Featured image: Julia Kis, lawyer, facilitator of the rule, based in Cluj-Napoca. Photo: Barla Melinda.
hungarian version
Preambulum:
It all started in Romania in 2018, when a woman stumbled across a fake listing on Publi24, a popular classifieds site where people buy, sell and advertise just about anything. The anonymous post falsely described her as a sex worker, using her photos and phone number, and soon spread to copycat sites across the web. Source
What are we talking about, exactly?
In the title we name three phenomena that are often conflated in public discourse, even though they can be defined more precisely in legal and social terms.
By “revenge listing” we mean the act of publishing personal or intimate information, images or photos about another person — typically an ex-partner — in the form of an “ad”, with the aim of shaming, retaliation, or coercion/blackmail.
We also include here intimate images created during a relationship with consent to be taken at the time, but without consent for any specific use outside the relationship. The moment a relationship ends and one party abuses such material — for example by posting it as a sexually explicit “dating” ad, or by handing it over / threatening to hand it over to the person’s family or workplace (see: doxxing) — it becomes part of the same revenge-listing logic.
By “dick pic” we mean the sending of unsolicited intimate images — and this is not exclusively content sent by men to women. There are female variants as well, and there are also situations where a man asks for an image, and after the relationship breaks down the image is later used for abuse.
The common denominator is not gender, but lack of consent and abuse of power.
Doxxing is the public disclosure of someone’s personal data (name, contact details, photo, address, intimate details) without permission, often with the aim of harassment or intimidation.
These phenomena are connected. Each is built on a breach of trust and the weaponisation of intimacy.
Image is illustrative. Photo: Петрушка, Mogoșoaia. Model: Arena Minda
One important clarification: abuse of sensitive personal data did not begin in the digital era.
As long as desire, rejection, shifts in power and broken hearts have existed — especially in intimate relationships, including male–female dynamics — abuse has existed too. In Transylvania, for instance, we know of an early 1990s case where a person’s photo appeared in a printed “mourning notice” in the Harghita County daily — as an ex-partner’s “farewell gift”.
The digital era did not create the phenomenon; it amplified it: speed, visibility, and harm. What once spread within a town can now become globally accessible within minutes.
This is where we are seeing progress now.
A recent decision of the Court of Justice of the European Union intervenes precisely at the point where these abuses become public: when intimate or sensitive content is published not through private channels but on public platforms, as advertisements. The core of the ruling is that the publishing platform can no longer remain passive: it must verify the uploader, the lawful basis, and the data subject’s consent.
This is where Glamour.Tabus.Passion concept-aimed Magánterület connects since 2002.
In this piece we summarise legal developments around revenge listings through a Cluj-based case — one in which a woman’s intimate photographs were posted as an advertisement in Romania.
In the coming period we will also publish a structured action guide:
what qualifies as digital abuse and how to recognise it,
what can and should be done,
and what to do if it has already happened.
If the person affected is a minor, in Romania the nationwide free helpline 119 (Telefonul Copilului) is available 24/7 to seek help regarding any form of abuse, exploitation or violence. In addition, since 2015, the 0800 500 333 line has also been available in Hungarian; it was originally created to support survivors of domestic violence, and it can be reached day and night.
*
This text (and forthcoming series) does not aim to spark moral panic, but to offer legal and human anchors in a space where, too often, the person affected has been left alone.
Below we follow this structure (an editorial longform at the intersection of EU policy, HR, and social context):
-
We review EU regulatory developments triggered by the result achieved by Cluj-based lawyer Júlia Kis — and reviewed by her (1,2,3,5).
-
We integrate primary sources and the official communication around legal steps.
-
We include relevant Transylvanian TV, radio and print coverage published so far in Hungarian.
-
As an intermezzo, we provide a concise, dictionary-style explanation of key English terms and concepts — with 2026 relevance.
-
With fresh eyes, we then revisit everything along the “Track 1” line, one step further: what comes next.
Comment box below — this is where we can talk. Or use the contact page.
GE
Weaponised Intimate Data: How EU Law Is Redefining Platform Responsibility
Editorial content by GERGELY EDIT
Proofread by: KIS JÚLIA, lawyer, Klausenburg
The Court of Justice of the European Union (CJEU) has recently ruled, through an unusual procedure, that operators of online classified marketplaces qualify as data controllers, and cannot hide behind the role of “mere intermediaries” when advertisements contain personal — especially sensitive — data.
The judgment, originating from a Romanian case, simultaneously redefines platform liability and reshapes the legal toolbox against digital harassment: introducing requirements of prior screening, explicit consent of the data subject, and active protection against re-publication.
After previously analysing the EU-mandated Romanian implementation of workplace harassment regulation (effective from April 2024) from a weighted HR-specialist perspective, this post examines what this new media-law environment — fought for from Cluj — actually means for us.
First, in a lighter, portal-style format — followed by an in-depth publicistic reading.
