MILAN—The conviction of three Google executives resulting from an online video showing an autistic schoolboy being bullied has sparked concerns about expanding media company liability in Italy and beyond.

A judge in Milan on Feb. 24 convicted three of four accused Google Inc. executives of violating Italy's privacy code. Google said it will appeal the convictions. The judge, however, acquitted all four on criminal defamation charges.

The boy's father and an advocacy group sought the charges based on a video shot by pupils at a Turin school. The video was uploaded to Google Videos in 2006.

“The video was totally reprehensible and we took it down within hours of being notified by the Italian police,” Matt Sucherman, Google's vp and deputy general counsel for Europe, the Middle East and Africa, said in a statement reacting to the verdict.

Google helped police identify the person who uploaded the video, and she and several classmates were sentenced to 10 months of community service for their involvement in the bullying, Mr. Sucherman said.

“In these rare but unpleasant cases, that's where our involvement would normally end,” he said.

The executives—David Drummond, Arvind Desikan, Peter Fleischer and George Reyes—had nothing to do with the video, according to Google. Mr. Reyes left the company in 2008.

“They did not appear in it, film it, upload it or review it,” Mr. Sucherman said. “None of them know the people involved or were even aware of the video's existence until after it was removed.”

The conviction has proved surprising to media liability experts.

“It's certainly something that changes the pattern of the risk,” said Paolo Rubini, director of risk management at Telecom Italia S.p.A. in Milan and chairman of Italy's risk management association, the Associazione Nazionale di Risk Manager e Responsabili di Assicurazioni Aziendali. “We are concerned.”

“We have to hope that it is an isolated case and does not become a habit,” Mr. Rubini said of the convictions. “Otherwise, it will be really difficult for us to manage this new risk from the lack of control of content.”

Nick Lockett, a senior partner at DL Legal L.L.P., a London firm that specializes in commercial and technology-related litigation, said the ruling, if upheld, “certainly has the capability” to broaden media company liability.

If it stands, the ruling leaves video site operators in a quandary, Mr. Lockett said. If they monitor uploads and an inappropriate posting makes it online, “they can no longer use the defense that as soon as they knew about it they took steps to take it down,” he said. If they don't monitor content to preserve that defense, they risk being held liable for something that appears on their site and is deemed inappropriate, Mr. Lockett said.

The ruling states that the autistic pupil did not consent to have the video uploaded, which puts companies in the position of having to determine how far to go to protect an individuals' privacy on the Internet and other media, he said.

“They will be working in an area where they have to say, "Where are we safe in putting anything up?' It certainly creates an area of significant uncertainty,” Mr. Lockett said.

Risk managers at media companies, familiar with the privacy issue concern, are not entirely surprised, Mr. Rubini said. “We were already concerned about this risk.”

“You have to monitor it, demonstrate that you have a controlling system in place,” he said of Internet content. “You have to be able to control the content, which is not easy.”

Mr. Lockett said the ruling has implications beyond Italy.

“If this judgment stands, we may well find other European countries saying, "If the Italians can have tighter controls over this, we can, too,'” he said.

If other courts in Europe follow Italy's lead, media and technology companies should be concerned, said Ian Birdsey, technology and media claims manager at Hiscox Ltd. in London. “It is hard to see what Google could realistically have done differently in the circumstances, and a number of media and technology companies would grind to a halt if they were to be required to monitor all user-generated content,” he said in an e-mail.

Mr. Birdsey said it would be “extremely surprising” if English courts took an approach similar to Italy's, because responsibility for user-generated Internet content in England generally rests first with users and then with companies that have procedures to remove inappropriate content after receiving complaints.

Whether Google or another media company hit by such a ruling has insurance in place that would respond depends on how the coverage is written and whether monetary damages are assessed, said Luca Franzi, a board member with Milan broker RVA Rasini Viganò S.p.A.

“If it was demonstrated that you created (monetary) damage owed to someone, I think professional liability insurance should apply,” Mr. Franzi said. If the damage is “moral,” resulting from humiliating someone, there is no loss for a policy to indemnify, he said.

A media company could, however, have insurance to cover costs of defending itself against charges like those faced by Google, Mr. Franzi said.

Mr. Rubini said the Google ruling is so unique that, if upheld, it could create an opportunity for insurers.

“This means that they might have a new market,” Mr. Rubini said. “Now that this risk is real, we might find a new market for professional liability.”