Getting Your Online Terms Ready for the EU Digital Services Act

Wendy Hederman and Dermot McGirr, Partners, discuss the Digital Services Act. They outline what it is, who the legislation is aimed at and some key dates that those in the Technology sector should be aware of.

The EU Digital Services Act (DSA) came into force late last year. All intermediary services providers and online search engines should now review and update their terms and conditions before 17 February 2024.

However, entities which have been designated as very large online platforms (VLOPs) or very large online search engines (VLOSEs) will be required to comply with these obligations within four months of their designation. We provide an overview of who this applies to and the steps these providers should be taking to ensure compliance with the DSA.

Who has to update their terms and conditions?

All providers of intermediary services and online platforms established or operating in the EEA will be required to review and potentially update their user terms and conditions to ensure compliance with the DSA. Intermediary service providers are providers of mere conduit services, caching services and hosting services. Some of the more obvious examples of these types of service providers are social networks and online marketplaces. However, many more services may also be subject to the DSA, including:

• Internet service providers
• Web hosting services
• Cloud computing services
• eCommerce services
• App stores
• Online maps services, and
• File storage services

What are the obligations?

Transparency is one of the overarching themes of the DSA and requires certain information to be provided in terms and conditions about a provider’s processes and procedures. For example, all providers of intermediary services are required to include information in their terms and conditions about any restrictions they impose in relation to the use of their service. Where a provider reserves the right to block a user’s access to services, or suspend or terminate a user’s account, or delete user generated content, the policies they apply, and any tools used for content moderation must be explained in the provider’s terms. Where the service is primarily directed at minors or predominantly used by them, this must be explained in a way that minors can understand. In addition, these providers are required to outline the rules of procedure of their internal complaint handling system including the appeals process for decisions taken against recipients of the service such as removal of content, suspension, etc. This may be a pain point for some providers who do not currently have such a complaint system in place.

Online platforms are required to provide information on the main parameters used in any recommender systems that they use. A recommender system is a fully or partially automated system which is used by an online platform to determine the manner in which information is prioritised and presented on its online interface.

Online platforms are required to clearly set out their policy in respect of misuse by users, and give examples of the facts and circumstances they take into account in determining misuse and suspension length. This may also identify some compliance gaps for some online platforms which do not have such a policy in place, or do not have a system of issuing prior warnings for suspension, or a process to give reasons for the suspension.

There are additional obligations for VLOPs and VLOSEs. These are online platforms and online search engines with more than 45 million average monthly active recipients of the service. The European Commission recently designated the first batch of VLOPs and VLOSEs based on the information these platforms and search engines published on their average monthly active recipients. We have previously published an insight on how online platforms and search engines should comply with this requirement. The obligations on VLOPs and VLOSEs include providing recipients of the services with a summary of the terms and conditions and to publish their terms and conditions in all of the official languages of the EU Member States in which they offer their services.

Next steps

When assessing how a business should comply with these requirements, we recommend that a careful review of the services and processes provided should be carried out. In particular, the following issues are important for compliance with the obligations for terms and conditions:

• Is the business an intermediary service provider, an online platform or an online search engine?
• Does the business have an internal complaint handling system in place?
• Does the business have any procedures or policies in place for content moderation? Note that there is no general obligation to proactively moderate content but there are requirements to remove illegal content when it is reported.
• If an online platform, does it have policies on misuse?
• Is the service aimed at, or predominantly used by, minors?
• If an online platform, does it use any recommender systems?

When should the terms be updated by?

Most of the provisions of the DSA come into force on 17 February 2024. However, VLOPs and VLOSEs are required to comply with the DSA within four months of their designation, which means that those VLOPs/VLOSEs already designated will be required to comply with the DSA by 25 August 2023.

Reviewing and updating the terms and conditions may identify other compliance gaps, such as not having an internal complaint handling procedure and or policies in place for handling misuse. Therefore, it is advisable that businesses should use the lead in time to review their terms and conditions as a first step towards broader compliance with the DSA.

For more information and expert guidance on the likely impact of the DSA and its obligations on your business, contact a member of our Technology team.

The content of this article is provided for information purposes only and does not constitute legal or other advice.