WebGroup and Coyote: algorithmic control and the hosting safe harbour
In short: On 16 June 2026, in Joined Cases C-188/24 and C-190/24 WebGroup Czech Republic and NKL Associates and Coyote System (ECLI:EU:C:2026:492), the Court of Justice ruled that an operator whose algorithm determines, in its own interest or that of its service, under what conditions, how and in which order of priority user information is broadcast exercises control over that information, cannot be classified as a hosting provider within Article 14(1) of the e-Commerce Directive, and that Article 15(1) therefore does not apply to it. Categorisation and indexation to improve accessibility do not have that effect. The ruling is on Directive 2000/31; the Digital Services Act is not mentioned in the judgment.
The hosting safe harbour protects an online intermediary from liability for what its users post, but only while the intermediary stays neutral. In Joined Cases C-188/24 and C-190/24 the Grand Chamber has narrowed what neutrality means: an algorithm that decides how and in what order user material circulates, in the provider’s own interest or that of its service, takes the provider outside the protection, while categorisation and indexation that make the same content easier to find keep it inside. The Court did not say where one ends and the other begins, and it did not decide on which side Coyote System itself falls.
The instrument the Court construed
The ruling is on Directive 2000/31, the e-Commerce Directive. Regulation (EU) 2022/2065, the Digital Services Act, does not appear in the judgment. The questions referred by the French Conseil d’État by decision of 6 March 2024 concerned Articles 2(h), 3, 14 and 15 of the Directive, and the operative part rules on those articles.
Article 14(1) exempts a provider from liability “where an information society service is provided that consists of the storage of information provided by a recipient of the service”, subject to conditions on knowledge and expeditious removal. Article 15(1) bars Member States from imposing a general monitoring obligation on providers of the services covered by Articles 12, 13 and 14. Recital 42 confines the exemptions to activity of “a mere technical, automatic and passive nature”, which the Court has long read as requiring the provider to have neither knowledge of nor control over what it stores. That neutrality test runs through Google France (Joined Cases C-236/08 to C-238/08), L’Oréal (Case C-324/09) and YouTube and Cyando (Joined Cases C-682/18 and C-683/18), each cited in the judgment.
What the Court decided
Knowledge and control are alternative and independent conditions, so an operator that controls the stored information falls outside Article 14(1) “even if it does not become aware of that information due to the automation of the information processing” ([110]). The algorithm is itself the means of control: once the operator has predetermined by algorithm the conditions under which information may or may not be broadcast, “it is irrelevant that that operator does not itself carry out additional interventions which have the effect of promoting, modifying or deleting information stored with a view to it being broadcast” ([111]).
The line falls at [112]. Where, “beyond the mere categorisation and indexation of information for the purpose of improving its accessibility”, the algorithm determines, in the interest of the operator or its service, under what conditions, how and in which order of priority the information is or is not broadcast, the operator exercises control, and the service cannot be classified as one consisting of the storage of information provided by a recipient.
The first indent of ruling 2 ends “and that Article 15(1) therefore does not apply to it”. Because Article 15(1) applies only where there is a provision of services referred to in Articles 12 to 14, a controlling operator cannot raise the general-monitoring bar against a national prohibition ([113]). The second indent covers the converse case: a Member State may prohibit an operator that does qualify as a host from rebroadcasting information relating to certain roadside checks, on grounds of public policy, security or safety. On either footing the prohibition can stand, subject to the checks the Court left to the Conseil d’État.
The Court stopped there. At [114] it said that “it is for the referring court to carry out the necessary checks to that end”. Coyote System’s own classification is undecided. The Court settled the test, not the outcome.
The read-across to Article 6 DSA is inference, not holding
Articles 12 to 15 of the e-Commerce Directive were deleted by Article 89(1) of the Digital Services Act. Article 89(2) provides that references to Articles 12 to 15 “shall be construed as references to Articles 4, 5, 6 and 8 of this Regulation, respectively”. Article 14 therefore maps to Article 6, and Article 15 to Article 8.
Reading the judgment as governing Article 6 is an inference from that mapping. It is a reasonable one. Article 6(1) opens on the identical formula, “where an information society service is provided that consists of the storage of information provided by a recipient of the service”, which is precisely the phrase the Court construed. What Article 6 does not contain is any express control limb answering to the Court’s test; its only control language is the authority-or-control formula in Article 6(2) and (3), a different question. The algorithmic-control test is a gloss on the opening words, and it travels with them.
The Article 15 to Article 8 step is weaker. The Court disapplied Article 15(1) because its wording made it conditional on the provision of a service referred to in Articles 12 to 14. Article 8 is drafted differently, attaching instead to “providers of intermediary services”. The same result probably follows, since an operator that controls the information is unlikely to be an intermediary service provider at all, but that is not the route the Court took and no court has ruled on it. Until one does, what exists is a construction of a deleted provision whose successor is worded the same at the point that mattered.
