J. Latała: The Country of Origin Principle and the Protection of Public Order in Digital Services.

CJEU Ruling – The Country of Origin Principle and the Protection of Public Order in Digital Services. Ruling on the obligations imposed on foreign internet service providers operating within the territory of another EU member state.

On June 16, 2026, the CJEU issued a judgment in joined cases C-188/24 (WebGroup Czech Republic and NKL Associates) and C-190/24 (Coyote System), ruling on the conditions under which a Member State may impose obligations on digital service providers established in another EU country.

The main proceedings before the French Council of State (Conseil d’État) concerned two French legal regulations: the first requires publishers of pornographic websites to implement an age verification system for their users, while the second prohibits navigation service providers from broadcasting information about traffic stops involving sobriety checks and drug testing.

WebGroup Czech Republic and NKL Associates—publishers of Czech pornographic websites—as well as Coyote System, the company that owns a navigation app, argued that the aforementioned regulations violate the country-of-origin principle set forth in the E-Commerce Directive

(2000/31/EC), under which Member States may not restrict the free movement of information society services originating in another country, and a service provider is, as a rule, subject only to the law of the country in which it is established, rather than the law of every country in which it operates.

The CJEU confirmed that this principle applies but is not absolute. A Member State may impose its own requirements on a foreign service provider when it comes to protecting public order—for example, the protection of minors or public safety. The Court also noted that such a measure must be proportionate, and that the Member State must first notify the European Commission and the country affected by the restriction of its intention to apply the restriction.

In the context of retransmitting information about traffic stops, the Court also ruled on the liability of service providers for content posted by users. If a service provider uses an algorithm to decide what, how, and in what order content is displayed, it is no longer merely a “passive intermediary” and thus loses the protection from liability enjoyed, for example, by hosting providers.

In Poland, a draft law on the protection of minors from pornographic content (Bill No. 2697) is currently under consideration, which is intended to also cover websites registered abroad. The CJEU indicates that such restrictions are permissible, provided that the principle of proportionality is upheld and the appropriate notification procedure is followed.