YouTube and Cyando: When Video-Sharing Platforms Become Directly Liable for User Copyright Infringement in EU Law

The dispute arose from two separate proceedings before the German Federal Court of Justice (Bundesgerichtshof). In Case C-682/18, music producer Frank Peterson brought proceedings against YouTube LLC and its parent company Google LLC before the German civil courts. Peterson asserted copyright and neighbouring rights in various musical recordings and performances by the artist Sarah Brightman, alongside compositions from his private publishing catalogue. In November 2008, unauthorised audio and video recordings of Brightman's Symphony Tour concerts, as well as tracks from the album A Winter Symphony, were uploaded to the YouTube platform by anonymous account holders, allowing users to stream the content on demand without Peterson's licence.

In Case C-683/18, international academic publisher Elsevier Inc. initiated proceedings against Cyando AG, the operator of the cyberlocker file-hosting platform Uploaded. Elsevier established that various proprietary monographs and scientific textbooks, including the Gray's Anatomy medical reference and Materials Science and Engineering, were stored on Cyando's servers and distributed to the public through download links shared across external indexing websites and collection blogs. Cyando offered anonymous storage and an affiliate model that rewarded uploaders financially based on the download volume their shared files generated.

Faced with these cross-cutting claims, the Bundesgerichtshof stayed both proceedings to refer several fundamental questions to the Court of Justice of the European Union. The national court sought clarity on whether operators of video-sharing platforms and cyberlockers perform an act of communication to the public within the meaning of Article 3(1) of Directive 2001/29/EC (the InfoSoc Directive), and whether such operators remain eligible for the conditional hosting liability exemption under Article 14(1) of Directive 2000/31/EC (the E-Commerce Directive).

The interaction between primary copyright infringement and intermediary safe harbours has long generated doctrinal friction across the European internal market. Under Article 3(1) of Directive 2001/29/EC, Member States must provide authors with the exclusive right to authorise or prohibit any communication to the public of their works, by wire or wireless means, including the making available to the public in such a way that members of the public may access them from a place and at a time individually chosen by them. This exclusive prerogative was conceived as an overarching economic safeguard, interpreted broadly by European jurisprudence to guarantee creators equitable remuneration for unauthorised public exploitation of their creative output.

Running parallel to this proprietary regime, Article 14(1) of Directive 2000/31/EC established a horizontal liability exemption for intermediate providers that perform hosting services consisting of the storage of information provided by a recipient of the service. Under this safe harbour, an intermediary avoids monetary liability for damages caused by stored third-party data on two cumulative conditions: it must not have actual knowledge of illegal activity or facts or circumstances from which the illegal activity is apparent, and upon obtaining such knowledge or awareness, it must act expeditiously to remove or disable access to the information.

Crucially, the two Directives were enacted without an explicit statutory hierarchy delineating how primary authorial control under Article 3(1) of the InfoSoc Directive reconciles with the liability exemptions under Article 14(1) of the E-Commerce Directive. If an intermediary's automated technical transmission were deemed a direct act of communication to the public, the platform operator would stand as a primary infringer, calling into question whether it could simultaneously claim to be a passive host entitled to shield itself behind the safe harbour of Article 14(1).

The Grand Chamber of the Court of Justice resolved the primary liability inquiry by reaffirming its established multi-criteria jurisprudence on communication to the public. Under Article 3(1) of Directive 2001/29/EC, liability requires both an act of communication and the transmission of the work to a public, meaning an indeterminate and fairly large audience not considered by the authors when they authorised the initial distribution. In platform hosting scenarios, the decisive legal question centered on whether the intermediary's operational conduct constituted an act of communication performed in full knowledge of the consequences of its actions.

The Court ruled that the operator of a video-sharing platform or file-hosting service does not make a communication to the public within the meaning of Article 3(1) merely by providing the technical architecture that enables users to make content available. Recalling Recital 27 of Directive 2001/29/EC, the Court confirmed that the mere provision of physical facilities for enabling or making a communication does not in itself amount to an act of communication. For a platform operator to cross the line into primary infringement, it must perform a deliberate intervention that plays an indispensable role in providing access to illegal content.

An intermediary plays this indispensable role when it intervenes with the specific intention of facilitating copyright infringement or when its conduct demonstrates deliberate indifference to unlawful exploitation. The Court emphasised that the operator must act in full knowledge of the consequences of its action to give the public access to protected works, meaning that the service must not merely facilitate third-party publication in the abstract, but must actively assist users in circumventing the author's control.

In Peterson and Elsevier, the claimants argued that the technological features integral to modern commercial platforms—automated indexing, algorithmic search functions, user-preference recommendation systems, and structured content categorisation—transform passive hosting into an active, deliberate intervention under Article 3(1). Both YouTube and Cyando operated sophisticated indexing mechanisms that arranged user uploads into accessible catalogues, which the claimants characterised as an autonomous presentation of creative works to a new public.

