The EU General Court has upheld the European Commission’s decision to classify Stripchat as a very large online platform, establishing important limits on how technology companies can challenge the calculation of their European user numbers.

The European Union’s General Court has rejected a legal challenge to the European Commission’s classification of adult entertainment platform Stripchat under the Digital Services Act, strengthening Brussels’ authority to determine which online services must comply with the legislation’s most demanding obligations.

In its judgment delivered on 14th October, the Luxembourg-based court dismissed the action brought by Technius Ltd, the company operating Stripchat, against its designation as a very large online platform.

The dispute centred on how the Commission calculated the platform’s average monthly active users in the European Union, which determines whether additional regulatory obligations apply.

Under the Digital Services Act, platforms exceeding 45 million monthly active recipients in the EU are subject to enhanced supervision, including requirements concerning systemic risks, transparency, content moderation and independent auditing.

The judgment addresses a fundamental question for European digital regulation: whether companies can exclude particular categories of website visits when calculating the number of people using their services.

How Brussels challenged the platform’s figures

In February 2023, Technius reported that Stripchat had approximately 31.8 million average monthly active recipients in the EU, placing it below the threshold for very large online platforms.

The company relied on information provided by Similarweb, a commercial service measuring website traffic and user behaviour.

However, the Commission questioned the methodology used to reach that figure. Technius had discounted certain visits on the grounds that users entered the website but departed without engaging with its content.

Such visits are commonly described as bounced visits and frequently appear in commercial website analytics.

The Commission concluded that the company’s deductions had significantly underestimated its audience because the original Similarweb calculation of unique visitors already incorporated a filtering process excluding many bounced visits.

On that basis, Brussels calculated that Stripchat had more than 62 million monthly unique visitors in the EU, well above the statutory threshold.

The Commission consequently designated the platform as a very large online service on 20th December 2023. Technius challenged the decision, arguing that the figures were unreliable and that the absence of a prescribed calculation methodology undermined legal certainty.

The EU General Court rejected both arguments.

Court rejects challenge to calculation methodology

According to the court’s official explanation, the Commission had adequately explained its calculation and was entitled to rely on the data available when the designation decision was adopted.

The judges found that Technius had effectively applied deductions to figures from which relevant traffic had already been filtered, producing an artificially reduced estimate of active recipients.

The judgment also addressed a potentially significant complication.

After the Commission adopted its decision, Similarweb revised its methodology. Using the corrected method, Stripchat’s estimated monthly active audience for the relevant period was approximately 37.3 million.

That figure was below the threshold for classification as a very large online platform. Nevertheless, the court held that the subsequent correction did not invalidate the original designation.

The judges determined that the Commission’s decision had to be assessed according to the facts, applicable law and permissible evidence available when the decision was taken.

The ruling therefore does not establish that Stripchat currently exceeds 45 million monthly users. It confirms that the later recalculation was insufficient to annul the Commission’s December 2023 decision.

A significant precedent for digital regulation

The consequences extend beyond one adult entertainment website.

The Digital Services Act covers online intermediaries operating in the European market, including social networks, marketplaces, hosting services and other platforms.

Its obligations increase according to the size and nature of a company’s operations. Very large online platforms must assess systemic risks associated with their services, introduce appropriate mitigation measures and submit to independent audits.

The Commission is responsible for supervising their additional obligations and can impose substantial financial penalties for established infringements.

The distinction between the two categories can therefore have considerable financial and operational consequences.

Companies falling below the 45 million threshold remain subject to relevant DSA obligations but do not face the same additional requirements imposed on the largest platforms.

The General Court’s ruling confirms that companies cannot escape designation by applying an unreliable interpretation of website traffic data.

At the same time, the Commission’s published supervisory framework allows a designation to be revoked when a platform remains below the threshold for a full year.

European technology enforcement faces growing scrutiny

The judgment comes as the Commission faces multiple legal challenges to its enforcement of Europe’s digital legislation.

As EU Today previously reported, Washington has sought to intervene in proceedings concerning the Commission’s €120 million Digital Services Act fine against X, introducing an additional diplomatic dimension to European regulatory disputes.

The Commission is also pursuing separate investigations into whether major platforms comply with obligations concerning the protection of minors, advertising transparency and the management of illegal content.

In another case examined by EU Today, Brussels reached preliminary findings concerning TikTok’s default privacy settings for children, illustrating the practical consequences of the stricter duties imposed on very large online platforms.

