What is the Digital Services Act?

Whether it’s a fine for X or a penalty for Meta, you’re bound to have noticed the occasional legal news story if you regularly read our magazine. So, how come the European Union often dishes out such tough punishments to big tech companies? Well, it’s mainly down to two regulations: the Digital Markets Act and the Digital Services Act. With these two instruments, the EU’s trying to provide its citizens with the best possible protection and keep large companies in particular on a tight leash.

The Digital Services Act officially came into force in November 2022. After that, the EU gave businesses affected about a year and a half to redesign their platforms and online services to make them compliant with the new regulations. In the meantime, EU member states had to set up public bodies to monitor these activities. On 17 February 2024, the Digital Services Act (DSA) came into force in every country in the EU. However, the regulations have also had an impact on Switzerland.

In a nutshell: what exactly is the purpose of the DSA?

While the DMA’s mainly concerned with economic issues, the DSA focuses on the content and services of major tech portals. This includes social media platforms such as Facebook and X, but also shopping sites such as Zalando, online marketplaces and app stores. Together, the DMA and DSA form a constitution for fundamental digital rights that applies across borders throughout the European Union.

At the moment, the platforms covered by the DSA are full of unlawful content. People trade illegal goods such as weapons or prescription drugs, or distribute pornography featuring minors. At the same time, otherwise legitimate-seeming companies use questionable methods to entice customers into making a purchase. Think ads emblazoned with «only 3 left!» or «shopping cart» buttons that actually tie users into buying a product. Known as «dark patterns», strategies like these are now banned under the DSA. Now, let’s not forget that many online platforms are bursting with fake news, especially social media channels. There’s dubious information, faked images from wars and falsehoods about politicians and celebrities.

Basically, the goal of the new law is to make online platforms a safe and trustworthy space for users again. Illegal content, unfair advertising tactics and fake news have been banned. At the same time, companies have to provide concrete evidence that they’re taking consistent action against this stuff on their websites.

For this to work, the EU has imposed a number of obligations on the portals in question. Otherwise, the companies responsible will face fines or even have their platforms blocked in the EU.

Where can I read the exact rules of the Digital Services Act?

If you’re interested in the legal nitty-gritty, the EU’s published the regulation in its entirety online. Incidentally, the full name of the Digital Services Act is «Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC». Like the DMA, it’s based on the Treaty on the Functioning of the European Union, in particular Article 114, which you can find on page 48 of the linked PDF.

Who has to comply with the DSA?

Essentially, the DSA applies to all providers of digital services, provided they’re active in the EU. «Active» means they’ve registered their head office or a branch in the EU, and offer their products or services there. The law applies regardless of company size.

Similar to the DMA, which mentions «gatekeepers», the DSA refers to VLOPs and VLOSEs. These are «very large online platforms» and «very large online search engines». There have been particularly strict, special regulations in place governing them since 25 August 2023. Skip to the section titled «What exactly do these companies have to do?» to find out more on this.

The EU Commission’s responsible for determining which services or companies fall into these categories, and has drawn up a list of companies that do. However, this list can be expanded if a service provider ends up meeting the criteria of a VLOP or VLOSE. If a platform is added to the list, it has four months to implement the new rules.

Which companies are already VLOPs and VLOSEs? How does a business become one?

A platform or search engine is considered a VLOP or VLOSE if it has more than 45 million active users per month or reaches more than 10 per cent of the EU population. At the moment, that’d equate to 44.92 million people. There are currently 17 VLOPs (some with several platforms) and two VLOSEs. These are:

• Alibaba/AliExpress (104.3 million)
• Amazon Store (181.3 million)
• Apple App Store (123 million)
• Aylo Freesites Ltd. (Pornhub) (over 45 million according to EU estimates)
• Booking.com (over 45 million according to EU estimates)
• Facebook (259 million)
• Google Play (284.6 million)
• Google Maps (275.6 million)
• Google Shopping (70.8 million)
• Infinite Styles Services Co. Ltd. (Shein) (108 million)
• Instagram (259 million)
• LinkedIn (45.2 million members, 132.5 million visitors)
• NKL Associates s.r.o (XNXX) (45 million)
• Pinterest (124 million)
• Snapchat (102 million)
• Technius (Stripchat) (over 45 million according to EU estimates)
• TikTok (135.9 million)
• Whaleco Technology Limited (Temu) (75 million)
• WebGroup Czech Republic (XVideos) (160 million)
• Wikipedia (151.1 million)
• X (formerly Twitter) (115.1 million)
• YouTube (416.6 million)
• Zalando (74.5 million)

