The EU General Court has upheld the European Commission’s decision to classify Stripchat as a very large online platform, establishing important limits on how technology companies can challenge the calculation of their European user numbers.

The European Union’s General Court has rejected a legal challenge to the European Commission’s classification of adult entertainment platform Stripchat under the Digital Services Act, strengthening Brussels’ authority to determine which online services must comply with the legislation’s most demanding obligations.

In its judgment delivered on 14th October, the Luxembourg-based court dismissed the action brought by Technius Ltd, the company operating Stripchat, against its designation as a very large online platform.

The dispute centred on how the Commission calculated the platform’s average monthly active users in the European Union, which determines whether additional regulatory obligations apply.

Under the Digital Services Act, platforms exceeding 45 million monthly active recipients in the EU are subject to enhanced supervision, including requirements concerning systemic risks, transparency, content moderation and independent auditing.

The judgment addresses a fundamental question for European digital regulation: whether companies can exclude particular categories of website visits when calculating the number of people using their services.

How Brussels challenged the platform’s figures

In February 2023, Technius reported that Stripchat had approximately 31.8 million average monthly active recipients in the EU, placing it below the threshold for very large online platforms.

The company relied on information provided by Similarweb, a commercial service measuring website traffic and user behaviour.

However, the Commission questioned the methodology used to reach that figure. Technius had discounted certain visits on the grounds that users entered the website but departed without engaging with its content.

Such visits are commonly described as bounced visits and frequently appear in commercial website analytics.

The Commission concluded that the company’s deductions had significantly underestimated its audience because the original Similarweb calculation of unique visitors already incorporated a filtering process excluding many bounced visits.

On that basis, Brussels calculated that Stripchat had more than 62 million monthly unique visitors in the EU, well above the statutory threshold.

The Commission consequently designated the platform as a very large online service on 20th December 2023. Technius challenged the decision, arguing that the figures were unreliable and that the absence of a prescribed calculation methodology undermined legal certainty.

The EU General Court rejected both arguments.

Court rejects challenge to calculation methodology

According to the court’s official explanation, the Commission had adequately explained its calculation and was entitled to rely on the data available when the designation decision was adopted.

The judges found that Technius had effectively applied deductions to figures from which relevant traffic had already been filtered, producing an artificially reduced estimate of active recipients.

The judgment also addressed a potentially significant complication.

After the Commission adopted its decision, Similarweb revised its methodology. Using the corrected method, Stripchat’s estimated monthly active audience for the relevant period was approximately 37.3 million.

That figure was below the threshold for classification as a very large online platform. Nevertheless, the court held that the subsequent correction did not invalidate the original designation.

The judges determined that the Commission’s decision had to be assessed according to the facts, applicable law and permissible evidence available when the decision was taken.

The ruling therefore does not establish that Stripchat currently exceeds 45 million monthly users. It confirms that the later recalculation was insufficient to annul the Commission’s December 2023 decision.

A significant precedent for digital regulation

The consequences extend beyond one adult entertainment website.

The Digital Services Act covers online intermediaries operating in the European market, including social networks, marketplaces, hosting services and other platforms.

Its obligations increase according to the size and nature of a company’s operations. Very large online platforms must assess systemic risks associated with their services, introduce appropriate mitigation measures and submit to independent audits.

The Commission is responsible for supervising their additional obligations and can impose substantial financial penalties for established infringements.

The distinction between the two categories can therefore have considerable financial and operational consequences.

Companies falling below the 45 million threshold remain subject to relevant DSA obligations but do not face the same additional requirements imposed on the largest platforms.

The General Court’s ruling confirms that companies cannot escape designation by applying an unreliable interpretation of website traffic data.

At the same time, the Commission’s published supervisory framework allows a designation to be revoked when a platform remains below the threshold for a full year.

European technology enforcement faces growing scrutiny

The judgment comes as the Commission faces multiple legal challenges to its enforcement of Europe’s digital legislation.

As EU Today previously reported, Washington has sought to intervene in proceedings concerning the Commission’s €120 million Digital Services Act fine against X, introducing an additional diplomatic dimension to European regulatory disputes.

The Commission is also pursuing separate investigations into whether major platforms comply with obligations concerning the protection of minors, advertising transparency and the management of illegal content.

