The EU Digital Services Act and Digital Markets Act—The Impact on Tech Companies

October 2023 marked the release of two important regulations in the EU—the Digital Markets Act and Digital Services Act. 

Both regulations aim to create a single set of rules that apply across the EU with two main goals:

1) to form a safer digital space in which the rights of all internet users are protected and

2) to establish a level playing field to enhance innovation, development, and competitiveness among businesses, both in the EU and all over the world.

The regulations mark a step forward in protecting consumers from internet abuse, which has surged in recent years with the development of AI and deepfake technology. They also address competition among digital platforms, impose more obligations on online platforms for published content, and allow users to more easily switch their device’s default app stores and browsers to alternatives of their choice.

Let’s see what the new regulations will bring to online businesses and internet users alike. 

What is the Digital Services Act?

“The Digital Services Act (DSA) regulates the obligations of digital services that act as intermediaries in their role of connecting consumers with goods, services, and content. This includes online marketplaces amongst others.” (source)

More specifically, the Digital Services Act (DSA) is supposed to: 

• Give better protection to online users’ rights. This includes provisions for users to contest decisions made by platforms regarding their content, data portability, and mechanisms for notice and takedown of illegal content.
• Harmonize rules for digital services. The DSA seeks to establish harmonized rules on issues like content moderation, advertising transparency, algorithmic transparency, online marketplaces, and online advertising. 
• Increase transparency and the accountability framework for online platforms. The DSA proposes stricter obligations for online platforms spanning social media, e-commerce, and online intermediaries, requiring them to take  responsibility for the content and services they host. This includes measures to address illegal content, harmful activity, and disinformation online.
• Increase cooperation and enforcement. The DSA encourages cooperation between EU member states to tackle illegal content, disinformation, and other online risks. It also introduces stronger enforcement measures, including fines and penalties for non-compliance.
• Enhance market supervision. The DSA proposes the establishment of a new European Digital Services Coordinator and imposes new supervision measures on platforms with significant market power. 

Here are some specific measures of the DSA:

• Users will be able to flag illegal content online, and platforms will be able to cooperate with specialized ‘trusted flaggers’ to identify and delete illegal content
• New rules to trace sellers on online marketplaces to help build trust and find scammers easier
• More transparency on terms and conditions
• More transparency on the algorithms used for recommending content, products, and services to users
• New obligations for the protection of minors on any platform across the EU
• Obligations for very large online platforms (VLOPs) and search engines to take risk-based actions (including audits) to prevent abuse of their software (such as election manipulation, disinformation, cyberbullying, harassment of women, etc.)
• A ban on targeted advertising by profiling children or certain personal data, i.e. ethnicity, political views, or sexual orientation
• A ban on ‘dark patterns’ in the UI of online platforms—visual tricks in the interface that manipulate users into choices they don’t intend to make
• Allowing access to data for researchers to analyze how platforms work and how online risks evolve
• New rights for internet users, including the right to complain to platforms, seek compensation for breaches of rules, etc.
• A unique oversight structure, where the European Commission will be the primary regulator for VLOPs and very large online search engines, or VLOSEs, which reach 45 million users. Smaller platforms and search engines will be supervised by the member states where they are established. A special cooperation mechanism will be set between local regulators and the European Commission.

The full text of the Digital Services Act is available here.

DSA: who’s affected?

All online intermediaries offering their services in the single market, whether they are established in the EU or outside, will have to comply with the new regulations. 

Here are the key categories of intermediaries which have to comply with the DSA: 

• Very large online platforms (VLOPs). The DSA introduces a category known as “very large online platforms” (VLOPs) with more than 45 million users (10% of the population in Europe). These are online platforms that have a significant presence in the European Union and meet certain criteria based on their number of users, market value, and other factors. VLOPs are subject to more stringent obligations and regulatory oversight. At the moment 17 VLOPs are designated:
  • Alibaba AliExpress
  • Amazon Store
  • Apple AppStore
  • Booking.com
  • Facebook
  • Google Play
  • Google Maps
  • Google Shopping
  • Instagram
  • LinkedIn
  • Pinterest
  • Snapchat
  • TikTok
  • Twitter
  • Wikipedia
  • YouTube
  • Zalando
• Search engines, including very large online search engines (VLOSEs) with 45+ million users. At the moment 2 VLOSEs are designated:
  • Bing
  • Google Search

Search engines are subject to certain obligations under the DSA, particularly concerning transparency in search results and advertising practices. 