The search engines are:

• Bing (119 million)
• Google Search (364 million)

All online platforms also have to publish their active user numbers every six months. This information is then communicated to the Digital Services Coordinator (DSC) in the appropriate country. Every member state has a DSC. The EU Commission can also request user numbers. This way, it can decide whether to designate new VLOPs or VLOSEs, or rule whether an existing one has become too small. Businesses also need to give the Commission an explanation of how their figures are calculated, and give them access to the relevant data. You can find out exactly how companies have to do this here.

What exactly do these companies have to do?

The number of obligations a company has to fulfil depends on whether or not it’s a VLOP or VLOSE. Smaller companies are excluded from some aspects of the law.

Listing and explaining every single legal obligation would make this article hundreds of pages long, so I’m limiting myself to the core responsibilities that’ll be relevant to your day-to-day life. If you want to do a thorough deep dive, you can read every detail here (in German).

Article 33, paragraph 6 of the DSA (website in German) obliges VLOPs and VLOSEs to carry out an annual risk assessment and forward it to the EU Commission. As part of their assessment, companies need to investigate whether there are problematic posts on its platform and how bad they are. They also have to check whether fundamental rights are being violated or whether public debate is being influenced in favour of one side. The latter refers to fake news; for example, are there fake AI videos of politicians telling lies or doing something stupid?

They also need to examine whether posts are having a negative impact in terms of gender-based violence, the protection of public health or minors. In addition, every platform has to explain what it’s doing to tackle these issues and how (e.g. moderation system, design of its recommendation systems, general terms and conditions, advertising, data protection).

What does this mean for you?

If you live in the EU, the new regulations also affect you as a user. Mostly in a positive way.

With commercial users of online marketplaces subjected to more rigorous checks, you’ll get better service. Platforms (e.g. Instagram) determine who offers the products or services advertised on their site. As a result, their names have to be displayed. This helps take rogue traders out of circulation. Consequently, you run less risk of buying something illegal, counterfeit or dangerous. If it later turns out that you have, the service provider has to inform you.

Users also have new rights. Service providers need to ensure you can report illegal content or products easily, in your own language. You can also lodge an objection if your products or content are removed from a platform.

So if, for example, you publish a post and someone else reports it as «fake» or «dangerous», causing it to be deleted by the moderator, you can raise an objection. Another moderator will review the deletion to check whether the initial decision was too strict.

Either way, the platform has to inform you of every decision – including the reasons for it. All this needs to be uploaded to the DSA transparency database. Subsequently, there has to be a clearly defined contact person for both you and the authorities.

There’s also going to be more transparency around online advertising. From now on, you’ll receive information about the ads you see on internet platforms. For instance, an explanation of why you’re seeing a particular advert. Platforms are forbidden from collecting data on minors’ internet usage habits for advertising purposes. Not only that, but they’re prohibited from using personal data such as political views, ethnicity, country of origin or sexual orientation for the same reason.

The rights we’ve just covered also apply to non-advertising content. If you don’t want content recommendations to be based on your internet usage patterns, you have the right to notify the platform accordingly. In response, they’re obliged to respect your wishes. Independent auditors and research bodies regularly monitor whether platforms are actually doing this.

If a service provider breaches the law and you suffer any damage or loss as a consequence, you’re entitled to compensation.

A platform’s T&Cs need to be available in every official language of the European Union.

How will the DSA affect Switzerland?

If a Swiss provider has an EU base (or branch), the rules also apply to them – and they have to follow them accordingly. If you live in Switzerland, different rules apply to claims for damages. However, you’ll also benefit from provisions such as moderation, more precise checks on online shops, the opt-out option for advertising and the reporting system in everyday life.