The Digital Service Act is expected to come into force this year. The intention of the legislators is that “everything that is illegal offline should also be illegal online”. For online platform operators, the Digital Services Act brings comprehensive new regulations for greater transparency and more consumer protection. Read here who the Digital Service Act applies to and what to consider when implementing it.

What is it about?

The European Union is in the final stages of adopting a comprehensive regulatory package consisting of two regulations: the Digital Services Act and the Digital Markets Act. This post will focus on the Digital Services Act, and a subsequent post will cover the Digital Markets Act. As EU regulations, the new rules will become immediately enforceable for all companies in Europe, without the need to implement the laws in the member states. The aim is to create a uniform legal framework for the entire EU, with the Digital Markets Act leading to fair competition between platform providers and the Digital Services Act leading to better protection of fundamental rights and effective law enforcement on the Internet.

Which companies are affected by the Digital Service Act?

The Digital Services Act applies to digital services that provide consumers resident or established in the EU with access to content, goods, and services, whether the providers are based in the EU or outside. The Digital Services Act refers to these services as “intermediary services”. Included in this broad definition are all online platforms aimed at consumers, such as sales platforms, social networks, search engines, cloud and messaging services.

For online platforms, the Digital Services Act contains regulations that are graduated according to their size: The first part of the regulations affects all online platforms regardless of their size and number of users. The second part of the regulations only applies to platforms with more than
45 million users per month – these are defined as “very large online platforms”. Such high monthly user numbers are regularly achieved only by the global players of online platforms, such as Meta (Facebook), Google and Amazon.

What new regulations result from the Digital Services Act for companies?

Some of the regulations from the Digital Services Act are already found in existing laws in Germany, while other significantly stricter regulations are also new for German companies.

Central to the Digital Services Act is that all online platforms are made responsible for fighting illegal content, goods and services and deleting corresponding entries. There is explicitly no obligation to pre-screen content. Content must be deleted after platform providers are requested to do so by judicial and administrative authorities via electronic contact points set up by the platform providers. Calls for violence and illegal hate speech should thus be removed more quickly than before. The sale of dangerous or counterfeit products is also to be uniformly prevented throughout Europe.

The law also increases transparency obligations towards users. For example, misleading user interfaces are to be prohibited, as is the use of manipulative “dark patterns” to persuade consumers to make certain purchasing decisions. Dark patterns describe user interface designs that are intended to induce users to take actions that run counter to their interests.

Sensitive data, e.g. origin, health and sexual orientation, may no longer be used for individually tailored advertising. The protection of children and young people is to be strengthened by ensuring that platforms are not allowed to use their data for personalized advertising and tracking. The terms of use of platforms that use recommendation algorithms must explain which factors guide the recommendations. In addition, users must be provided with an internal complaint management system on the part of the providers. Platform providers that do not have a branch in the EU must appoint a legal representative in a member state – comparable to the EU domestic representative pursuant to Art. 27 GDPR.

For “very large online platforms” with more than 45 million monthly users, the Digital Services Act places them under the supervision of the European Commission as the primary regulator, which is intended to ensure consistent implementation and control of the regulations. Providers of “very large online platforms” will have to pay an annual supervision fee to the Commission. They will also be required to conduct annual risk assessments and make their recommendation algorithms (including for research purposes) more transparent.

Violations of the Digital Services Act can result in severe fines for companies of up to six percent of annual global revenue, but other measures such as temporary suspension of services may also be taken.

When will the reforms take effect?

On 23 March 2022, the Council of the European Union and the European Parliament agreed on a binding draft of the Digital Services Act. On 5 July 2022, the Act was confirmed by the European Parliament. Now only the Council of the European Union has to approve it, but this is considered a formality.

It is expected that the regulation will come into force in the third or fourth quarter of 2022. However, companies will not have to comply with the new regulations from that date, but will be allowed to invoke transition periods. This means for “very large online platforms” that they must comply with the Digital Services Act regulations four months after they have been classified as “very large online platforms” by the Commission. All other platform providers must comply with the Digital Service Act regulations 15 months after the Digital Service Act takes effect, but not before 1 January 2024.

What is the advice for companies?

As soon as the final wording of the regulation has entered into force, platform providers should take advantage of the transitional periods and examine whether and to what extent they are addressed by the law and what measures are required. Even if smaller and medium-sized online platforms will be affected by fewer new regulations, they must evaluate whether their currently established compliance mechanisms are sufficient and, if necessary, take additional measures at an early stage.