With online hate speech – including racism and xenophobia – on the rise, societies are struggling with an effective response that also respects the fundamental right of the freedom of expression. A broad range of measures may be taken to address hate speech online (see the Council of Europe Recommendation on Hate Speech adopted in 2022). In this spectrum of measures, criminal law is an important last resort. In 2003, the First Protocol to the Convention on Cybercrime was opened for signature, addressing the “criminalisation of acts of a racist and xenophobic nature committed through computer systems” (ETS No. 189). In connection with the twentieth anniversary of this Protocol, a good practice study was undertaken on the experience of this treaty. The workshop aims to present findings of this study, to provide further guidance and to discuss challenges in addressing xenophobia and racism committed online while respecting the right to freedom of expression.