The Digital Services Act deal turns platform risk into a legal duty

In the early hours of Saturday 23 April 2022, negotiators for the European Parliament and the Council of the European Union reached a provisional political agreement on the Digital Services Act[1]. The Commission had tabled the proposal on 15 December 2020[2]. The Council adopted its general approach on 25 November 2021[3]. Parliament adopted its position on 20 January 2022 by 530 votes to 78, with 80 abstentions[4]. Sixteen months separate the proposal from the deal. For a Regulation of this scope, that is quick. President von der Leyen called the agreement "historic, both in terms of speed and of substance"[5]. The companion text, the Digital Markets Act, had been agreed one month earlier, on 24 March 2022[1].

We write as the first generation that grew up inside these services. A European born in 1995 opened a social media account before the General Data Protection Regulation existed. The Digital Services Act is the first Union law that treats the design of a platform as a source of risk in its own right. That is why we read the agreement closely.

What the agreed text requires

The Regulation applies to every intermediary service offered in the Union. Its obligations are graded by the type of service and by the number of users[1]. The heaviest duties fall on very large online platforms and very large online search engines. The text defines them as services with more than 45 million monthly active users in the Union[1]. Those providers must analyse systemic risks every year. The agreement names the risks: the dissemination of illegal content, adverse effects on fundamental rights, the manipulation of democratic processes, gender-based violence and harm to minors and to users' mental health[1]. The providers must then reduce those risks and submit to an independent audit each year[6]. The Commission will supervise them directly, in cooperation with Member States, and it may fine them up to 6 per cent of worldwide turnover[6]. The country-of-origin principle continues to apply to every other provider[1].

Four provisions concern young users in particular. Targeted advertising that relies on the personal data of minors is prohibited[1]. Advertising that relies on sensitive data such as sexual orientation or religion is banned for all users[6]. Interfaces designed to mislead users into choices they would not otherwise make, known as "dark patterns", are prohibited on online platforms, and cancelling a subscription must be as easy as signing up[6]. Every very large platform must also offer at least one recommender option that does not rely on profiling[1]. The text adds a crisis mechanism, drafted after Russia's invasion of Ukraine. The Commission may activate it on the recommendation of the board of national Digital Services Coordinators, and it may then require very large platforms to act against urgent threats for a period limited to three months[1][6].

The rapporteur, Christel Schaldemose, said that "what is illegal offline is also illegal online"[6]. That sentence has been the slogan of the file since 2020. The agreed text gives it a procedure. Users will have a clearer "notice and action" route to report illegal content, platforms must process notices without arbitrariness and users obtain a right to compensation for damage caused by a platform's infringement[6].

Where the deal stops short

Amnesty International called the agreement a "watershed moment" and, in the same statement, a "missed opportunity" on surveillance advertising, because the Regulation limits advertising built on tracking without ending it[7]. The ban on dark patterns is not a blanket ban. Practices already governed by the Unfair Commercial Practices Directive and the General Data Protection Regulation are carved out, and the Commission may issue guidance on specific practices[5]. The duty towards minors turns on whether a platform is aware with reasonable certainty that a user is a minor[5]. That standard will be tested by the platforms themselves, since they decide what they know.

Enforcement is the open question. The Commission takes on the supervision of the largest companies in the world with a staff that has never done this before. National Digital Services Coordinators must be designated and funded by each Member State[1]. Amnesty warns that without strong enforcement the law becomes a "paper tiger"[7]. We share that concern. A Regulation that fines 6 per cent of turnover only deters if a fine is credible.

Timing matters too. The text must now be finalised at technical level and checked by lawyer-linguists. Parliament and the Council must then approve it formally. It will enter into force twenty days after publication in the Official Journal, and its rules will apply fifteen months later[6]. Very large platforms will be bound earlier, four months after their designation[8]. On that calendar, most duties will not bind before 2024. Our generation will therefore vote in the 2024 European elections under rules that are only starting to apply.

The Regulation also exempts micro and small enterprises from several new obligations and gives smaller companies more time to adapt[1][6]. We think that balance is right. A rule written for a company with 45 million users should not close the market to a start-up founded by three graduates in Tallinn.

We draw four conclusions. The Commission should publish its guidance on dark patterns before the Regulation applies, so that no platform can plead uncertainty on the first day. Each Member State should designate and fund its Digital Services Coordinator within the fifteen months, and it should not wait for the application date. The Commission should open the risk assessments and audit reports of very large platforms to researchers in universities across the Union, including doctoral students, since independent scrutiny is the only check that scales. Parliament's Internal Market Committee, which visits Meta, Google and Apple in Silicon Valley from 23 to 27 May, should obtain written commitments on the minors' provisions from each company it meets[6].