Short answer
A user who uploads protected material without authorisation or a valid copyright exception may be directly liable. For a qualifying online content-sharing service provider, Article 17 of Directive (EU) 2019/790 goes further: the platform itself performs an act of communication or making available when it gives the public access to user-uploaded protected material. It must obtain authorisation or satisfy a demanding, proportionate “best efforts” regime concerning licensing, specified works, substantiated notices, removal and repeat uploads.
That regime does not authorise indiscriminate filtering. Cooperation with rightholders must not prevent lawful content from remaining available. Users must be able to rely on quotation, criticism, review, caricature, parody and pastiche. Article 17 forbids a general monitoring obligation, requires justified requests, and provides prompt complaints, human review, impartial out-of-court redress and court access. The Court of Justice has held that providers cannot be required to block at upload stage content whose illegality would require an independent assessment.
The Digital Services Act adds transparency, notice, reasons and redress duties, while preserving the special copyright rules. The result depends on the service, user, licence, work, national implementation and whether the upload is genuinely infringing.
Start by classifying the platform and the upload
Article 17 does not govern every website that stores a file. It applies to an online content-sharing service provider as defined in Article 2(6): an information-society service whose main or one of its main purposes is to store and give public access to a large amount of protected user-uploaded content, which it organises and promotes for profit-making purposes. The Directive excludes, among others, non-profit online encyclopaedias, non-profit educational and scientific repositories, open-source development platforms, electronic communications services, online marketplaces, business-to-business cloud services and personal cloud storage that does not provide public access.
An upload may be authorised, covered by the platform's licence, use public-domain material, or rely on an exception. Article 17(2) extends platform authorisation to relevant non-commercial or low-revenue user acts. Without such a route, the user may infringe reproduction and communication rights.
A covered platform communicates user uploads to the public
Article 17 assigns a direct copyright role to the covered service:
Member States shall provide that an online content-sharing service provider performs an act of communication to the public or an act of making available to the public [...] when it gives the public access to copyright-protected works or other protected subject matter uploaded by its users. —
The provider should therefore seek authorisation, commonly through a licence. For situations within Article 17, the former hosting safe harbour in Article 14 of Directive 2000/31 does not apply. The current Digital Services Act hosting safe harbour likewise does not displace this special copyright regime; the DSA expressly preserves EU copyright law.
As of 31 July 2026, Case C-579/24 remains pending. The Advocate General has proposed that technically necessary server copies are reproductions, but that the Article 17 authorisation covers them—and qualifying non-commercial users' copies—without a separate licence. That opinion is not a Court judgment.
Without authorisation, the covered provider is liable unless it demonstrates all applicable Article 17(4) conditions:
- best efforts to obtain authorisation;
- best efforts, according to high industry standards of professional diligence, to ensure the unavailability of specific works for which rightholders supplied relevant and necessary information; and
- expeditious action on a sufficiently substantiated notice to disable access or remove the notified material, plus best efforts to prevent future uploads of those specified works.
Article 17(5) makes compliance proportionate to service type, audience, size, content, available measures and cost. Article 17(6) provides a lighter regime for a new service available in the EU for under three years with annual turnover below EUR 10 million; an additional repeat-upload obligation applies once monthly EU visitors exceed five million.
Lawful quotation and parody must remain available
Article 17 places a substantive limit on cooperation and filtering:
The cooperation between online content-sharing service providers and rightholders shall not result in the prevention of the availability of works or other subject matter uploaded by users, which do not infringe copyright and related rights, including where such works or other subject matter are covered by an exception or limitation. —
Member States must ensure that users can upload content for quotation, criticism or review, and for caricature, parody or pastiche. These safeguards matter because a matching audio or video fragment may be licensed, public domain, too insubstantial, or lawfully transformed in context. A match is not the same as an infringement.