In another case examined by EU Today, Brussels reached preliminary findings concerning TikTok’s default privacy settings for children, illustrating the practical consequences of the stricter duties imposed on very large online platforms.

The Stripchat judgment concerns designation rather than a finding that the company breached any substantive safety obligation. Its immediate consequence is to preserve the Commission’s original classification decision.

Technius may still appeal to the Court of Justice of the European Union on points of law within two months and ten days of notification of the judgment.

For European regulators, the decision provides judicial support for using established commercial analytics when assessing the reach of online platforms, provided that the methodology is adequately explained and the underlying evidence is reliable.

For technology companies, it confirms that the legal assessment of user numbers extends beyond the figures they choose to report to Brussels. The Commission can scrutinise those calculations and reject methods that fail to provide a reliable estimate of an online service’s European audience.

In December 2023, a Belarusian KGB representative entered an online seminar organised by the Belarusian Free University and told participants that everything was under the service’s control.  

The following month, the online university, run from exile, was designated an “extremist entity”.

It was a warning that being in exile in a safe country does not necessarily put independent voices beyond the reach of authoritarian states. 

For people forced into exile, reaching the EU should mean being able to continue their work without fear. Yet repression follows them into the digital spaces where they organise, report, and communicate. “We can never be sure who is behind a switched-off camera in our online meetings,” one interviewee told us.  

ARTICLE 19 Europe’s new report, 404: Safety not found?, draws on interviews with exiled targeted journalists, human rights defenders working in Belarusian and Russian language environments, as well as digital security experts who try to protect them. Respondents identified Belarusian and Russian state-linked actors as major sources of threats, while stressing how difficult it is to attribute individual incidents. 

The research documents phishing attacks that expose private communications and trusted contacts, including people inside repressive states. It also shows how platform moderation is manipulated through coordinated malicious complaints.

“Extremist” and “foreign agent” designations deter audiences from sharing or subscribing to independent media. A publication may lose sensitive records built up over years, or remain online yet lose contact with the people it exists to inform. 

The harm extends beyond the person whose accounts are compromised. Stolen information may be used to pressure colleagues and relatives, while fear and mistrust drive self-censorship and withdrawal from public work.

For dispersed organisations with few offline ways to reach audiences, losing access to a platform can threaten their ability to function. 

To an external observer, those attacks might seem like a scattering of isolated incidents. They are not. Digital transnational repression is a coordinated, evolving strategy – and treating it as anything less than a systemic risk will leave the response permanently one step behind the threat.

It’s a reality that the international community, including the European Union, must confront. 

Turning commitments into protection

EU governments should recognise transnational repression for what it is: an attack on the conditions that allow independent journalism and civil society to function.

Offering physical refuge is not enough if people in exile cannot safely investigate abuses, organise or reach their audiences.  

On 23 September, more than 130 UN human rights experts called for action against transnational repression. Mariana Katzarova, the UN special rapporteur on Russia, has called for a binding UN convention. 

But the EU does not need to wait.  

The Digital Services Act already gives the European Commission a basis for action. It requires designated very large online platforms to assess systemic risks to fundamental rights arising from their services in the EU and to take effective, proportionate measures in response.

The practical test is straightforward: does a platform’s design or operation enable transnational repression? Does that amount to a systemic risk under Article 34? Has the platform adequately mitigated it under Article 35? 

Repeated abuse of reporting systems should trigger scrutiny of how those systems operate.

Platforms should provide meaningful human review, clear and accessible appeals and timely support for users facing coordinated attacks, and scrutinise government requests based on politically motivated designations.

Where the commission finds breaches, it should enforce compliance. Any measures against repression must protect freedom of expression, privacy and secure communication, including encryption. 

While attribution remains difficult, victims should not have to establish the entire chain of state responsibility before receiving support.

Investigators must pursue perpetrators and enablers, while regulators assess whether platforms have addressed recurring risks.

These are distinct responsibilities; difficulty in fulfilling one cannot justify neglecting the other. 

The EU should also establish a permanent European coordination mechanism linking national authorities, cybersecurity responders, and civil society.

It should set out clear arrangements for cross-border referrals, early warnings and support.

People reporting attacks need practical assistance, legal advice, and psychological support. Authorities must work with affected communities and build trust without treating language or nationality as grounds for suspicion. 