Inside or outside the hosting safe harbour: factors to consider
The judgment gives factors, not a formula. The table sets out where the Court’s reasoning points, recognising that national courts will fix the threshold case by case as recommender systems come before them.
| Feature | Points to neutral host (inside Article 14(1)) | Points to control (outside Article 14(1)) |
|---|---|---|
| Ordering principle | Chronological, or the user’s own choice | Engagement-optimised ranking set by the provider |
| Purpose | Helping users find what they searched for | Deciding what users see and how prominently |
| Whose interest | The user’s | The provider’s own or that of its service |
| Intervention | Categorisation and indexation only | Determining whether and how content is broadcast |
| Example | A search index or a chronological feed | A recommender feed optimised for engagement |
The consequence is evidential. A service that orders content by recency or by the user’s explicit choice stands apart from one designed to maximise engagement in the provider’s commercial interest. What decides the classification is the record of how the ranking or recommender system works, why it was built that way, and whose interest it serves.
The UK position has diverged
For UK-facing platforms this is EU law and binds nobody here, but it bears more directly on UK law than a Digital Services Act ruling would. The UK never adopted the DSA. Its hosting defence is regulation 19 of the Electronic Commerce (EC Directive) Regulations 2002, which implemented Article 14 of the same Directive and opens on materially the same words: “Where an information society service is provided which consists of the storage of information provided by a recipient of the service”. Those Regulations remain in force as assimilated law. A Court of Justice construction of the parent provision has no binding force in the United Kingdom, but it construes the formula regulation 19 uses rather than a successor instrument the UK never took.
On the algorithmic-control question the UK courts have not ruled. The regulation 19 cases, from Bunt v Tilley [2006] EWHC 407 (QB) to Tamiz v Google [2013] EWCA Civ 68, concern storage, knowledge and intervention after notice, not whether a ranking algorithm operates in the provider’s own interest. The Online Safety Act 2023 adds duties that apply whether or not a service is a neutral host. The same recommender system can now be assessed one way for a platform’s EU users and another for its UK users.
A platform serving both must run two analyses over one piece of engineering. This adds to other points of divergence, from the UK’s planned under-16 social media ban to the EU AI Act’s transparency obligations, where the same product meets different rules on each side of the Channel. The cross-regime picture is set out on our UK and EU divergence page.
Questions the judgment leaves open
The broad reading sits awkwardly with the structure of the Digital Services Act. Article 27 requires providers of online platforms that use recommender systems to set out their main parameters in their terms and conditions, and Article 38 requires very large online platforms and search engines to offer at least one recommender option not based on profiling. An online platform is a species of hosting service, so both obligations presuppose that a provider running a recommender system is a host. A reading of Article 6 that excluded every recommender-driven service would set the Regulation against itself. On its facts, Coyote concerned a service that orchestrated the dissemination of a narrow class of user reports, some distance from a general-purpose feed.
The open questions are substantial. Whether “in its own interest or that of its service” separates engagement-optimised ranking from personalisation the user has chosen is undecided. So is how much ordering or weighting turns accessibility into control, and whether national courts will converge on a single threshold. So too is whether the Article 89(2) mapping carries the algorithmic-control test into Article 6 without qualification. Each turns on evidence about how a system is designed and whose purpose it serves, rather than on the headline category of the service.
Frequently asked questions
Which instrument did the Court rule on?
Directive 2000/31, the e-Commerce Directive. The operative part interprets Articles 2(h), 3, 14(1) and 15(1). Regulation (EU) 2022/2065, the Digital Services Act, is not mentioned in the judgment. Articles 12 to 15 of the Directive have since been deleted by Article 89(1) of the Digital Services Act, and Article 89(2) directs that references to them be construed as references to Articles 4, 5, 6 and 8 respectively.
Does using a recommender system lose the hosting exemption?
Not automatically. The Court separated categorisation and indexation that improve accessibility, which keep a provider neutral, from an algorithm that determines, in the provider’s own interest or that of its service, under what conditions, how and in which order of priority content is broadcast. Where a given system falls is a fact-specific question for the national court.
What did the Court decide about Coyote System itself?
Nothing. At paragraph 114 the Court left the necessary checks to the referring court. It also held, in the second indent of ruling 2, that a Member State may prohibit rebroadcasting information about certain roadside checks on grounds of public policy, security or safety even where the operator does qualify as a host, so the prohibition can stand either way, subject to the checks the Court left to the Conseil d’État.
Does this judgment bind UK platforms?
No. It is EU law and does not bind UK courts. It governs liability for a platform’s EU users, and it construes the provision that regulation 19 of the Electronic Commerce (EC Directive) Regulations 2002 implemented, in materially the same words, which makes it persuasive material here rather than an irrelevance.
If you operate a platform that ranks or recommends user content and need to establish on which side of the hosting safe harbour it falls, contact Rob Bratby at Bratby Law.
