The European Council of the EU gave formal approval to the Digital Services Act (DSA) on 4 October 2022, which is the most significant update to the legal framework on digital services since the adoption of the E-Commerce Directive in 2000.

The focus of the DSA is to improve user safety online by regulating online content, advertising and product sales. The DSA will come into effect in early 2024, giving those impacted by the new regulation 15 months to prepare and even less time for very large online platforms.

A fragmented space for business

The rapid digitalisation of society and the economy has provided many positives but has also raised numerous concerns which national regulators and legislators have tried to manage through a range of targeted, sector-specific interventions. This has led to a fragmentation in approach across the EU member states.

New direction

The introduction of the DSA as a directly applicable regulation aims to resolve this issue by creating legal certainty for businesses and in addition, prevents big tech companies forum shopping between member states to avoid regulation.

The new law, along with the Digital Markets Act (DMA), is part of an EU legislative package which aims to create a safer digital space, protect the fundamental rights of users and establish a level playing field for businesses.

Are you an online intermediary?

The DSA defines clear responsibilities and accountability for online intermediaries, whether they are established inside or outside the EU, who offer services to those within the EU. There are four categories of intermediaries:

• Providers of Intermediary Services - those that provide a 'mere conduit' or caching service
• Providers of Hosting Services - such as cloud and web page hosting services and social media services
• Providers of Online Platforms – anyone storing and disseminating public information, aimed at social media platforms and marketplaces
• Providers of Very Large Online Platforms (VLOPs) who have a significant societal and economic impact, reaching at least 45 million users in the EU (representing 10% of the population) and Very Large Online Search Engines (VLOSEs) which have with more than 10% of the 450 million consumers in the EU

The DSA is designed asymmetrically which means that larger intermediary services with significant societal impact (VLOPs and VLOSEs) are subject to stricter rules, notably US “big tech”.

The EU has put a marker down of how important it views regulating digital services by providing the Commission with the same supervisory power it currently has under current anti-trust rules, including in the most serious cases, the ability to impose fines of up to 6% of the global turnover of a service provider.

Online intermediaries - key obligations

Under the DSA, service providers will not only have to be more transparent, but will also be held accountable for their role in disseminating illegal and harmful content. Amongst other things, the DSA:

• lays down special obligations for online marketplaces in order to combat the online sale of illegal products and services;
• introduces measures to counter illegal content online and obligations for platforms to react quickly, while respecting fundamental rights;
• better protects children online by prohibiting platforms from using targeted advertising based on the use of children’s personal data as defined in EU law;
• imposes limits on the presentation of advertising and on the use of sensitive personal data for targeted advertising, including gender, race and religion;
• bans ‘dark patterns’ which nudge users towards choices based on pop-ups or positioning text.

Stricter rules apply for VLOPs and VLOSEs, which will have to:

• offer users a system for recommending content that is not based on profiling;
• analyse the systemic risks they create – risks related to the dissemination of illegal content, negative effects on fundamental rights, on electoral processes and on gender-based violence or mental health.

Crisis response

One new addition announced alongside the Council’s approval is a crisis response mechanism. In the context of Covid 19 and the Russia/Ukraine conflict, particularly the impact of manipulation of online information, the mechanism will make it possible to analyse the impact of the activities of VLOPs and VLOSEs and rapidly decide on proportionate and effective measures to ensure the respect of fundamental rights. As a result, online intermediaries may be asked to limit “urgent threats”.

Further detail of the DSA is in the full text adopted by the European Parliament in July 2022.

Navigating the new framework

The introduction of the DSA along with the DMA will create a major shift in how the EU regulates digital markets and will impose additional obligations on many businesses, both large and small, which operate in the online space. With the DSA coming into force from early 2024 it is vital that businesses take lessons from the implementation of GDPR and use this head start effectively by getting prepared early.

Understanding whether you are an online intermediary will be the first step in ensuring compliance.

Threat or opportunity?

It is worth noting that whilst the UK’s online safety regime (the Online Safety Bill) has been delayed, it is still important for online intermediaries in the UK who provide services to users in the EU to be ready to be compliant with the DSA when it comes into force.

Although, compliance with such an expansive new regulation may seem like a daunting task, it is important to remember that the DSA is not designed to rip up the current rule book but to build on previous legislation such as the eCommerce Directive. In addition, new regulation should not be seen as a brake pedal on digital innovation but as an opportunity to develop technology in a more responsible and safe way. The EU Minister for Industry and Trade is confident that the DSA “has the potential to become the ‘gold standard’ for other regulators in the world”. If the potential underlying this confidence is realised, it is likely that those businesses who prepare well for the new EU digital framework will stand in good stead for future global digital regulatory developments.