For a quarter of a century, the single most useful sentence in EU digital law was short: comply where you are established, and the rest of the bloc is not your problem. The country-of-origin principle in the e-Commerce Directive was the mechanism that turned twenty-seven national rulebooks into one market. It is also, not coincidentally, why so much of the internet is legally domiciled in a small handful of member states. Establish in the most permissive jurisdiction, and the principle did the rest of the work: other member states could not reach across the border to impose their own rules on you.
On 16 June 2026, the Court of Justice of the European Union narrowed that sentence for one specific, high-stakes purpose. In its Grand Chamber judgment in Joined Cases C-188/24 (WebGroup Czech Republic and NKL Associates) and C-190/24 (Coyote System), the Court held that the protection of minors can justify a member state imposing obligations — including age-verification duties — on a service provider established in another member state, without the country-of-origin principle standing in the way. It is the first time the EU’s highest court has ruled directly on the question every European platform operator has been quietly avoiding: can France make you check ages if you are established in Prague? The answer, subject to conditions, is now yes.
The dispute: a French decree and a Czech address
The case did not begin as a grand constitutional question. It began the way most of these do — with a regulator sending letters.
France requires publishers of pornographic content to deploy technical age-verification measures that keep minors out, under Article 227-24 of its Criminal Code as extended by Law No 2020-936 and Decree No 2021-1306. France’s audiovisual and digital regulator, Arcom, issued formal notices to a set of large adult sites demanding they comply. Several of the operators were established not in France but in the Czech Republic — and they argued, with real legal force behind them, that France simply had no authority over them. Their service was an “information society service” provided from another member state; under the country-of-origin principle, only Czech rules and Czech regulators applied. The French decree, on their reading, was exactly the kind of extraterritorial reach the single market was built to prevent.
That argument is not frivolous, and for years it worked in practice. The whole point of establishing in one member state rather than another is that you inherit its regulatory posture. The referring French court asked the CJEU to settle whether the country-of-origin principle really does immunize a foreign-established provider from a downstream member state’s child-protection rules — and, in the parallel Coyote case, whether an operator that algorithmically curates what its users see still enjoys the passive-host liability shield.
What the Court actually held
The judgment does two distinct things, and platforms need to hold them separately because they cut in the same direction but through different doors.
First: minors are an override. The Court confirmed that the country-of-origin principle does not preclude a member state from taking measures against a provider established in another member state where an essential objective — and the protection of minors is exactly that — is at stake. This is not a novel invention; it is the derogation mechanism the e-Commerce Directive always contained, now given teeth and applied squarely to age verification. A destination member state can act against a foreign-established service to protect children, and country-of-origin is no longer an automatic answer to “you can’t regulate me.”
Second: the conditions are stringent, not decorative. The Court did not hand national regulators a blank cheque. To act against a provider established elsewhere, a member state must proceed case by case with individual, targeted measures rather than a blanket rule aimed at foreign services; it must demonstrate proportionality; and, in the ordinary course, it must follow the Directive’s cooperation procedure — asking the provider’s home member state to act first and notifying the Commission — before imposing its own restriction. This is the guardrail. The ruling validates cross-border enforcement and disciplines it: a regulator that wants to reach across the border has to do the procedural work, target specific providers, and show its measure is no broader than the child-protection objective requires. As Baker McKenzie’s analysis frames it, the Court further shaped the principle rather than demolishing it.
Third, in the companion Coyote holding: the host shield is not unconditional. The Court addressed when a platform loses the hosting-liability exemption it relies on to avoid responsibility for user content. Where a provider exercises active, algorithmic control over how content is distributed — deciding who sees what — it can forfeit the neutral-intermediary protection and be treated as playing an active role. Commentators reading the judgment have called it, only half-hyperbolically, “the end of immunity” for algorithmically curated services. For age assurance specifically, this closes a convenient escape hatch: “we merely host, we do not control what minors reach” is a weaker defence the moment a recommender system is doing the reaching. Osborne Clarke’s read is that the Grand Chamber has meaningfully clarified both the “coordinated field” and the limits of hosting liability in one stroke.
Why “establish in the most permissive member state” just stopped working
The practical consequence is the part every compliance and legal team needs to internalize, because it inverts a strategy that has been rational for a decade.
The old EU playbook for a service that would rather not verify ages was structural, not technical: pick your establishment carefully. Domicile in the member state with the lightest child-protection enforcement, and let the country-of-origin principle hold the stricter states at arm’s length. The relocation of adult platforms to jurisdictions perceived as more permissive was not an accident of tax or talent; it was, in part, regulatory arbitrage built directly on this principle. The Czech establishment in C-188/24 is the strategy in its purest form.
After 16 June 2026, that structure no longer immunizes you from the destination state’s rules where minors are concerned. France can pursue a provider in Prague; Germany can pursue a provider in Dublin; the pattern generalizes. The reporting on the judgment put it bluntly: member states can force age checks on foreign sites. Your establishment address is no longer a moat around your age-gating obligations. What matters now is the rule of the member state whose users you actually serve — and if you serve users in twenty-seven of them, the operative standard is the strictest one that can lawfully reach you, not the most convenient one you registered under.
This is the EU-internal mirror of the fragmentation problem platforms already know from the US state patchwork, and it changes the calculus we described in “geoblock or verify.” Geoblocking a single strict member state was a plausible cost-avoidance move when country-of-origin protected you everywhere else. Now that the principle yields to child protection across borders, the exit door is smaller: you would have to block every member state whose standard you cannot meet, and the ruling makes clear that more of them can lawfully assert a standard.
