The hosting defence – shining a light on algorithms and content creator partnerships

The hosting exemption

The hosting exemption originated in the E-Commerce Directive (2000/31/EC) and has since been moved, largely unchanged, into the Digital Services Act (EU) 2022/2065 (DSA). This framework provides that an operator is not liable for information it is merely hosting if it does not have actual knowledge of unlawful activity or information. Where a claim for damages is made, the exemption will also apply if the operator is not aware of facts or circumstances from which it would have been apparent that the activity or information was unlawful. Once actual knowledge or awareness of unlawfulness is obtained, the operator must act expeditiously to remove or disable access to the information.

Control and active role

The key issue in determining whether the hosting exemption applies is whether the operator exercises control over the content or plays an active role.

In recent joined cases WebGroup Czech Republic, a.s. and Coyote System v Premier ministre (C-188/24 and C-190/24), the CJEU confirmed that mere categorisation and indexation of uploaded information for the purpose of improving its accessibility does not amount to control. However, if an operator (in this case an app provider) uses an algorithm to determine, in its own interests or that of its service, under what conditions, how and in which order of priority information is or is not broadcast, it would be exercising control, and the hosting exemption would not be available. 

In AGCOM (C-421/24), the CJEU has decided that where an operator reviews, for the purpose of concluding a commercial partnership contract, the main theme of a video channel, that channel’s most viewed videos or newest videos and the associated metadata, the provider acquires specific knowledge of the essential content of a videos and cannot therefore claim to act as an intermediary service provider. This applies even if that examination of the content (whether automated or manual), is intended to verify that the content creator seeking that commercial partnership agreement complies with the rules laid down by the platform for accessing such a partnership.

The exemption from liability cannot be relied on, even where the provider does not become aware of the content of the platform because the processing "is automated" where the provider has previously defined, by means of an algorithm, the conditions for broadcast such as the manner of broadcast, the order of priority, etc. and accordingly exercises control over that content (WebGroup Czech Republic and Others).

Key takeaways from the CJEU decisions

The AGCOM decision shines a light on content creator/partnership programmes and the hosting defence. Platforms that review, monetise or control the distribution of particular content face an increased risk that they will be treated as active participants rather than neutral hosts.

If a platform discovers potentially unlawful activity while appraising a content creator for a commercial partnership, it can no longer treat that information as merely part of the commercial approval process. The knowledge of the review team effectively becomes the knowledge of the platform. The issue must therefore be passed promptly to the relevant compliance team and, if the content is unlawful, removed or blocked without delay.

The decisions also show that platforms cannot benefit from the hosting defence merely because their review of content was carried out by an automated system. Where in using an algorithm, the platform selects the criteria and determines the resulting treatment of the content, that processing may be attributed to the platform.

The UK angle

The Electronic Commerce (EC Directive) Regulations 2002 (2002 Regs) implemented the E-Commerce Directive in the UK and were preserved after Brexit as assimilated domestic legislation. While their EU origin remains relevant context, the 2002 Regs are now interpreted by applying the UK's domestic approach to statutory interpretation.

In June 2021 the CJEU gave its judgment in joined cases Peterson/Cyando.[1] The decision in Cyando came after IP completion day (the end of the Brexit implementation period, 11 pm on 31 December 2020) and is not binding on UK courts. Under the EU (Withdrawal) Act 2018, section 6, UK courts have the discretion to have "regard" for "relevant" cases that do not form part of assimilated EU case law. On this point of "having regard" to previous CJEU decisions, some UK judges have indicated that the power to depart from assimilated EU case law would be exercised with great caution. Therefore, when a post IP completion day decision forms part of a body of relevant decisions, the majority of which are assimilated EU case law, or when it builds on and further refines the CJEU's previous jurisprudence, or when it is directly relevant to the issues in the case in issue, then that case is likely to be highly persuasive (TuneIn Inc v Warner Music UK Ltd[2]). Other cases[3] (Thatchers v Aldi) suggest an ongoing judicial inclination toward alignment, unless the CJEU's interpretation is considered to be an error.

Cyando appeared to expand the scope of the hosting exemption – deciding that when assessing the intermediary's activity and role in relation to content, a relevant consideration is whether the conduct of the intermediary goes "beyond merely making the platform available" and does "not intervene in the creation or selection of content" uploaded to the platform or "view or monitor that content before it is uploaded" i.e. the content is uploaded automatically.

The AGCOM and Webgroup decisions, in contrast, seem to narrow the defence. Applying TuneIn factors, a UK court might find AGCOM and Webgroup persuasive: they apply the E-Commerce Directive rather than the Digital Services Act (DSA) (the underlying events giving rise to these cases occurred before the DSA provisions became applicable), build on a body of pre IP completion day case law on the hosting defence and the domestic implementing hosting provision referred to has not changed. Applying Thatchers, a UK court may not find the cases persuasive if it considers the CJEU has taken a wrong turn on Article 14 interpretation.

Going forward, however, there may be divergence. The EU has replaced the relevant E-Commerce Directive articles with equivalent ones in the DSA which the UK has not implemented, and the UK's regime is now split between the 2002 Regs and the Online Safety Act which is arguably a distinct framework.