The Digital Services Act (DSA) is a landmark legislative initiative aimed at regulating how online platforms operate.
The DSA is intended to change the way we use online services, protecting users from harmful content and ensuring transparency and fairness in how the largest digital platforms operate. Let’s see how the new legal norms will affect marketers’ daily work.
The Digital Services Act
Regulation 2022/2065 (DSA) is a directly applicable EU legal act. This means that from the moment it entered into force, all entities it covers must comply with its provisions (unlike EU directives, which must be implemented into national law to take effect). Together with the Digital Services Act, the European Commission prepared the Digital Markets Act, which you can read about here.
The DSA’s goal is to increase the safety of internet users and counteract harmful online phenomena, and the new regulations are meant to be clearer and more stable.
The DSA focuses on:
- Preventing the sale of illegal goods and services,
- Ensuring the safety of minors,
- Protecting information about users,
- Banning the publication of illegal and/or misleading content,
- Banning ad targeting based on sensitive personal data,
- Banning the use of deceptive interfaces (dark patterns).
Who the DSA applies to
The DSA’s provisions are addressed to online platforms within the meaning of art. 3(i) DSA, as well as very large online platforms (VLOPs) and very large online search engines (VLOSEs) offering their services within the European Union, regardless of where they are established. The full list of VLOPs and VLOSEs can be found on the European Commission’s website. The larger the entity and the scale of its operations, the stricter the requirements the law imposes on it.
Very large online platforms and search engines are considered to have at least 45 million monthly active users, corresponding to 10% of the European Union’s population.
The DSA’s scope covers, among others:
- Social media,
- Marketplaces,
- Internet providers, hosting companies and domain registries,
- Certain e-commerce platforms.
The DSA states that:
“Online platforms, such as social networks or online platforms allowing consumers to conclude distance contracts with traders, should be defined as providers of hosting services that not only store information provided by the recipients of the service at their request, but that also disseminate that information to the public at the request of the recipients of the service.”
In other words, the DSA can apply to people running ordinary websites, educational platforms and online stores, if they:
- allow comments under articles,
- let users publish product reviews,
- provide space for user-published content, e.g. online forums.
Bear in mind, however, that even if an online store lets buyers leave product reviews, that doesn’t automatically place it in the category of online platforms burdened with the most obligations. The obligations of ordinary intermediary service providers are described in Chapter III, sections 1 and 2 of the DSA.
The regulations concerning online platforms do not apply to micro and small enterprises — i.e. companies employing fewer than 50 people whose annual turnover or balance sheet total is below €10 million.
Since when, and what penalties for non-compliance
The rules apply to all regulated entities from February 17, 2024.
Failure to comply can mean fines of up to 6% of total worldwide annual turnover for very large online platforms — or even a complete ban on operating in the EU. Additionally, these entities can be fined 1% of annual worldwide turnover for, e.g., refusing to submit to an inspection.
The first formal proceedings to enforce online platforms’ accountability were opened by the European Commission in December 2023 against platform X (formerly Twitter). Another DSA compliance proceeding was opened in February 2024 against TikTok.
For platforms too small to fall into the VLOP category, regulatory oversight will rest with the Digital Services Coordinator in each member state (the list of coordinators is on the European Commission’s website). It is the coordinator who will decide the size of any penalty for non-compliance.
The DSA — what it means for marketers in practice
For the online stores and other smaller platforms covered by the rules, meeting the DSA’s requirements will mean designating a contact point, adapting their terms of service, and fulfilling all information and reporting obligations. For the largest online platforms, it will additionally mean increasing the transparency of their operations and their accountability to society, especially minors.
Below is a list of the obligations imposed on the entities specified in the rules that will directly or indirectly affect marketers’ work:
1. Ad transparency
The big platforms will have to provide ad libraries, meaning they’ll have to build databases where you can find every ad shown to users over the past year, along with information about who commissioned it and how large its reach was.
For marketers, such an ad repository is an excellent, easily accessible source of information about the best-performing ads and the results of competitors’ advertising efforts. On the other hand, the repositories will also reveal the know-how of ad targeting based on non-standard user attributes.
