Hosting Providers and Unlawful Content: The Court of Cassation Clarifies Liability Limits with Ordinance No. 17360 of 2025

In the digital age, managing online content is a constant challenge, especially for hosting service providers. Freedom of expression often clashes with the need to protect individuals from defamation, copyright infringement, or other forms of illegality. In this context, Ordinance No. 17360 of June 27, 2025, by the Court of Cassation, presided over by A. S. and drafted by A. T., offers a fundamental clarification on the liability limits of hosting providers, delineating a precise boundary between exemption and the obligation to intervene.

The ruling, stemming from the appeal by F. against A., quashed a previous decision by the Court of Appeal of Florence and referred the case back, emphasizing "knowledge of illegality" as the determining factor for liability. Let's analyze the key points of this important decision together.

The Role of the "Passive" Hosting Provider and the Law

To fully understand the scope of the Ordinance, it is essential to distinguish between different types of IT service providers. The relevant legislation is Legislative Decree No. 70 of 2003, which transposed Directive 2000/31/EC on electronic commerce. Article 16 of this decree governs the liability of hosting providers, distinguishing between "active" and "passive" ones.

• "Passive" hosting provider: merely provides data storage space without exercising any prior control over content uploaded by users. This category includes mere storage services, such as blogs, forums, or social media platforms where users post independently.
• "Active" hosting provider: actively intervenes in the management, selection, modification, or promotion of content, assuming an editorial or control role. In such cases, its liability is more extensive.

The general rule for "passive" hosting providers is exemption from liability for unlawful content published by third parties. However, this exemption is not absolute, as clarified by the Court of Cassation.

The Ordinance's Turning Point: Knowledge and Obligation to Remove

The core of Ordinance No. 17360 of 2025 lies in defining the conditions under which a "passive" hosting provider loses its exemption from liability. The Supreme Court reiterates and consolidates a principle already emerged in previous rulings (such as No. 7708 of 2019 and No. 24818 of 2023), but articulates it with clarity.

A provider of IT services acting as a "passive" hosting provider is generally exempt from liability for the publication of any unlawful information and defamatory comments originating from third parties who are recipients of the service; however, once it acquires, in any manner, awareness of the manifest illegality of such information and comments, it is obliged to take action for their prompt removal if it wishes to continue to benefit from exemption from said liability, without the need for a communication from the competent authorities for this purpose.

This maxim is of crucial importance. The Court of Cassation establishes that the exemption from liability ceases the moment the hosting provider acquires, "in any manner," "awareness of the manifest illegality" of the content. This means that a formal communication from judicial or administrative authorities is not necessary to trigger the obligation to act. It is sufficient for the provider to be aware, even through a user report or internal monitoring, of the evident illegality of a piece of content.

The adjective "manifest" is not accidental: it indicates that the illegality must be evident, not requiring complex legal investigations. For example, the publication of child pornography, blatant defamation, or clear copyright infringement fall into this category. Once such awareness is acquired, the provider is obliged to take action for the "prompt removal" of the content, under penalty of losing its exemption and assuming direct liability for the unlawful act.

Conclusions and Practical Implications

Ordinance No. 17360 of 2025 represents an important warning for all hosting providers. Italian jurisprudence, in line with European principles, aims to balance freedom of information and technological innovation with the protection of fundamental individual rights. The ruling clarifies that passivity is no longer an option when the illegality of content is evident and known to the platform operator.

The practical implications are significant:

• "Passive" hosting providers must implement effective systems for receiving and managing reports of unlawful content.
• It is advisable to adopt clear policies on content moderation and prompt removal.
• The assessment of "manifest illegality" requires careful case-by-case analysis but cannot be evaded under the pretext of the absence of a formal order.

In summary, the Court of Cassation has reiterated a principle of enhanced diligence for online service providers: knowledge of illegality imposes a duty to intervene, regardless of who or how such knowledge was acquired. This contributes to making the web a safer place by holding accountable those who, while not creating the content, enable its widespread dissemination.