table sets out where the Court’s reasoning points, recognising that national courts will fix the threshold case by case as recommender systems come before them.
| Feature | Points to neutral host (inside Article 6) | Points to control (outside Article 6) |
|---|---|---|
| Ordering principle | Chronological, or the user’s own choice | Engagement-optimised ranking set by the provider |
| Purpose | Helping users find what they searched for | Deciding what users see and how prominently |
| Whose interest | The user’s | The provider’s own or that of its service |
| Intervention | Categorisation and indexation only | Determining whether and how content is promoted |
| Example | A search index or a chronological feed | A recommender feed optimised for engagement |
The consequence is evidential. A service that orders content by recency or by the user’s explicit choice stands apart from one designed to maximise engagement in the provider’s commercial interest. What decides which side of Article 6 a provider falls is the record of how its ranking or recommender system works, why it was built that way, and whose interest it serves.
The UK position has diverged
For UK-facing platforms, this is EU law and doesn’t set a binding precedent, but it widens a gap that is already opening. The UK never adopted the DSA. Its safe harbour still rests on the Electronic Commerce (EC Directive) Regulations 2002, regulations 17 to 19, which survived the post-Brexit statute book as assimilated law and came through the Retained EU Law (Revocation and Reform) Act 2023 intact.
On the algorithmic-control question itself, the UK courts have not addressed it. The hosting cases under regulation 19, from Bunt v Tilley [2006] EWHC 407 (QB) to Tamiz v Google [2013] EWCA Civ 68, concern storage, knowledge and editorial intervention after notice, not whether a ranking algorithm operates in the provider’s own interest. There is no UK equivalent of the WebGroup control threshold, and whether regulation 19 would be read in step with it is untested. The Online Safety Act 2023 adds duties of care that apply whether or not a service is a neutral host. So the same recommender system can now be assessed one way for a platform’s EU users and another for its UK users.
A platform serving both must conduct two analyses of one piece of engineering. This adds to other points of divergence, from the UK’s under-16 social media ban to the EU AI Act’s transparency obligations, where the same product meets different rules on each side of the Channel. The cross-regime picture is set out on our UK and EU divergence page.
Questions the judgment leaves open
The judgment is in tension with the structure of the DSA itself. Articles 27, 34 and 38 of the Digital Services Act regulate how hosting providers, including the largest platforms, operate their recommender systems, and so presuppose that such providers are hosts. A reading of Article 6 that excluded every recommender-driven service would set the regulation against itself, which suggests the broad reading overstates the holding. On its facts, Coyote concerned a service that actively orchestrated the dissemination of a narrow class of user reports in its own commercial interest, some distance from a general-purpose feed.
Several questions follow. Does the phrase in its own interest distinguish engagement-optimised ranking from personalisation that a user has chosen? How far must an algorithm determine what users see before curation becomes control? Will national courts, applying the active-role test from YouTube and Cyando, converge on a single threshold or arrive at different ones? And how will the UK courts read regulation 19, now assimilated law, against a Court of Justice gloss that no longer binds them? Each question depends on evidence about how a system is designed and whose purpose it serves, not on the headline category of the service.
Frequently asked questions
Does the DSA hosting exemption still exist after this ruling?
Yes. Article 6 of the Digital Services Act is unchanged. The judgment clarifies who can rely on it. A provider that stores user content and stays neutral keeps the exemption; a provider that uses an algorithm to control how and in what order content is disseminated, in its own interest, does not.
Does using a recommender system automatically lose the exemption?
No. The Court of Justice did not hold that every recommender feed loses protection. It separated indexation that helps users find content, which stays neutral, from algorithmic control that decides what surfaces and how prominently. Where a given system falls is a fact-specific question the Court left to national courts.
What is the difference between indexation and algorithmic control?
Indexation organises and categorises content so users can find what they are looking for. Algorithmic control determines, in the provider’s own interest, under what conditions, how and in what order content is or is not shown. The first keeps a provider neutral; the second makes it an active participant in distributing the content.
Does this CJEU judgment bind UK platforms?
No. It is EU law and does not bind UK courts. It matters to UK-facing platforms in two ways: it governs liability for their EU users, and it widens the divergence between the EU framework and the UK regime, which keeps the e-Commerce hosting defences alongside the Online Safety Act 2023 duties of care.
If you operate a platform that ranks or recommends user content and need to understand on which side of the DSA hosting exemption it falls, contact Rob Bratby at Bratby Law. We advise platforms and their advisers on intermediary liability across the UK and EU.