The Grand Chamber rejected this categorical characterisation. The Court held that automated processing, semantic categorisation, algorithmic ranking, and automated content recommendations are intended to facilitate the navigation of an otherwise unmanageable volume of third-party content. Such technical operations do not, in themselves, establish that the platform operator has knowledge of or control over the specific protected works residing on its servers. The automated display of search results or suggested videos reflects programmatic responses to user queries and historical viewing patterns rather than an autonomous decision by the intermediary to communicate a specific work.

Similarly, the Court held that the commercial nature of the platform and the presence of advertising do not alter the character of the intermediary's intervention under Article 3(1). Although platform operators seek to maximise traffic and commercial revenues, the pursuit of profit does not establish that the operator intentionally intervenes to grant the public unauthorised access to copyright-protected works. Economic motivation alone cannot convert an otherwise neutral hosting facility into an active infringer.

To guide national courts in assessing whether an operator's involvement crosses into an intentional act of communication, the Court established a concrete, non-exhaustive catalogue of factors that evidence deliberate intervention:

The Grand Chamber stressed that these factors must be evaluated as a whole. A finding of communication to the public requires conclusive evidence that the platform operator chose not to implement appropriate technical measures that an ordinarily diligent operator would deploy to counter copyright infringements credibly and effectively, or constructed its commercial ecosystem to benefit directly from unauthorised traffic.

Having clarified the limits of Article 3(1) of Directive 2001/29/EC, the Court evaluated the second core issue: the conditions under which an online platform qualifies for the hosting immunity under Article 14(1) of Directive 2000/31/EC. Safe harbour protection shields an intermediary from financial claims, including damages and costs, provided the service remains strictly confined to the role of an information society service provider whose activity is of a mere technical, automatic and passive nature.

Drawing upon its prior jurisprudence in Google France (Joined Cases C-236/08 to C-238/08) and L'Oréal v eBay (Case C-324/09), the Grand Chamber held that an intermediary is disqualified from Article 14(1) immunity only if it plays an active role that gives it knowledge of, or control over, the data stored at the request of its users. The inquiry into whether a platform plays an active role must focus on whether the operator provides assistance that entails optimising the presentation of the specific uploaded works or promoting them in a manner that demonstrates intellectual awareness or editorial management.

Crucially, the Court held that an operator does not forfeit safe harbour protection merely because it employs automated software to index files, structure displays, or format third-party uploads for technical interoperability across various user devices. Because these processes run automatically without human editorial intervention, they do not confer upon the intermediary the degree of cognitive control necessary to transform the host into an active participant aware of the illicit character of the stored information.

Under Article 14(1)(a) of Directive 2000/31/EC, an intermediary loses safe harbour immunity if it possesses actual knowledge of illegal activity or awareness of facts or circumstances from which that activity is apparent, yet fails to act expeditiously to remove or disable access to the content. The Grand Chamber established rigorous evidentiary standards for assessing when a copyright holder's notification triggers actual knowledge.

The Court held that general, abstract awareness that a platform is used to disseminate protected content unlawfully is insufficient to deprive the operator of the hosting exemption. Because Article 15(1) of Directive 2000/31/EC prohibits Member States from imposing general monitoring obligations upon intermediaries, knowledge under Article 14(1) cannot be imputed from the sheer statistical likelihood of widespread platform misuse. An intermediary is not legally expected to conduct systematic, unguided searches across millions of daily uploads to detect potential infringements.

Consequently, actual knowledge requires that the intermediary receive a notification that contains sufficient factual and legal information to enable a diligent hosting provider to identify the illegality of the stored file without conducting an exhaustive legal or factual investigation. If a notice identifies a specific file, provides verifiable proof of the claimant's rights, and points to the precise URL where the illicit copy resides, the operator must act expeditiously. If the operator fails to take prompt takedown measures following such a concrete notification, it forfeits its Article 14(1) immunity and becomes exposed to ordinary monetary liability.

Even when an intermediary escapes primary liability under Article 3(1) of the InfoSoc Directive and successfully claims safe harbour immunity under Article 14(1) of the E-Commerce Directive, it remains subject to injunctive relief. Under Article 8(3) of Directive 2001/29/EC, Member States must ensure that rightsholders can apply for an injunction against intermediaries whose services are used by a third party to infringe a copyright or related right. This procedural remedy does not depend on intermediary fault or direct wrongdoing.

In Peterson, the Bundesgerichtshof asked whether German procedural law could subordinate the grant of an injunction under Article 8(3) to the condition that the rightsholder first notify the platform operator of an initial infringement and allow it an opportunity to remove the content before judicial proceedings are initiated. Under German national law (specifically the doctrine of Störerhaftung, or disturber liability), a hosting provider could not be subject to court costs or immediate injunctive orders unless it had breached a specific duty of care following an ineffective notification.

