The Digital Services Act: A new global golden standard for internet regulation?

A new set of rules encompassed in the proposed Digital Services Act (the DSA) has recently been shared. While the DSA is primarily targeted at the larger technology players and increasing their accountability, the DSA (like the GDPR) will have an impact on startups too. So, what are the laws the DSA could introduce, who would these apply to and what should startups keep in mind? 

What is the Digital Services Act? 

The main concept of the DSA is, as Margrethe Vestager, Executive Vice-President for a Europe fit for the Digital Age, said: ‘what is illegal in the real world, shall become illegal in the online world.’ Its ultimate aim is therefore to modernise the old e-Commerce Directive and thus make the online world a safer place by targeting mainly:

  • spreading of hate speech, 
  • cyber threats, 
  • disinformation, 
  • illegal content, 
  • sale of fake products,
  • dark patterns,  
  • targeted advertising and, in particular, 
  • online platforms, such as social media or marketplaces. 

The DSA tries to guarantee certainty in the European Union, by ensuring that larger platforms hold a higher level of responsibility for the content on their platforms. Moreover, by harmonising these rules among all Member States, start-ups can grow within the EU with clear rules, legal certainty, and in a safer environment in terms of digital safety, too. This will create a comprehensive set of new rules for all digital services.

Who will be affected if the proposed Act comes into force?

  • Intermediary services – all providers of intermediary services will be caught by the proposed DSA. This includes any provider of ‘mere conduit’, ‘caching’ or ‘hosting’ services. In plain speak, this means internet access providers, domain name registrars, cloud and web hosting services, online marketplaces, app stores, collaborative or social media platforms etc. 

  • Larger online platforms and ‘persons (natural and legal) acting for purposes related to their trade’ – organisations with more than 45 million active users per month and, in cases of suspected infringement of the DSA, even other persons. In plain speak, this means auditors, shall be subject to providing information to the Commission.

  • Companies based outside of the EU if they provide services in the EU.Whiles the changes encompassed under the DSA will not directly affect micro and small enterprises (a micro organisation has a maximum of 9 employees & annual turnover and/or balance sheet max EUR 2 million, whereas a small organisation has a maximum of 49 employees and annual turnover and/or balance sheet max EUR 10 million according to the Annex to the Commission Recommendation of 6 May 2003), small startups which operate in the above categories should keep in mind that the DSA affects them too. 

What impact will the DSA have on startups and the innovation ecosystem? 

Given that many different legislations were in place in the European Union prior to the DSA, compliance with each regulation placed a disproportionate burden on startups when they wanted to expand to other countries.

If the DSA is adopted, it would bring more uniform obligations and therefore lower costs for startups, as startups will not have different obligations to meet regarding their online activity in each European member state. Startups will therefore be able to spend the saved money in another direction.

Which obligations will start-ups have under the DSA? 

Obligations under the DSA differ according to a provider’s role, size and impact on the online world. Even though startups will not be affected as heavily as bigger companies, they are likely to qualify as micro or small enterprises and be subject to the following obligations:

  1. To provide a description of restrictions they impose on the use of the platform, in using their services. For example, this could be in the startups terms and conditions, and include information on any policies, procedures, measures and tools used for the purpose of content moderation, including algorithmic decision-making and human review.
  1. To put mechanisms in place to allow notification of illegal content. These mechanisms should be easy to access, user-friendly, and allow for the submission of notices electronically.
  1. To cooperate with national authorities. The startup should establish a point of contact with authorities for direct communication, electronically, with Member States’ authorities, the Commission and the Board.
  1. For providers based outside of the EU, to provide legal representatives in the EU. It may be necessary to establish a legal representative in the EU if you are a non-EU provider to communicate with the Member States’ authorities, the Commission, and the Board. This communication concerns all issues necessary for the receipt of, compliance with and enforcement of decisions issued in relation to the DSA.

Failure to comply with the DSA could result in a fine of 6% annual turnover. 

Specific changes to targeted advertising and content moderation 

For startups who use targeted advertising, such as targeted Google ads, they will need  to comply with the rules under the DSA. In particular the proposed Act outlines: 

  • if a recommendation engine is used, the need to be transparent about how content is being displayed to users
  • an alternative means to profiling based on algorithmically influenced content
  • transparency for targeted advertising (if used) 
  • a ban of targeted advertising based on special categories of data defined under the GDPR (ethnicity, political views or sexual orientation) or when processing the personal data of children 

These new rules aim to empower users to understand their choices while giving them more control over the content they see online.

When should my startup start to address these obligations? 

Currently, the proposed DSA is still undergoing an ordinary legislative procedure, which means the negotiations are still ongoing. Once adopted, the rules will directly apply to all EU member states. The following months will be very important because it is envisaged that the DSA will become effective in 2024.

For startups, the DSA will lay down a common set of obligations and accountability rules. From hate speech to misinformation to false advertising, startups with an online presence will need to ensure they meet the new requirements. We are curious to see the shape of the DSA once it is in its final draft and will keep you updated on changes as they occur. 

Author: Vanda Zaklaiová
Editors: Tatiana Pavelková and Annabel Pemberton