The fragmentation this unlocks — and the harmonization racing to catch it
There is an uncomfortable tension sitting inside this judgment. It validates each member state’s power to enforce its own child-protection rules across borders, which is precisely what produces a fragmented EU: France’s Arcom standard, Germany’s KJM/JMStV regime, Italy’s AGCOM approach, Spain’s pilots, and more, each now harder to escape by establishment choice. A provider serving the whole bloc faces not one age-verification rule but a lattice of them, and the DSA’s own country-of-origin logic does not fully resolve the friction — the Commission itself has flagged that aggressive national initiatives risk clashing with DSA coherence and generating years of litigation.
Brussels’ answer to the fragmentation it just enabled is already in flight. The Commission has been pushing its age-verification “mini-wallet” — a purpose-built app that proves a user is over an age threshold without disclosing identity, declared technically ready in May 2026 and urged into deployment by the end of 2026. It is deliberately built as a subset of the broader EU Digital Identity Wallet, delivering the one function — a privacy-preserving age proof — that member states need now rather than waiting for the full wallet. The strategic bet is obvious: if every member state can compel age checks, give them a common, interoperable, privacy-first way to satisfy that compulsion, so the lattice of national rules resolves onto one technical rail. Whether the mini-wallet actually converges the standards or simply becomes one more accepted method alongside national ones is the open question of the next eighteen months.
The architecture that clears the strictest bar, not the closest one
For a platform operator, the strategic instruction from all of this is a single sentence: stop optimizing your age-assurance posture around where you are established, and start optimizing it around the strictest member-state standard that can lawfully reach your users. That is an architecture problem, and it is the one we build Xident to answer.
Meet the highest bar once, not each bar separately. The failure mode after this ruling is building a bespoke integration per member state — an Arcom flow here, a KJM flow there — that drifts out of sync the moment any one regulator updates its guidance. The durable design is a single age-assurance flow engineered to satisfy the strictest applicable standard, which by construction satisfies the more lenient ones beneath it. Build for the top of the lattice and you inherit the rest.
Resolve the majority with a measured Check. Most users do not need a document scan to clear a well-designed gate. A low-friction, measured Check — facial age estimation for a confident age-range read, a returning-user credential lookup, a liveness or authenticated-device signal, an open-banking or wallet handoff — clears the confident majority while still producing an auditable, defensible decision. This is the tier that keeps your funnel intact under a regime where every member state can now demand you actually check.
Reserve full Verification for the contested minority. When the measured Check lands too close to the threshold, escalate to a document- or chip-read Verification with selective disclosure. High assurance is expensive, so you spend it only where the cheaper measured tier could not resolve the case — an orchestrated, layered waterfall rather than a single blunt gate applied to everyone.
Be wallet-ready before the wallet is mandatory. The EU mini-wallet and the EUDI Wallet are arriving on a end-of-2026 trajectory. A stack that can accept an incoming wallet-based age proof as one Check method — rather than requiring a rebuild when relying-party integration becomes the expected path — is the one that ages well. Design the flow so the mini-wallet is a first-class input the day member states switch it on.
Retain the assertion, not the evidence. What your systems store is a signed “this user is over 18” (or over the relevant threshold), not the face scan or the ID image behind it. This is the privacy-first architecture that answers the data-minimization expectations riding alongside every one of these national regimes, and the single most effective way to make the inevitable breach boring instead of catastrophic.
Make it portable. Layer a reusable credential across the flow, and a user who clears the measured Check once can prove age at the next gate — on your platform or another — without repeating anything. Verify once, prove everywhere, and the per-member-state friction tax collapses into a one-time cost.
What to do before the national regulators press the advantage
The CJEU handed every destination-state regulator a validated legal pathway. Some will use it quickly. Five moves are defensible today and directly on that trajectory:
- Re-map your EU exposure by user, not by establishment. List the member states where you actually have users, then identify each one’s child-protection age-verification standard. Your establishment jurisdiction is no longer the relevant frame; the union of destination-state standards is.
- Identify your strictest reachable standard and build to it. Among the member states that can lawfully reach you, find the toughest requirement and design one flow that satisfies it. Do not build twenty-seven flows.
- Kill the establishment-arbitrage assumption in your risk register. If any part of your compliance posture quietly depends on “we’re established in X, so Y can’t touch us,” rewrite it. For child protection, the ruling removed that assumption.
- Audit your recommender for the Coyote problem. If an algorithm decides what content users reach, do not assume the passive-host shield still covers you. Treat algorithmically distributed content as content you are responsible for gating.
- Get wallet-ready now. Add the EU age-verification mini-wallet to your integration roadmap as an accepted Check method ahead of the end-2026 push, so you are a relying party by design rather than by emergency.
The real headline
Another CJEU judgment about pornographic websites is easy to file under “not my sector.” That would be a mistake. The Court did not rule narrowly about adult content; it ruled about the principle that has underwritten EU platform strategy since 2000 — and it held that where children are concerned, the principle bends to the destination state. The specific facts were French decrees and Czech operators. The general holding is that your establishment address no longer decides which age-verification rules apply to you.
The platforms that read this as an adult-industry story will keep optimizing for the most permissive jurisdiction until a notice arrives from a stricter one. The platforms that read it correctly will stop treating country-of-origin as an age-assurance shield, build one measured flow that clears the strictest bar in the bloc, keep the assertion instead of the evidence, and be ready for the wallet before it is mandatory. Country of origin still runs the single market. It just stopped running your age gate.
Xident provides privacy-first age assurance built on a two-tier model: a low-friction, measured Check for the confident majority — facial age estimation, returning-user credential lookup, liveness, and OAuth — and a high-assurance Verification for the contested few, returning a signed age assertion rather than retaining the underlying identity document. If you serve users across multiple EU member states and want one flow that clears the strictest applicable standard instead of the most convenient one, see how the two operations work or talk to us.