The Grand Chamber affirmed the compatibility of this domestic requirement with EU law. The Court held that Article 8(3) does not preclude national procedural rules that require a rightsholder to notify the platform operator and grant it an opportunity to cure the infringement out of court before applying for an injunction. This procedural condition prevents abusive litigation and preserves the practical balance established by the E-Commerce Directive, ensuring that an innocent intermediary is not burdened with the substantial procedural costs of an unexpected judicial action before it has even been informed of the illicit upload.

The decision in YouTube and Cyando arrived at a critical historical juncture, addressing legal questions governed by the 2000 and 2001 Directives just as the deadline for Member States to transpose Directive (EU) 2019/790 on Copyright in the Digital Single Market (the DSM Directive) expired in June 2021. The relationship between the CJEU's interpretation of the legacy framework and the bespoke statutory mechanism of Article 17 of the DSM Directive remains an essential doctrinal distinction.

Article 17 explicitly redefines the legal status of an online content-sharing service provider (OCSSP). Under Article 17(1), an OCSSP performs an act of communication to the public or an act of making available to the public when it gives the public access to copyright-protected works uploaded by its users. Furthermore, Article 17(3) explicitly declares that the hosting safe harbour in Article 14(1) of Directive 2000/31/EC does not apply to the situations covered by Article 17. Instead, qualifying OCSSPs must either obtain authorisations from rightsholders or satisfy rigorous, cumulative best-efforts obligations to avoid direct liability for user uploads.

The Grand Chamber in YouTube and Cyando made clear that its preliminary ruling applied strictly ratione temporis to facts arising prior to the DSM Directive. For services falling outside the statutory definition of an OCSSP under Article 2(6) of Directive 2019/790—such as pure cloud storage facilities, cyberlockers lacking public curation, or enterprise data repositories—the principles articulated in YouTube and Cyando remain the governing benchmark under general EU copyright law.

Following the CJEU's preliminary ruling, the joined cases returned to the German Federal Court of Justice for final disposition under domestic law (BGH, Judgments of 2 June 2022, Case I ZR 140/15 YouTube II and Case I ZR 53/17 Uploaded II). Applying the CJEU's factual framework, the Bundesgerichtshof drew starkly contrasting conclusions regarding the two platform operators, illustrating how the Grand Chamber's criteria operate in practice.

In YouTube II, the Bundesgerichtshof dismissed Frank Peterson's damages claims against YouTube. The court found that YouTube had not performed an intentional act of communication to the public under Article 3(1). YouTube had established standard notice-and-takedown procedures, implemented automated verification tools (such as Content ID), and provided clear terms of service prohibiting copyright infringement. Peterson had failed to provide concrete, specific notifications containing precise file URLs in advance of his broader damages suit. In the absence of actual knowledge of specific illicit files, YouTube qualified for the Article 14(1) hosting exemption and could not be held retrospectively liable for damages.

Conversely, in Uploaded II, the Bundesgerichtshof reached an adverse determination regarding Cyando. The German court held that Cyando had engaged in an unauthorised communication to the public because its operational model was purposefully structured to encourage illicit file sharing. Cyando provided anonymous, unindexed storage while paying cash rewards to users whose uploaded files achieved high download volumes, knowing that such traffic in practice consisted almost entirely of popular copyrighted works indexed on third-party link aggregators. By intentionally structuring its service to profit from illegal downloads without deploying effective technical countermeasures, Cyando crossed the threshold into deliberate intervention, forfeiting both the safe harbour and immunity from primary copyright liability.

The Grand Chamber's ruling in YouTube and Cyando established a calibrated doctrinal boundary for online intermediary liability. By refusing to equate the mere provision of an automated, algorithmically driven platform with an act of communication to the public, the Court preserved the structural vitality of hosting safe harbours for neutral intermediaries. Deliberate intervention requires an identifiable subjective or systemic defect: the operator must either cultivate infringement through intentional incentives, demonstrate manifest bad faith upon receiving concrete notice, or systematically omit standard technological precautions.

At the same time, the decision dismantled the presumption that cyberlockers and commercial file-hosts can hide behind passive neutrality while operating business models dependent on widespread piracy. Where an intermediary designs its operational and affiliate structures to monetize unlawful traffic, European copyright law treats that operator not as a neutral host, but as a deliberate co-performer of the public communication.

This dual approach provides legal certainty across two distinct tiers of European digital regulation. For historical disputes and entities that operate outside the scope of Article 17 of Directive (EU) 2019/790, the YouTube and Cyando framework ensures that hosting platforms must exhibit verifiable institutional diligence. Intermediaries that deploy credible technological safeguards and act promptly upon receiving specific notifications retain legal protection; those that engineer their platforms to foster or profit from unauthorised access face direct, unshielded liability under EU copyright law.