German courts annul internet blocking orders against pornography platforms: Key takeaways for digital service providers
7 min read
Recent landmark decisions by German administrative courts have declared internet blocking orders against Cyprus-based pornography platforms unlawful. The rulings underscore the primacy of EU law, particularly the Digital Services Act (DSA) and the country-of-origin principle, over national youth protection rules. The judgments have significant implications for digital service providers, such as video-sharing platforms, social media platforms and similar content, host and access providers operating across the EU.
Background
In April 2024, the Rhineland-Palatinate State Media Authority ordered several German internet access providers to block access to certain websites containing pornographic content operated by a company based in the Republic of Cyprus, arguing that the platforms failed to provide sufficient technical safeguards (such as age verification systems) to prevent children and adolescents from accessing harmful content, as required under the German Interstate Treaty on the Protection of Minors in the Media (Jugendmedienschutz-Staatsvertrag - JMStV). After priority measures against the website operators and their technical service providers (host providers) proved unsuccessful, the media authority required the internet access providers to implement DNS blocking to prevent accessibility of the websites.
Similarly, in April 2024, the North Rhine-Westphalia State Media Authority ordered two German internet access providers to block access to a website with pornographic content operated by a company as well based in the Republic of Cyprus.
With rulings of 13 January 2026, the Administrative Court of Neustadt an der Weinstraße annulled the blocking orders by the Rhineland-Palatinate Authority.1 The Administrative Court of Düsseldorf granted suspension of enforcement of the blocking orders by the North Rhine-Westphalia Authority in its decisions of 19 November 2025.2
The Courts' Reasoning
Primacy of the Digital Services Act
The Administrative Court of Neustadt ruled that, since the full entry into force of the EU Digital Services Act (DSA)3 in February 2024, youth protection in the online environment is governed by a harmonised EU framework. The DSA sets out comprehensive due diligence obligations for online platforms to protect minors, precluding Member States from imposing additional national requirements in areas already covered by the Regulation. Further, the Court ruled that the DSA supersedes previous German special provisions. In short: the DSA has a blocking effect on Member State media legislation. As a result, the German blocking orders were found to lack a valid legal basis under national law. The Düsseldorf Administrative Court has not ruled on whether the provisions of the JMStV are (still) applicable or whether measures to protect minors in relation to the platform can only be imposed based on the DSA. Rather, it has assumed the applicability of national law.
Violation of the Country-of-Origin Principle
Both courts emphasised that, under the country-of-origin principle enshrined in the E-Commerce Directive4 (and implemented in Germany by the Digitale-Dienste-Gesetz - DDG), digital service providers are generally subject only to the laws of the EU Member State in which they are established—in this case, Cyprus. Other Member States may only derogate from this principle in narrowly defined circumstances and through individualised measures. According to recent case law of the Court of Justice of the European Union,5 Member States may not take general abstract measures that apply to a broadly defined category of specific information society services and apply indiscriminately to all providers of that category of services, such as the German Interstate Treaty on the Protection of Minors in the Media.
The amendments to the Interstate Treaty on the Protection of Minors in the Media that entered into force on 1 December 2025, pursuant to the Sixth State Treaty Amending Media Treaties, do not lead to a different interpretation of the EU law-based inapplicability of abstract-general JMStV requirements to providers based in other EU Member States, as the normative structure of the JMStV continues to impose direct obligations on all providers without requiring individualised administrative orders.
In the notification procedure regarding the intended amendment of the JMStV the EU Commission has already announced that the obligations under the JMStV, also for providers based in another Member State, to take measures to ensure that pornographic content is made accessible only to adults, as an abstract-general measure constitutes a violation of the country-of-origin principle.6
DSA Does Not Authorise National Blocking Orders
The Administrative Court of Neustadt further held that the blocking orders could not be based directly on the provisions of the DSA, as Cypriot authorities would be primarily responsible, and in any event, action by the national State Media Authority against one of the platforms classified as a "Very Large Online Platform" within the meaning of Article 33(1) DSA is precluded because the EU Commission has already initiated its own proceedings, thereby establishing exclusive jurisdiction of the Commission.
Appeals Permitted
Due to the fundamental significance of the cases, the Administrative Court of Neustadt permitted appeal to the Higher Administrative Court of Rhineland-Palatinate. The Düsseldorf Administrative Court also ruled that appeals may be lodged against all decisions to the Higher Administrative Court of North Rhine-Westphalia.
Key Takeaways
- Protection by the country-of-origin principle: Providers of digital services established in EU Member States are generally protected by the country-of-origin principle and cannot be subjected to abstract-general national regulatory requirements of other Member States. This strengthens legal certainty for cross-border digital services within the single market.
- Primacy of EU-level regulation: The rulings highlight the growing importance of EU-level regulation in the digital sector and the need for providers to monitor both EU and national legal developments closely. The DSA establishes a comprehensive, harmonised framework that takes precedence over national regulatory approaches. Businesses should focus compliance efforts on DSA requirements rather than divergent national laws.
- Enforcement challenges for national authorities: The decisions significantly limit the ability of German authorities to enforce national youth protection standards against foreign-based platforms. Since the majority of service providers targeted by German youth protection regulations are not based in Germany but in other EU Member States such as Ireland, the Netherlands, Luxembourg, or Cyprus, the application of the country-of-origin principle significantly reduces the scope of abstract-general German youth protection regulation in the area of digital services to the few service providers based in Germany.
Practical Recommendations
Digital service providers should:
- review their compliance programmes in light of the DSA and ensure alignment with the requirements of their home Member State;
- evaluate enforcement risks from national authorities in light of these rulings, particularly regarding blocking orders, payment blocking, and other indirect enforcement measures; and
- actively engage with the European Commission as competent authority if their platform has been designated as a Very Large Online Platform (VLOP) and Very Large Online Search Engine (VLOSE)
Conclusion
A paradigm shift is emerging in EU media legislation and regulation: The EU is becoming a player in genuine media legislation, and the European Commission (in collaboration with other institutions where appropriate) is increasingly acting as a central media regulator in the European single market for media services. In other words, media legislation and regulation in the EU is becoming Europeanised. The recent German court decisions mark a significant shift in the enforcement landscape for online content regulation in the EU. They reaffirm the primacy of EU law and the country-of-origin principle, limiting the extraterritorial reach of national youth protection rules. While youth protection remains a legitimate and important regulatory objective, the Courts have made clear that enforcement must occur within the framework established by EU law, particularly the Digital Services Act. Businesses should carefully assess their compliance strategies and enforcement risks in light of these developments.
Johannes Rabe (White & Case, Associate, Berlin) contributed to the development of this publication.
1 See press release No. 3/26 of the Administrative Court of Neustadt an der Weinstraße regarding its judgments of 13 January 2026, 5 K 475/24.NW, 5 K 476/24.NW, 5 K 1203/24.NW, 5 K 1204/04.NW, available here.
2 See press release of the Administrative Court of Düsseldorf regarding its decisions of 19 November 2025, 27 L 805/24, 27 L 806/24, 27 L 1347/24, 27 L 1348/24, 27 L 1349/24, 27 L 1350/24, available here.
3 Regulation (EU) 2022/2065 of 19 October 2022 on a Single Market for Digital Services (Digital Services Act).
4 Directive 2000/31/EC of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (E-Commerce Directive).
5 CJEU, judgments of 30 May 2024, C-662/22, C-667/22, Airbnb Ireland et al., para. 70, of 9 November 2023, C-376/22, Google Ireland et al., paras. 27 et seq.
6 See EU Commission COM(2024) 4659 final.
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.
© 2026 White & Case LLP