The DSA obliges online platform providers to ensure proper labeling of every ad presented to an individual recipient in real time.
These labels include:
- an indication that the creative is an advertisement,
- information on whose behalf the ad is presented (and who finances it, if that’s a different entity from the one commissioning it),
- identification of the main parameters used to determine the recipient to whom the ad is presented and, where applicable, how those parameters can be changed.
These obligations are independent of the information obligations laid down in other legal acts, including e.g. those concerning presenting promotional prices in advertising.
2. Ban on personalized advertising targeted at children
Under art. 28(2) DSA, online platform providers may not present ads based on profiling if they are aware with reasonable certainty that the recipient of the service is a minor.
In particular, this means platforms cannot enable ad targeting at children based on their age.
Note that this is not an absolute ban on showing ads to children. It’s permissible, for example, to display ads on a website without using data about the user’s age (if there is no reasonable certainty that the recipient is a minor).
3. Ban on ad targeting based on sensitive categories
Under the ban in art. 26(3) DSA, online platform providers may not present recipients with ads based on profiling using the special categories of personal data referred to in art. 9(1) GDPR:
“(…) revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, or data concerning health or data concerning a natural person’s sex life or sexual orientation.”
It’s worth mentioning here the position of IAB Poland, which points out that profiling with sensitive data occurs above all when this data is entered directly by the user (e.g. when creating an account) — though sometimes a broader context of various pieces of information can also lead to objectively inferring membership in certain categories.
On the other hand, the IAB notes the need to distinguish between belonging to a specific category and being interested in specific content, and states that platforms should evaluate the profiling process case by case to “avoid the risk of assigning untrue sensitive data to a platform user, derived solely from simple contextual inference”.
From this interpretation one can conclude that advertising a medicine whose advertising is legally permitted, based solely on knowledge of the user’s visit to a thematically related page, doesn’t necessarily violate the DSA’s ban. This reasoning leaves a certain opening, e.g. for remarketing — but the question remains how far online platforms will want to rely on this interpretation.
4. Explaining how algorithms work
The big online platforms’ algorithms often promote sensational content, or content matched to a circle of user interests chosen by the algorithm itself.
With the new rules in place, online platforms are obliged to explain the logic of how content selection works, including which key parameters (e.g. personal data) are used in the process and what effect the algorithm is trying to achieve.
For marketers this will be a source of information that can help promote content more effectively and reach the intended advertising goal faster.
One example is the publicly disclosed X/Twitter algorithm. Perhaps we’ll also learn more about how Google’s algorithms work.
At the same time, users will receive a clear explanation of why particular materials are recommended to them, and will have the right to opt out of profiling-based recommender systems.
Additionally, the big platforms will have to regularly publish transparency reports disclosing, among other things, the number of active users, statistics on removed content, and the potential negative impact of platform use on children’s mental health.
The DSA defines four categories of systemic risk that will require in-depth assessment by VLOPs and VLOSEs. These are above all the dissemination of illegal content and disinformation, but also the service’s impact on freedom of expression, its impact on democratic processes, and its impact on public health protection, on minors, or on gender-based violence.
5. Content moderation rules
Entities covered by the DSA are obliged to create and publish a set of rules and tools governing content moderation, which by design is meant to reduce the one-sided removal of users’ content or blocking of their accounts.
For marketers this means clear guidelines and information about which content and ad creatives can be published and which cannot.
These terms must be written clearly and understandably for users — including minors, if the platform is also aimed at them. For this reason, two alternative versions of terms are appearing more and more often: one written in plain language, and a typically legal one.
The new rules will be felt most by those who manage or use websites where users can post comments. This applies to news portals as well as online stores where customers can review products or even update their user profile, e.g. by adding a photo.
6. Statements of reasons for action taken against flagged content
When a platform takes action against illegal content or content violating the platform’s terms, it must clearly explain the reasons for the action, or present an appropriate statement of reasons.
The user will receive such a statement the moment action is taken against content they published. It will specify exactly which content is involved and explain why and how it was moderated. It will also include information on how the user can appeal the platform’s decision.