• Online content sharing service providers, which include platforms that allow users to upload and share content, such as social media networks, video-sharing platforms, and user-generated content platforms. These providers are required to implement measures to prevent the dissemination of illegal content.
• Online advertisers. The DSA includes provisions for greater transparency in online advertising and addresses issues such as targeted advertising, dark patterns, and unfair practices. 
• Online marketplaces, where goods or services are bought and sold, are also covered by the DSA. These platforms must ensure transparency and provide certain information to users, particularly in cases where businesses use the platform to sell products or services.
• Regulatory authorities and governments within the European Union will have a role in enforcing the new regulations and collaborating with online platforms to address illegal content, disinformation, and other online risks.
• Users and consumers of online platforms will benefit from enhanced user rights and protections. The DSA aims to provide users with more control over their digital experience, including the ability to contest decisions made by platforms regarding their content and ensure transparency in terms of how their personal data is collected and used.

Companies will have obligations proportionate to their size and nature while ensuring they remain accountable. Smaller platforms and service providers may have lighter compliance obligations compared to very large online platforms.

What is the Digital Markets Act?

The EU Digital Markets Act (DMA) is intended to address concerns about the market power and behavior of large digital platforms, creating a fair and competitive digital environment. 

The key objectives and provisions of the EU Digital Markets Act include:

• Definition of gatekeepers. “Gatekeepers are large digital platforms providing so-called core platform services, such as online search engines, app stores, messenger services. Gatekeepers will have to comply with the do’s (i.e. obligations) and don’ts (i.e. prohibitions) listed in the DMA.” (source)
• Practices prohibited for gatekeepers, including self-preferencing (favoring their own products or services over competitors), leveraging data collected on their platforms to gain a competitive advantage, and blocking/hindering third-party access to their platforms.
• Data access. Gatekeepers are required to provide access to certain data and functionalities to third-party businesses to promote competition and innovation. They must also ensure interoperability with other platforms when necessary.
• Non-discrimination of businesses and fair ranking. Gatekeepers must treat businesses fairly and not discriminate against them in their dealings. 
• Clear terms and conditions. Gatekeepers must provide clear terms and conditions, including information about ranking and search algorithms.
• Sanctions. The DMA includes provisions for remedies and sanctions (i.e. fines) to ensure compliance.
• Market investigation powers. The DMA grants the European Commission additional powers to conduct investigations on digital markets and intervene to address structural competition problems and risks to the internal market.
• Enhanced oversight and remedies. The DMA establishes a system of ex-ante regulation, meaning that gatekeepers will have specific obligations even before potential breaches occur. This includes obligations for gatekeepers to notify the European Commission of mergers and acquisitions. The legislation also introduces stronger enforcement tools and penalties for non-compliance.

The full text of the Digital Markets Act is available here.

DMA: who’s affected?

The DMA is designed to regulate large online platforms that have been identified as “gatekeepers” in the digital ecosystem. The DMA specifically targets platforms that meet certain criteria and have significant market power. To determine which entities need to comply with the DMA, the act establishes specific thresholds and criteria for gatekeeper designation, including:

• Size and market position. Gatekeepers are typically very large online platforms that hold a significant position in the digital market. The DMA specifies various quantitative criteria, including annual revenues, the number of active users, and other factors to identify these platforms.
• Core services. The DMA applies to gatekeepers that provide certain “core platform services”, including online intermediation services (e.g., online marketplaces), online search engines, social networking services, and more.
• EU presence. Gatekeepers that offer their services within the European Union or to European users are subject to the DMA, regardless of where the company is based.
• Obligations and prohibited practices. The DMA establishes specific obligations and prohibits certain practices for designated gatekeepers to ensure fair competition.

The DMA aims to foster competition and ensure that gatekeepers do not engage in anti-competitive practices that hinder innovation. By imposing obligations on gatekeepers, the act aims to create an environment that allows smaller competitors to thrive and encourages innovation and diversity in the digital market.