From classified ads to data weapons
What does the EU’s new ruling mean for marketplaces — and why does it matter that it started in Romania?
The Court of Justice of the European Union has ruled:
an online classified marketplace cannot hide behind the “we merely facilitate” argument if an advertisement contains personal — especially sensitive — data.
RO: Judgment of the Court of Justice of the European Union in the case Russmedia Digital and Inform Media Press (C-492/23) – On 2 December 2025, D-na Octavia Spineanu-Matei:
Source Credits: © European Union, 202X, licensed under CC BY 4.0
The Romania-originated case represents an EU-level milestone:
it redraws platform responsibility and constitutes a direct response to one of the most brutal forms of digital harassment.
What exactly does the ruling say? (layperson’s summary)
In Case C-492/23, the Court of Justice ruled that the operator of an online marketplace qualifies as a data controller with regard to personal data contained in user-posted advertisements.
This means GDPR obligations cannot be shifted solely onto the user who uploads the ad.
If an advertisement contains special (sensitive) data — such as references to sexual life, nudity, or health — the platform must, before publication:
-
identify such content (via technical and organisational measures),
-
verify whether the person posting the ad is identical to the data subject,
-
and confirm the data subject’s explicit consent.
If any of these cannot be demonstrated, the advertisement must not be published.
Moreover, the operator must take “all measures reasonably available” to ensure that such content cannot be unlawfully copied or republished on other platforms.
(CJEU judgment — CELEX C-492/23; analysis by Juridice.ro)
The ruling was presented by Koen Lenaerts, President of the Court of Justice of the European Union.
So… is the “we only provide hosting” argument over?
Yes. The Court made it clear: GDPR controller responsibility does not dissolve behind e-commerce safe-harbour doctrines.
Why does it matter that this came from Romania?
This ruling emerged through a preliminary ruling procedure:
a Romanian court asked the CJEU to interpret EU law, and the Court delivered a binding interpretation.
This is not a Romanian exception, but an EU-wide standard that national courts and platforms must follow.
It is a rare moment:
a Romanian case has produced a judgment that lawyers and compliance teams in Berlin, Paris, and Budapest must now take into account.
Given that the Magánterület / arenaminda–gergelyeditproject runs a femicide-tribute strategic communication line, we cannot avoid explicitly welcoming — with due respect to men as well — that this step was carried through by a female lawyer, via a case involving the misuse of sensitive images of a woman.
Naturally, the ruling protects men as well: unsolicited “dick pics” are also sensitive personal data.
Júlia Kis, Cluj-based lawyer and professional facilitator of the CJEU decision. Photo: Melinda Barla
Congratulations may be sent to Júlia Kis via Facebook; we also requested information directly and thank her for the prompt responses.
TVR Cluj — recent interview with the lawyer. Related: interview in hungarian by Szerénke Forrai (Cluj Radio), summary by Ildikó Újvári in Szabadság (a hungarian daily still published in print in Romania).
Who is RUSSMEDIA / Inform Media Press — and why does size matter?
Russmedia Newspaper SRL (later Inform Media Press SRL) is linked to Publi24, one of Romania’s largest online classified platforms.
Public company data indicate:
-
multi-billion-scale revenue,
-
over one hundred employees,
-
nationwide reach.
This matters. The Court’s implicit message was also this:
those who operate marketplaces at industrial scale bear industrial-scale responsibility.
But… does it matter that the compensation was “only” €7,000?
No. The precedent value far exceeds the amount; the obligations are systemic.
What does this mean for e-commerce and online marketplaces?
Winners
-
data subjects, who previously could only request takedown after harm occurred,
-
employers and HR professionals increasingly facing workplace consequences of digital harassment,
-
legal certainty.
Losers (or those facing higher costs)
-
marketplaces, because notice-and-takedown alone is insufficient,
-
smaller platforms lacking pre-screening capacity,
-
actors previously operating in legal grey zones.
This is now a business-model issue, not merely a legal one.
But… doesn’t this risk excessive censorship?
A real concern. Over-filtering may affect legitimate content — yet the ruling clearly targets sensitive personal data, not freedom of expression.
The unspoken background: digital violence, dick pics, revenge listings
Let us not deceive ourselves:
unsolicited intimate images, humiliation-based listings, and doxxing are not teenage phenomena.
They occur just as much in 50+ elite environments, within workplace and intimate power dynamics.
This ruling does not solve everything — but it states clearly for the first time:
if digital violence takes the form of an advertisement, platforms cannot remain neutral.
The cardinal question
Can the EU regulate digital marketplaces in a way that does not force victims into constant self-defence, but instead places responsibility on systems?
This ruling offers a cautious yet clear answer.
Methodological note
This is not an immediate “new Romanian law”, but an EU-law interpretation to be applied in the underlying case, and one that platforms across the EU would be wise to align with.