The Stripchat judgment concerns designation rather than a finding that the company breached any substantive safety obligation. Its immediate consequence is to preserve the Commission’s original classification decision.

Technius may still appeal to the Court of Justice of the European Union on points of law within two months and ten days of notification of the judgment.

For European regulators, the decision provides judicial support for using established commercial analytics when assessing the reach of online platforms, provided that the methodology is adequately explained and the underlying evidence is reliable.

For technology companies, it confirms that the legal assessment of user numbers extends beyond the figures they choose to report to Brussels. The Commission can scrutinise those calculations and reject methods that fail to provide a reliable estimate of an online service’s European audience.

In December 2023, a Belarusian KGB representative entered an online seminar organised by the Belarusian Free University and told participants that everything was under the service’s control.  

The following month, the online university, run from exile, was designated an “extremist entity”.

It was a warning that being in exile in a safe country does not necessarily put independent voices beyond the reach of authoritarian states. 

For people forced into exile, reaching the EU should mean being able to continue their work without fear. Yet repression follows them into the digital spaces where they organise, report, and communicate. “We can never be sure who is behind a switched-off camera in our online meetings,” one interviewee told us.  

ARTICLE 19 Europe’s new report, 404: Safety not found?, draws on interviews with exiled targeted journalists, human rights defenders working in Belarusian and Russian language environments, as well as digital security experts who try to protect them. Respondents identified Belarusian and Russian state-linked actors as major sources of threats, while stressing how difficult it is to attribute individual incidents. 

The research documents phishing attacks that expose private communications and trusted contacts, including people inside repressive states. It also shows how platform moderation is manipulated through coordinated malicious complaints.

“Extremist” and “foreign agent” designations deter audiences from sharing or subscribing to independent media. A publication may lose sensitive records built up over years, or remain online yet lose contact with the people it exists to inform. 

The harm extends beyond the person whose accounts are compromised. Stolen information may be used to pressure colleagues and relatives, while fear and mistrust drive self-censorship and withdrawal from public work.

For dispersed organisations with few offline ways to reach audiences, losing access to a platform can threaten their ability to function. 

To an external observer, those attacks might seem like a scattering of isolated incidents. They are not. Digital transnational repression is a coordinated, evolving strategy – and treating it as anything less than a systemic risk will leave the response permanently one step behind the threat.

It’s a reality that the international community, including the European Union, must confront. 

Turning commitments into protection

EU governments should recognise transnational repression for what it is: an attack on the conditions that allow independent journalism and civil society to function.

Offering physical refuge is not enough if people in exile cannot safely investigate abuses, organise or reach their audiences.  

On 23 September, more than 130 UN human rights experts called for action against transnational repression. Mariana Katzarova, the UN special rapporteur on Russia, has called for a binding UN convention. 

But the EU does not need to wait.  

The Digital Services Act already gives the European Commission a basis for action. It requires designated very large online platforms to assess systemic risks to fundamental rights arising from their services in the EU and to take effective, proportionate measures in response.

The practical test is straightforward: does a platform’s design or operation enable transnational repression? Does that amount to a systemic risk under Article 34? Has the platform adequately mitigated it under Article 35? 

Repeated abuse of reporting systems should trigger scrutiny of how those systems operate.

Platforms should provide meaningful human review, clear and accessible appeals and timely support for users facing coordinated attacks, and scrutinise government requests based on politically motivated designations.

Where the commission finds breaches, it should enforce compliance. Any measures against repression must protect freedom of expression, privacy and secure communication, including encryption. 

While attribution remains difficult, victims should not have to establish the entire chain of state responsibility before receiving support.

Investigators must pursue perpetrators and enablers, while regulators assess whether platforms have addressed recurring risks.

These are distinct responsibilities; difficulty in fulfilling one cannot justify neglecting the other. 

The EU should also establish a permanent European coordination mechanism linking national authorities, cybersecurity responders, and civil society.

It should set out clear arrangements for cross-border referrals, early warnings and support.

People reporting attacks need practical assistance, legal advice, and psychological support. Authorities must work with affected communities and build trust without treating language or nationality as grounds for suspicion. 

The test for the EU is simple: can people who have reached European soil feel safe to continue documenting abuses, speaking publicly and seeking justice without having to constantly fear the governments they fled?

If the EU’s commitment to freedom of expression is real, it must be measured by the protection it delivers.