Delve into the EU Digital Services Act (DSA) – its provisions, compliance requirements, and implications for online platforms. Learn who must adhere to the DSA, the distinctions from GDPR, and the intersection with advertising transparency.
The EU Digital Services Act (DSA) is a comprehensive legislation designed to regulate digital platforms, including large online platforms and search engines, enhancing safety and accountability online. It requires platforms to be transparent about their content moderation processes, decision-making on advertisements, and the operation of recommendation algorithms.
Other key provisions of the DSA include:
Explore more privacy compliance insights and best practices
Enforcement of the DSA involves new EU-level oversight structures and penalties for non-compliance can be as severe as 6% of a company's global turnover. This act complements the Digital Markets Act (DMA) by addressing the responsibilities of digital services, applying to all online intermediaries operating within the EU, with a particular focus on platforms serving over 45 million users.
The Digital Services Act was formally adopted by the European Parliament on July 5, 2022, and by the Council of the European Union on July 18, 2022. It was published in the Official Journal of the European Union on October 27, 2022.
It came into effect gradually in 2023 and 2024.
If you run a small or medium business, it is likely that you don't need to comply with the DSA.
It applies to providers of online intermediary services and platforms that provide services in the European Union must comply with the EU Digital Services Act, regardless of where they are based. This includes a wide range of services such as large online platforms and search engines.
According to the EU Digital Services Act, a "large online platform" is defined as a service that reaches at least 45 million users in the European Union. This number corresponds to roughly 10% of the EU's population, which is used as a threshold to determine the platforms that have a significant societal impact due to their large user base.
These large platforms are subject to more stringent obligations under the DSA due to their potential to spread illegal content, disinformation, and other societal risks more widely. These obligations include systemic risk assessments, greater transparency requirements, and enhanced accountability measures. The aim is to ensure these platforms operate responsibly, mitigate risks effectively, and provide a safer online environment.
The General Data Protection Regulation (GDPR) and the DSA are both European Union regulations aimed at improving the digital landscape, but they target different aspects.
The GDPR acts as a shield for personal information. It establishes a comprehensive framework for how companies can collect, use, and safeguard the data of EU citizens. This includes granting individuals a range of rights over their data,such as the right to access, rectify, or erase it. The GDPR ensures transparency and empowers users to control their digital footprint.
The DSA, in contrast, takes a broader approach, aiming to create a safer and more trustworthy online environment for EU users. It tackles illegal content, the spread of disinformation, and unfair practices by online platforms like social media and marketplaces. The DSA compels platforms to increase content moderation efforts and hold them accountable for the content they host. This fosters a more responsible online ecosystem.
There's an area of intersection, particularly concerning online advertising. The DSA prohibits the practice of targeting advertisements based on sensitive personal data categories protected by the GDPR, such as race or religion. In this instance, the regulations work in tandem to strengthen user privacy protections in the digital advertising sphere.
It's crucial to remember that the GDPR holds the upper hand. The DSA builds upon the existing data protection framework established by the GDPR, not the other way around. The GDPR lays the foundation for user control over their data, and the DSA leverages this foundation to create a safer online environment.
Compliance with the DSA means complying with the following requirements:
If your business needs to comply with the DSA, it doesn't mean that all these requirements will apply. What you'll need to do depends largely on the nature of your business, especially if it involves hosting services or managing content online.
The Digital Services Act is designed to regulate a broad spectrum of online intermediaries and platforms, such as online marketplaces, social networks, content-sharing platforms, app stores, and platforms for booking travel and accommodations. It sets a new standard for the accountability of these platforms, focusing on the management of disinformation, illegal content, and other societal risks. The DSA also emphasizes overarching principles that protect freedom of expression and other fundamental rights, ensuring that these platforms do not compromise on these critical values while managing content.
Meanwhile, the Digital Markets Act targets gatekeeper online platforms with specific rules to ensure fair behavior in the digital marketplace. The DMA's regulations are crafted to foster a level playing field, promoting innovation, growth, and competitiveness both within the European Single Market and globally. This act addresses the power dynamics in digital markets, aiming to prevent gatekeepers from exploiting their dominant positions and thus ensuring healthier competition and more opportunities for new entrants.
