---
title: "Case C-492/23: judgment of 2 December 2025"
canonical: "https://dposchool.com/gdpr/case/c-492-23"
source: "https://curia.europa.eu/juris/liste.jsf?num=C-492/23&language=en"
source_note: "Only the judgment as published by the Court of Justice is authoritative."
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Court of Justice judgment · Case C-492/23

# X v Russmedia Digital SRL and Inform Media Press SRL

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

- **Case:** C-492/23
- **Court:** Court of Justice
- **Date of judgment:** 2 December 2025
- **ECLI:** ECLI:EU:C:2025:935
- **Instrument:** Regulation (EU) 2016/679 (GDPR)
- **Provisions:** [Article 4(7)](https://dposchool.com/gdpr/article/4#4-7), [Article 5(2)](https://dposchool.com/gdpr/article/5#2), [Article 9](https://dposchool.com/gdpr/article/9), [Article 24](https://dposchool.com/gdpr/article/24), [Article 25](https://dposchool.com/gdpr/article/25), [Article 26](https://dposchool.com/gdpr/article/26), [Article 32](https://dposchool.com/gdpr/article/32), [Article 2(4)](https://dposchool.com/gdpr/article/2#4)

## Holding (summary, not the official text)

An online marketplace operator is a controller of personal data in ads published on its site; before publication it must identify ads with sensitive data, check the advertiser is the person concerned or has explicit consent, take security measures against copying, and cannot rely on the hosting exemptions of the e-Commerce Directive for these GDPR duties.

## Official source

- [Case C-492/23 on CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-492/23&language=en)
- [Judgment on EUR-Lex (CELEX 62023CJ0492)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0492)

Checked against the official source on 28 October 2026.

Only the judgment as published by the Court of Justice is authoritative. This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Judgments](https://dposchool.com/gdpr/cases) / C-492/23

[All judgments](https://dposchool.com/gdpr/cases)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents