CJEU Rules Online Marketplaces Are GDPR Data Controllers
Summary
Romania's National Supervisory Authority for Personal Data Processing reported that the Court of Justice of the European Union ruled that online marketplace operators qualify as GDPR data controllers for personal data processed in connection with transaction operations. The ruling clarifies that platforms facilitating third-party sales cannot escape data controller obligations by characterising themselves as mere intermediaries or hosting providers.
Online marketplace operators across the EU should treat this CJEU ruling as definitively establishing their data controller status under GDPR, regardless of how they have previously characterised their role. Affected platforms should audit their existing compliance programs against the full range of controller obligations: legal basis documentation, data subject rights procedures, Records of Processing Activities, and data processing agreements with third-party sellers should be reviewed and updated to reflect this clarified controller status.
What changed
The CJEU determined that operators of online marketplaces are data controllers under GDPR Article 4(7) for personal data processing linked to marketplace transactions. This interpretation confirms that platforms cannot avoid GDPR controller obligations by characterising their services as neutral hosting or intermediary functions.\n\nOnline marketplace operators must now ensure full GDPR compliance as data controllers, including establishing lawful legal bases for processing, maintaining records of processing activities, handling data subject requests, and implementing appropriate technical and organisational security measures. Platforms that rely on third-party sellers to manage their own compliance may need to revise their contractual arrangements and data-sharing practices.
Archived snapshot
Apr 20, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
The National Supervisory Authority For Personal Data Processing
Mentioned entities
Related changes
Get daily alerts for Romania ANSPDCP
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from ANSPDCP.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when Romania ANSPDCP publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.