Very large platforms must also submit these statements to the DSA transparency database.
As of February 17, 2024, the total number of statements of reasons submitted exceeded 4.5 billion. The largest share comes from the Google Shopping platform:
Reports built from the submitted statements provide statistics showing the reasons behind decisions taken against content on the individual platforms:
7. Giving users the ability to appeal decisions to remove content or block an account
The algorithms that classify content as illegal or unacceptable are often wrong, contributing to the unjust removal of legitimate publications. In such situations, it will be entirely justified to challenge the platform’s arbitrary decision.
For marketers this means, first, receiving detailed information about why a creative or ad was rejected or removed by the portal, and second, the ability to appeal that decision and seek approval to display the prepared creative.
8. Providing users with mechanisms to report illegal or harmful content
Platforms will be obliged to prepare mechanisms allowing users to easily report illegal content, and procedures for responding quickly to such reports.
Recital 12 of the DSA indicates that the concept of “illegal content” should be understood broadly, reflecting the rules that exist offline. The definition of “illegal content” also covers information itself (regardless of its form) concerning e.g. the sale of non-compliant or counterfeit products, the sale of goods or provision of services in breach of consumer protection law, or the unauthorized use of copyrighted material.
Every user will be able to report such a situation so the platform takes appropriate action. For marketers this can also matter for brand image, if their ads appear next to illegal or harmful content.
Moreover, the big platforms will be obliged to employ an adequate number of moderators responsible for effective content moderation — including handling reports of unlawful content — in all official languages of the European Union.
9. Ban on so-called “dark patterns”
“Dark patterns” are design patterns intended to nudge consumers into actions they didn’t originally plan — e.g. increasing the value of their shopping cart or subscribing to an auto-renewing plan. This applies to all digital market players, regardless of size.
Drawing the line between illegal patterns and effective marketing can be difficult, but crossing it can bring unwanted attention and liability for commercial practices deemed unfair, misleading and harmful to consumers’ collective interests. The European Data Protection Board has prepared guidance to help recognize and avoid “deceptive interfaces” in social media, available at this link.
Consider as a warning the fine imposed on an Italian online marketing agency for practices deemed “dark patterns”, and the fine of over PLN 1.5 million imposed on the DUKA store by Poland’s consumer protection authority (UOKiK) for using the “sneak into basket” mechanism — covertly adding items to the cart.
UOKiK scrutinizes online stores’ practices, particularly manipulative techniques such as:
- Placing a product in the cart, e.g. a thematically related product at an attractive price, or an insurance service;
- Adding unannounced fees at the final stage of the purchase process (known as “drip pricing”);
- Using deceptive interfaces, e.g. placing the order button before all fees are shown to the consumer;
- Using fake countdown timers to exert artificial pressure;
- Running promotions with no defined end, suggesting attractive prices apply only for a limited time when in fact they apply continuously;
- Hiding essential information about the product, service or transaction terms.
What does the DSA change for e-commerce?
Remember that the addressees of the DSA’s obligations are online platforms (intermediary service providers). The DSA therefore concerns only specific, mostly large entities. Most online stores will not be directly subject to its provisions.
Any penalties for non-compliant ads will hit the platforms that allowed them to be displayed, not the advertisers (content providers) themselves.
This doesn’t mean e-commerce won’t feel the new rules’ impact indirectly.
Platforms such as Google, Facebook, YouTube, Instagram, Pinterest, TikTok and X (Twitter), being under the European Commission’s special scrutiny, will enforce the above rules even more strictly — rules which, nota bene, were already to some extent reflected in their terms of service. As a result, these platforms simply won’t display content or ads using, for example, remarketing lists built on sensitive data.
The Digital Services Act opens a new chapter of a fair digital market and can also be an opportunity for marketers, letting them use transparent ad repositories and better understand how the big platforms’ algorithms work.
By ensuring user safety and curbing manipulative practices, marketers can focus on building authentic and effective advertising strategies. The DSA bets on quality and ethics in the digital world, which can bring greater consumer trust and long-term success for businesses.
