Digital Services Act – is the End in Sight?

Update: EU Digital Services Act Now Published

The draft text of the Digital Services Act (DSA) was published by the European Commission in December 2020 and is expected to be finalised shortly. One of the key purposes of the DSA is to increase protections for consumers transacting online. A summary of some of the key obligations and changes proposed to be introduced under the draft DSA is set out in this article.

Current status

The European Council confirmed its general approach in November 2021, and the European Parliament adopted its DSA Report in January 2022. Since then, three-way discussions, known as trilogues, have been taking place between the European Parliament, European Commission and the European Council in order to debate and finalise the text of the DSA.

During the 22 April 2022 trilogue meetings, political agreement was reached on the proposal of the DSA. The final text has not yet been published.

Confirmed additions

Although the final approved text has yet to be issued, it’s been confirmed through official EU press releases that the DSA will:

• Ban targeted advertising based on sensitive data, eg information relating to race, political opinions, religious beliefs, trade union membership, health and sexual orientation
• Ban practices aimed at misleading users and using deceiving or nudging techniques to influence users’ behaviour through ‘dark patterns’
• Provide for a crisis response mechanism to analyse the impact of the activities of very large online platforms and search engines on a specific crisis eg a health threat. This was introduced in light of the Russian aggression in Ukraine and the impact on the manipulation of information online. Any actions will be limited to three months.
• Provide for a right for users to seek compensation for any loss or damages resulting from platforms not complying with their DSA obligations

Online search engines

The scope of the DSA will be extended to capture very large online search engines with more than 45 million active monthly users in the EU. It is not clear which specific obligations they will be subject to beyond:

• “curbing illegal content online”
• Taking “risk-based action to prevent the misuse of their systems and undergo independent audits of their risk management systems”
• Offering a system for recommending content that is not based on a user’s profiling

Targeted advertising and minors

An additional key issue that has been debated in the trilogue meetings is targeted advertising and minors. This stems from the change proposed by the European Parliament in January 2022 that “Targeting or amplification techniques that process, reveal or infer personal data of minors or personal data referred to in Article 9(1) of Regulation (EU) 2016/679 for the purpose of displaying advertisements are prohibited.”

It has been confirmed that the DSA will prohibit platforms from targeting advertising based on the use of minors’ personal data. It remains to be seen what the final text will provide for. However, we understand that the proposals discussed during trilogue meetings included a prohibition on seeking additional personal data to verify age. It is arguable that such a restriction would effectively be a ban on all targeted advertising if the platform must be certain that the user is not a minor, but cannot take additional steps to verify it.

In addition, there is no EU-wide consensus on a definition of “minor”. In Ireland, the minimum age at which someone can enter into a legally binding contract is 18 years of age. However, the digital age of consent is 16 years of age in Ireland.

If platforms cannot seek additional information to verify the age of a user, the EU should provide clear guidance on what other actions platforms would reasonably be expected to take in order to form a view on the age of each user. Getting the balance right regarding targeted advertising towards minors may be challenging in practice for both businesses and regulators.

Next steps

Following political agreement on the DSA during the trilogue meeting on 22 April 2022, once the text has been technically finalised and verified by lawyer-linguists, the DSA must be formally approved by the European Parliament and European Council.

Once adopted, the DSA will be implemented as an EU Regulation, and the new rules will be directly applicable across the EU. The DSA will apply where recipients of services are based in the EU, regardless of the service provider’s place of establishment.

The DSA will:

• Come into force 20 days after its publication in the EU Official Journal
• Apply 15 months after entry into force, or from 1 January 2024, whichever is the later
• Apply for very large online platforms and very large online search engines, four months after their designation

For more information on the likely impact of this development on your business, please contact a member of our Product Regulation & Consumer Law team.

The content of this article is provided for information purposes only and does not constitute legal or other advice.