We all spend countless hours on the internet, watching movies or videos, reading articles, chatting, shopping, debating, commenting, liking and sharing personal content. The online space offers the possibility for all of us to get access to information, to express our views and be heard by others. We have multiple opportunities to learn, thrive and connect with our loved ones.
On the other hand, we are the targets of online platforms and other providers of online services who collect an amazing array of our personal data, some of it highly sensitive like our political affiliation and sexual orientation. Activities that would be considered illegal and lead to a prosecution offline often go unnoticed online. We face disturbing content, such as hate speech or videos showing acts of violence.
The online world has been regulated for decades; however, new services and challenges emerge, therefore from time to time we need a new set of rules to regulate the online ecosystem. It is important to conduct business safely, but also to protect our democracies. Disinformation campaigns can distort our view of the world. Manipulated photos and state propaganda are used as weapons in wars. Deepfakes can trick our minds and conspiracy theories that go viral on the web fuel extremism.
It is evident that we need rules. In 2016, lawmakers in the European Union (EU) passed the General Data Protection Rules (GDPR), which, as the name suggests, aims to protect our personal data. Civil society has advocated for a strong GDPR throughout the legislative process, about which Liberties has written extensively.
EU lawmakers are about to pass another landmark legislation: the Digital Services Act (DSA). Similar to the GDPR, it aims to create a safer digital space.
Here is what you need to know.
What is the Digital Services Act?
The Digital Services Act is a new law that sets the rules for the online world in the EU. It is a long-due overhaul of the e-Commerce Directive (ECD), the current EU legislation that dictates the online rules, which was adopted in – wait for it – 2000. Back then, the popular instant messaging services were called Yahoo and MSN, and social networking services like Facebook, LinkedIn or Twitter were mere ideas. It must be noted that the DSA does not replace the ECD but rather updates it.
In January 2020, the European Commission announced its intention to establish new rules for digital platforms in the EU. Following a public consultation and a number of studies, it presented its draft law on December 15, 2020. Since then, the draft law has undergone a long legislative process. Key dates were January 20, 2022 when the European Parliament adopted its position and April 23, 2022, when, after intense negotiations, a political agreement was finally reached between the Parliament, the European Council with the support of the Commission – also called the trilogue negotiations.
Throughout the legislative process, lobbyists from around the world courted lawmakers to shape the law in a way that fits their interests. Tech giants in particular, such as Apple, Amazon, Google or Meta, spent millions to weaken the law and protect their business models.
Who will the DSA affect?
The DSA will affect all companies that provide online services in the EU or to EU citizens. This includes social media platforms, search engines, online businesses and media publishers. They may have to make changes to how they operate their websites, for example. And given that we all use online services, we are all indirectly affected by the new law.
However, the rules are different for the different players. We as end users will not have to change our behaviors. Those who will feel greatest impact is big tech, the Very Large Online Platforms, also called VLOPs, and the Very Large Online Search Engines, also called VLOSE, who have more than 45 million users in the EU. The idea is: the bigger the platform the stricter the rules.
What are the DSA’s main goals?
The Commission promised in December 2020 that the Digital Services Act would protect citizens and their fundamental rights online. The DSA wants to modernize and harmonize digital services rules in the EU. Currently, the ECD is applied slightly different in each member state and designed for an online sphere before Y2K.
The DSA also aims to prevent big tech from becoming too powerful and to ensure that rules are not dictated by VLOPs’ and VLOSEs’ terms and conditions. Some refer to the DSA as the constitution for digital internet services, or the sheriff that comes to tame the wild west that is the internet.
What obligations will the DSA contain?
In general terms, there are a series of obligations that companies who provide online services must fulfil. They must follow new rules on providing notice about illegal content, cookie banners and online advertising, as well as improving transparency, including algorithms and their effect on society. The DSA also intends to create a new European body, the European Digital Services Board, in charge of enforcement.
Let’s go into more detail.
Fighting illegal content
One of the most controversial points in the Digital Services Act is how to fight illegal content, such as defamation, hate speech, and calls for violence and death threats. The DSA wants social media platforms and web operators to block illegal content without delay. National authorities can order providers of digital services to act against a specific piece of illegal content. Serious violations must be reported to the police. Online platforms will have to be transparent about the steps they are taking to combat illegal content.
However, there is a danger if the rules are too strict. If platforms are given very short deadlines to delete illegal content or otherwise face big fines, they may very well delete more content than necessary. The vast amount of content that is uploaded every day on the web makes it impossible to manually check each upload for illegal content. Therefore, the job would be done automatically by computer programs, also called upload filters. This could lead to legal content being deleted, which violates our freedom of speech and freedom of information. Therefore, proper balanced is needed without compromising the fundamental rights of the internet users.
Ban on dark patterns
Tired of cookie banners asking your consent every time you visit a website? You are not the only one. Unfortunately, the DSA will not make them disappear. But at least, it will prohibit the so-called dark patterns that trick us into sharing our personal data (Article 13a). Online platforms and other online service providers will no longer be allowed to highlight the “consent to accepting all cookies” button or to make it more time-consuming to click on the “refuse cookies” button.
Algorithmic accountability
Can you explain what an algorithm is and how it works? Do you know how Facebook’s or Twitter’s algorithms decide which posts you see? Most probably you don't. Article 31 of the DSA wants to shed more light on this opaque world. In the future, VLOPs and VLOSEs will have to provide more transparency on how and why algorithms recommend a particular post, including why posts that spread fear and hatred are more likely to go viral. They will also have to analyze the potential negative impacts of their services on our society. These assessments will have to be shared with authorities, academia, and civil society organizations at least once a year (Article 26). VLOPs and VLOSEs must also give their users more control over how their data is being used, including the option to not be targeted at all.
Targeted online advertising
We’ve all heard at least once in our life that social media platforms know us better than we know ourselves, and we all have some idea why we receive ads about a product that we were considering buying earlier in the week. This can feel scary and invasive. In the future, online advertisers will have to reveal to each user why they are seeing a particular ad, who is behind it and what data was used to target you. Further, the DSA is prohibiting all targeting based on sensitive data, such as health data and any information that suggests sexual orientation, ethnic origin, political opinions, or religious beliefs. It also bans advertisers from targeting children.
Enforcement and sanctions
The Digital Services Act is an ambitious law. However, to be effective it must also ensure that the rules are being respected. Each country in the EU will nominate a Digital Services Coordinator responsible for the enforcement of the law. In addition, the DSA intends to create a new European body, the European Digital Services Board that will work together with those Digital Services Coordinators. For VLOPs and VLOSEs, the European Commission will be directly in charge of supervision and enforcement. The Commission will be able to carry out investigations, including through requests for information and on-site inspections. In case VLOPs and VLOSEs don’t follow the rules, they face fines of up to 6% of their annual worldwide turnover, or even a ban in case of repeated breaches.
When will the DSA apply?
Companies will have time to prepare for the new law, which will be applicable from January 1 2024.
Further recommended reading:
How Targeted Political Advertisement Must Be Regulated In The EU: Policy Brief
EU Actions Must Match Words As DSA Negotiations Enter Endgame