The test for the EU is simple: can people who have reached European soil feel safe to continue documenting abuses, speaking publicly and seeking justice without having to constantly fear the governments they fled?

If the EU’s commitment to freedom of expression is real, it must be measured by the protection it delivers. 

A group of 119 members of the European Parliament is pressing the European Commission and national governments to ensure that a new EU ban on artificial-intelligence  ‘Nudifier’systems used to generate non-consensual sexual images can be enforced as soon as it takes effect.

The prohibition on so-called AI “nudifier” systems becomes applicable on 2 December 2026 following changes to the EU Artificial Intelligence Act approved earlier this year.

The legislation prohibits AI systems designed to create child sexual abuse material or realistic images, video or audio depicting an identifiable person’s intimate parts or sexually explicit activity without that person’s consent.

Providers cannot place systems intended for such use on the EU market. Systems capable of producing the material must have adequate safeguards intended to prevent it, while deployers are prohibited from deliberately using AI systems for that purpose.

The final agreement on the AI Act amendments gave companies until 2 December to bring their systems into compliance.

The latest intervention is intended to ensure that regulators are ready to enforce the prohibition rather than simply having the legislation on the statute book.

The letter supported by 119 MEPs was initiated by Green MEP Lena Schilling and Greens/EFA co-president Terry Reintke.

Its signatories include members from several political groups.

They want the Commission and member states to ensure that national authorities are designated to enforce the ban and that people targeted by non-consensual AI-generated sexual imagery know which authority to contact.

The letter also calls for stronger enforcement of the Digital Services Act against online platforms and search engines carrying or facilitating access to such material.

The initiative follows research cited by the organisers which identified 147 European politicians appearing on websites containing sexualised AI deepfakes.

Of those identified, 138 were women.

Schilling was among those affected and has used her own case to argue that the December prohibition needs an operational enforcement system from its first day.

The prohibition emerged during the EU’s broader revision of its AI legislation.

In March, the European Parliament adopted its negotiating position by 569 votes to 45, with 23 abstentions.

Parliament and Council subsequently reached agreement on the revised text, and the measure completed its formal legislative process in June.

EU Today reported at the time that the Council’s final approval combined delays to some high-risk AI requirements with new restrictions on non-consensual sexual imagery.

The issue is distinct from the wider transparency requirements applying to AI-generated content.

Under Article 50 of the AI Act, transparency obligations have applied since 2 August.

Providers of generative systems must in relevant cases make AI-generated or manipulated material machine-readable and detectable, while deployers face disclosure obligations covering deepfakes and some AI-generated material dealing with matters of public interest.

EU Today examined those changes when chatbot and deepfake disclosure rules entered into application in August.

There is, however, a transitional period for some AI systems that were already on the market before 2 August. Their machine-readable marking obligations take effect on 2 December.

That means the same date will bring both the new nudifier prohibition and the end of the transitional period for certain AI-content marking requirements.

Enforcement is divided between national regulators and EU institutions.

National market-surveillance authorities carry much of the responsibility for enforcing the AI Act. The Commission’s AI Office has direct enforcement responsibilities in more limited areas, including certain systems built on general-purpose AI models and systems integrated into very large online platforms or search engines.

The Commission’s guidance on Article 50 is intended to provide regulators and companies with a common interpretation of those transparency requirements.

The nudifier prohibition raises an additional problem because distribution of non-consensual intimate images also intersects with the Digital Services Act, national criminal and civil laws and EU legislation addressing violence against women.

The 119 MEPs are therefore seeking action beyond the AI Act itself.

Their letter asks for stricter use of the Digital Services Act against platforms and search engines, faster implementation of the EU directive combating violence against women and clearly identifiable national authorities able to respond to complaints.

The legal gap surrounding nudifier systems had previously been acknowledged by the Commission.

Its review of prohibited AI practices concluded that the original AI Act’s provisions on manipulation and exploitation of vulnerabilities did not adequately cover systems producing child sexual abuse material and non-consensual sexually explicit images.

That finding contributed to the explicit prohibition subsequently added during the Digital Omnibus negotiations.

The legislation is now settled. The immediate issue before the 2 December deadline is whether regulators across the 27 member states have the mechanisms in place to identify prohibited systems, investigate providers and respond when people report AI-generated intimate material produced without their consent.