The EU has agreed on another ambitious piece of legislation to control the online world.
Early Saturday morning, after hours of negotiations, the bloc reached the terms and conditions of the Digital Services Act, or DSA, which will force tech companies to take more responsibility for content that appears on their platforms. New obligations include speeding up the removal of illegal content and goods, explaining to users and researchers how their algorithms work, and taking stricter measures against the spread of misinformation. Companies risk fines of up to six percent of their annual turnover for non-compliance.
“The DSA will upgrade the ground rules for all online services in the EU,” European Commission President Ursula von der Leyen said in a statement. “It gives practical effect to the principle that what is illegal offline must also be illegal online. The larger the size, the greater the responsibilities of online platforms.”
Margrethe Vestager, the European Commissioner for Competition who oversaw much of the bloc’s technical regulation, said the law “ensures that platforms are held accountable for the risks their services may pose to society and citizens.”
The DSA should not be confused with the DMA or Digital Markets Act, which was passed in March. Both acts affect the tech world, but the DMA focuses on creating a level playing field between companies, while the DSA deals with how companies control the content on their platforms. The DSA is therefore likely to have a more direct impact on Internet users.
Although the legislation only applies to EU citizens, the impact of these laws will certainly be felt in other parts of the world. Global tech companies may decide that it is more cost-effective to implement a single content auditing strategy and use relatively strict EU regulations as a benchmark. While US lawmakers who want to curb Big Tech with their own regulations, are already drawing inspiration from the EU rules.
The final text of the DSA has yet to be released, but the European parliament and European Commission have detailed a number of obligations that it will contain:
- Targeted advertisements based on a person’s religion, sexual orientation, or ethnicity are prohibited. Also minors cannot be subjected to targeted advertising.
- “Dark Patterns” – confusing or deceptive user interfaces designed to trick users into making certain choices – will be banned. The EU says that, as a rule, canceling subscriptions should be as easy as signing up.
- Major online platforms such as Facebook will need to make the workings of their recommendation algorithms (used for example sorting content on the news feed or suggesting TV shows on Netflix) transparent to users. Users should also be offered a recommendation system “not based on profiling”. For example, in the case of Instagram, this would mean a chronological feed (as recently introduced).
- Hosting services and online platforms will need to clearly explain why they have removed illegal content, and provide users with an opportunity to appeal such removals. However, the DSA itself does not define what content is illegal and leaves it up to individual countries.
- The largest online platforms will have to provide key data to researchers to “give greater insight into how online risk is evolving”.
- Online marketplaces need to keep basic information about merchants on their platform to track down individuals selling illegal goods or services.
- Major platforms will also need to introduce new strategies to deal with disinformation during crises (a provision inspired by the recent invasion of Ukraine).
The DSA, like the DMA, will differentiate between technology companies of different sizes, imposing greater obligations on larger companies. The largest company – those with at least 45 million users in the EU, such as Meta and Google – will be the most critical. These technology companies have lobbied hard to tone down the requirements in the DSA, especially those related to targeted advertising and the handing over of data to outside investigators.
While the terms and conditions of the DSA have now been agreed upon by EU member states, the legal language has yet to be finalized and the law formally transposed into law. However, this last step is currently seen as a formality. The rules will apply to all businesses 15 months after the bill is passed into law, or from January 1, 2024, whichever is later.