The practical key is risk-based content management:
sensitive data → prior verification → reinforced protection against re-publication.
GLOSSARY – WHAT ARE WE TALKING ABOUT?
Revenge Advertising
A form of public posting or ad-like publication in which someone discloses personal or intimate information, images or data about another person – most commonly a former partner – with the intent to shame, punish, intimidate or extort.
Unlike private harassment, revenge advertising turns abuse into a public act by using visibility as a weapon.
“Dicpic” (Unsolicited Intimate Image Sharing)
The sending of images depicting intimate body parts without the explicit consent of the recipient.
This is not an exclusively male-to-female phenomenon: female-initiated cases exist, as do situations where an image was originally created at the request of a partner but later misused after the relationship ended.
In every case, the defining element is the absence or withdrawal of consent.
Doxxing
The public disclosure of personally identifiable information – such as name, contact details, home address, photographs or intimate details – without consent, typically for the purpose of harassment, intimidation or retaliation.
Doxxing often amplifies other forms of digital abuse by enabling offline harm.
Sensitive (Special Category) Personal Data
Under the GDPR, data that reveal particularly protected aspects of a person’s life, such as sexual life, nudity, health status or other highly private circumstances.
The processing of such data is subject to stricter legal conditions and enhanced safeguards.
Platform as Data Controller
According to a recent ruling of the Court of Justice of the European Union, the operator of an online marketplace or advertising platform is not merely a technical intermediary.
Where personal data appear in published ads, the platform bears data controller responsibility and cannot shift all legal obligations onto the user who uploaded the content.
Pre-Moderation (Prior Content Review)
A set of technical and organisational measures designed to prevent content containing sensitive personal data from being published without proper authorisation.
In high-risk categories, this includes identity verification, consent checks and proactive safeguards – not merely post-hoc removal.
Digital Violence
Any form of online conduct that misuses personal or intimate content for the purpose of exerting power, causing humiliation, or issuing threats.
Digital violence is not age-specific, and it extends far beyond social media platforms into workplaces, marketplaces and other public digital infrastructures.
From news framing to close reading:
The end of “we merely facilitate”:
a GDPR breakthrough for marketplaces from Romania, effective 2026
The CJEU has ruled that operators of online classified marketplaces are not neutral intermediaries: regarding personal data contained in user-posted ads, they qualify as data controllers and cannot shift GDPR obligations onto uploaders.
If an advertisement contains sensitive data (e.g. sexual life), the platform must identify such content prior to publication, verify identity and explicit consent, and refuse publication if these conditions are unmet.
Moreover, platforms must take all reasonable measures to prevent unlawful copying and republication — and cannot escape this responsibility through classic e-commerce safe-harbour logic. (Based on CJEU jurisprudence.)
The news is not €7,000 in damages.
The news is that the EU has stated: a marketplace is not a notice board.
And those who run notice boards are responsible for what they allow on them — especially when it constitutes digital violence.
Case C-492/23 is brutally simple: users upload, platforms publish — and therefore platforms become data controllers.
Full stop.
Not passive hosting. Not neutral pipes. Not “we just host”. (CJEU)
Image is illustrative. Photo: Петрушка / Mogoșoaia. Model: Arena Minda
1) Professional implications: the partial return of pre-moderation
This is not compliance fine-tuning; it affects the business logic of UGC-based marketplaces.
2) Why Romania matters at EU level
This preliminary ruling sets EU-wide standards — not a national deviation.
A rare moment where Romania does not merely adopt EU norms, but shapes them.
3) Who is Russmedia / Inform Media Press — and why size matters
Public data show a high-volume, infrastructure-level operation.
The message: scale brings responsibility.
4) Who benefits — and who bears the cost?
Beneficiaries: victims, HR ecosystems, legal certainty.
Costs: platforms, advertisers, smaller operators lacking compliance infrastructure. (Matheson)
5) Collateral damage
Risks include over-filtering and migration of harmful content to less regulated spaces.
Hence the key question for any informed reader:
How do we protect individuals without over-censoring public space or driving harm further underground?
6) The known but rarely acknowledged reality
Digital sexual coercion, revenge imagery, and intimidation are not age-specific.
The law now says: once this becomes an “ad”, neutrality ends.
Képünk illusztráció. Fotó: Петрушка, Mogoșoaia. Modell: Arena Minda
What is at stake is not a compliance rule, but whether the EU can redesign digital infrastructure so responsibility rests with systems rather than victims.
This is not a new law tomorrow, but a binding interpretation whose implementation will shape platform business models.
Where platforms cannot meet these standards, business-model change — not legal debate — will follow.
Project manager, HR-qualified freelance communicator, marketing graduate, Méray Prize-winning journalist. Author of two literary volumes. Founder of Magánterület.tk, the first Hungarian-language blog in Romania (2002). This is its continuation.
Thank you for being here —
in a place where memory is work, and beauty is a form of resistance.