In Poland v Parliament and Council, Case C-401/19, the Grand Chamber accepted that Article 17's prior review and filtering can restrict freedom of expression. It upheld the regime only because Article 17 contains binding safeguards. In particular:
[P]roviders of those services cannot be required to prevent the uploading and making available to the public of content which, in order to be found unlawful, would require an independent assessment of the content by them in the light of the information provided by the rightholders and of any exceptions and limitations to copyright. —
The Court also said a system unable adequately to distinguish lawful from unlawful content, and therefore liable to block lawful communications, would be incompatible with freedom of expression. Rightholders must supply relevant and necessary information. A notice must contain enough information for the provider to identify illegality without a detailed legal examination. Article 17(8) prohibits a general monitoring obligation.
Automated matching may support decisions about clearly identified material, but thresholds must address false positives and context. A detected fragment is not conclusively unlawful.
Complaints must be prompt, reasoned and human-reviewed
When content is blocked or removed, Article 17(9) requires an effective and expeditious complaint and redress mechanism. Rightholders must duly justify removal requests. Most importantly:
Complaints [...] shall be processed without undue delay, and decisions to disable access to or remove uploaded content shall be subject to human review. —
Member States must also provide impartial out-of-court redress without removing national legal protection, efficient judicial remedies, and access to a court or other relevant judicial authority to assert an exception. Platforms must tell users in their terms that EU copyright exceptions and limitations can permit uploads.
The DSA supplies an additional procedural layer where its provisions apply:
- Article 14 requires clear moderation terms and diligent, objective and proportionate enforcement with due regard to users' fundamental rights.
- Article 16 requires hosting notices and decisions to be processed in a timely, diligent, non-arbitrary and objective manner. A notice produces safe-harbour knowledge only where it lets a diligent provider identify illegality without a detailed legal examination.
- Article 17 requires a clear and specific statement of reasons, including the factual and legal ground, use of automation and available redress.
- Articles 20 and 21 provide eligible online-platform users with a free internal complaint route and access to certified out-of-court settlement. Complaint decisions must be supervised by appropriately qualified staff and not taken solely by automated means.
The DSA's small-platform exclusions and detailed scope rules must be checked separately. They do not reduce an Article 17 provider's copyright-specific complaint and human-review duties.
YouTube and Cyando explains the earlier and residual framework
The joined YouTube and Cyando judgment, Cases C-682/18 and C-683/18, concerned the Copyright and E-Commerce Directives as applicable before Article 17. The Court expressly said its answers did not concern the later Article 17 regime.
Under that older framework, merely supplying a platform did not itself amount to communication to the public. A provider could cross the line by contributing beyond mere provision—for example, by knowingly leaving specifically identified illegal material available, failing to deploy measures expected from a reasonably diligent operator despite general knowledge of extensive infringement, selecting illegal content, supplying tools specifically for illegal sharing, knowingly promoting it, or using a financial model that encouraged infringement. A neutral hosting operator could use the safe harbour only without the relevant active role and without knowledge or awareness of specific illegal acts.
This reasoning remains relevant to services and activities outside Article 17's special scope, now read with the DSA hosting safe harbour. It must not be used to dilute the direct statutory treatment of a covered content-sharing provider.
A practical anti-over-blocking process
A compliant assessment should record:
- whether the service meets every element of the Article 2(6) definition or an exclusion;
- whether the platform or user has authorisation;
- the exact work and reliable information supplied by the rightholder;
- whether the upload is clearly infringing or needs contextual legal assessment;
- possible quotation, criticism, review, caricature, parody or pastiche;
- why a particular blocking measure is suitable, necessary and proportionate;
- what automated tool was used and its error controls;
- the reasons sent to the user and notifier; and
- the speed, independence and human supervision of complaint and redress routes.
Conclusion
EU law can make both the unauthorised uploader and a covered content-sharing platform responsible, but it does not prefer copyright enforcement at any cost. Article 17's liability mechanism and its user safeguards form one legal package. A platform seeking to meet its best-efforts duties must target sufficiently identified infringement, preserve lawful and exceptional uses, avoid general monitoring, explain restrictions and correct errors quickly through genuine human-reviewed redress.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.