The difference between the DSA and DMA

Both Acts intend to foster innovation and competition while ensuring consumer rights protection and a secure online environment. However, there are differences:

1. Target. The DMA primarily addresses big players in the digital market and related competition issues, while the DSA encompasses a wider range of digital intermediary services (including online platforms, ISPs, and hosting services) and imposes stricter requirements on very large online platforms (VLOPs) and very large online search engines (VLOSEs) to address societal risks they may pose.
2. Applicability. The DMA primarily focuses on fostering a fair and competitive digital market. By targeting gatekeepers and introducing proactive regulation, the DMA aims to foster innovation, protect competition, and safeguard the interests of smaller businesses that rely on these platforms. Meanwhile, the DSA addresses the EU’s concerns regarding the growing influence of online platforms in political discussions, disinformation campaigns, fake news dissemination in the lead-up to elections, and the societal impact of hate speech. The DSA also aims to create a safer digital space and protect users’ fundamental rights. It dictates new rules for VLOPs and VLOSEs to ensure that they are responsible for the posted content and that users’ data is respected and secured.
3. Market investigation powers. The DMA grants the European Commission broad powers to conduct market investigations on digital markets and take appropriate measures to address competition problems. The DSA does not include such extensive market investigation powers.
4. Penalties and enforcement. The DMA proposes substantial penalties for non-compliance by gatekeepers, including fines of up to 10% of their global turnover and structural remedies like divestiture. It also grants the European Commission enhanced oversight and enforcement powers. In comparison, the DSA introduces fines for non-compliance, but does not specify penalties as severe as those proposed in the DMA. Member states play a larger role in the enforcement of the DSA.

What’s changed?

At present, digital service providers face a complex regulatory landscape within the European Union, with 27 different regulatory regimes each imposing varying obligations and restrictions. Larger corporations typically possess greater resources and expertise, allowing them to adapt to multiple privacy regulations more promptly and effectively than smaller enterprises. The DSA and the DMA are designed to collaboratively establish a unified framework for internet governance within the EU. While these Acts are complementary in their mission, they address distinct rights, impose different sets of obligations, regulate various categories of companies, and are enforced by separate regulatory agencies.

While the Acts are not yet in full force, there are concerns among users, politicians, and the tech community, such as:

• the fear that the Big Tech will ignore the regulations
• red tape leading to inefficiency
• the need for significant resources to oversee all cases of human rights abuse

At the same time, if all mechanisms function as written in the legislation, the Digital Services Package (DSA and DMA) will mark one of the most important steps forward in recent years in the field of internet regulation. 

“Interoperability requirements and targeted ad restrictions give EU members unrivaled control over how companies use their data. Prohibitions on unfair practices and sparing smaller companies from the harshest requirements open markets and spur innovation. Independent audits, mandatory reporting, and algorithm transparency provide mechanisms to hold providers accountable for the damage they cause. Finally, the legislation represents a symbolic victory for democracy over Big Tech.” (source)

Next steps

The DSA package will become fully applicable to all entities beginning from 17 February 2024. 

Once adopted, EU member states will be required to transpose the provisions of the DSA into their national legislation. This process may involve developing or amending laws to align with the requirements of the DSA. Member states will be responsible for enforcing the provisions of the DSA within their jurisdictions.

FAQ

• What is the new Digital Services Act?

  The new Digital Services Act (DSA) is a European Union law aimed at regulating online platforms and services, introducing responsibilities for content moderation, transparency, and accountability, and users rights protection to create a safer and more balanced digital environment.

• What is the difference between the DMA and the DSA?

  The DMA focuses on regulating large online platforms, aka “gatekeepers”, to ensure fair competition, while the DSA is primarily concerned with addressing content-related issues, responsibilities of online service providers, and user protection.

• What are the benefits of the Digital Markets Act?

  The Digital Markets Act (DMA) intends to promote fair competition, innovation, and consumer choice in the digital market by regulating the behavior of large online platforms and addressing concerns related to their market power.

• What is the current status of the Digital Services Act?

  The DSA package will become fully applicable to all entities beginning from 17 February 2024. 

• What is the Digital Services Act in the UK?

  In the UK, there’s no separate DSA. However, the EU DSA will also be applicable to businesses operating in the single market.

• What is the Digital Services Act in Germany?

  On August 4, 2023, the German Federal Ministry for Digital and Transport presented a draft for a German Digital Services Act (“G-DSA-Draft”). The German DSA is intended to complement the existing EU DSA, defining authorities’ competences and the procedures applicable in Germany. Germany has been active in shaping digital regulations within its jurisdiction. One example is the Network Enforcement Act (NetzDG), which was enacted in 2017. The NetzDG requires social media platforms to promptly remove or block certain illegal content, such as hate speech and fake news, and implement reporting mechanisms for users to flag such content. Germany also recently adopted the Act to Improve Law Enforcement in Social Networks (Netzwerkdurchsetzungsgesetz or NetzDG 2.0), which further strengthens the obligations of social media platforms to combat illegal content, protect user rights, and enhance transparency in content moderation.