Agreement on Digital Services Act (DSA)
In the night of Saturday, 04.16.22, the European Parliament and the EU states reached a compromise on the Digital Services Act (DSA). The stated goal of the law is to establish rules for the Internet to “make everything that is illegal offline illegal online” – whether hate speech, terrorist propaganda, or even the sale of counterfeit products. The law should be seen in the context of the Digital Markets Act (DMA), which aims to create fair competition. It is true that the DSA still has to be adopted by the plenary of the EP and the Council of Ministers, the body of the member states. However, this is considered a formality.
Who is affected?
Directly affected by the new law will be online brokerage services. These include:
- Switching services that have an infrastructure network: Internet access providers, domain name registrars;
- Hosting services such as cloud computing and web hosting;
- very large online search engines with more than 10% of the 450 million consumers in the EU and thus more responsibility for curbing illegal content online;
- Online platforms that bring sellers and consumers together, such as online marketplaces, app stores, collaborative economy platforms, and social media platforms;
- very large online platforms with a reach of more than 10% of the 450 million consumers in the EU, which could pose particular risks for the distribution of illegal content and societal harm.
Nonetheless, advertisers and intermediaries should also consider the new regulations due to the potential shared responsibility with operators. The new regulation also includes restrictions on online advertising and regulations for cookies.
What are the obligations for the operators of these services?
A large number of obligations are imposed on the operators of such services. The aim of these obligations is, among other things, to limit hate, incitement and disinformation, which should replace parts of the NetzDG. Greater transparency is also to be created through obligations to (partially) disclose algorithms of large platforms.
Other regulations, however, which are aimed particularly in the direction of consumer protection, also have an impact on the possibilities of online advertising. Thus, fortunately, a complete ban on targeted advertising did not materialize. However, the DSA now under negotiation provides for a ban on personalized advertising based on data of minors or the playout of personalized advertising to minors. However, it is still unclear how far this prohibition actually extends and to what extent the operators can also be held accountable for actually carrying out age verification.
What is clear, however, is that sensitive data, such as data on the Internet, must be protected. health data or sexual orientation, will be prohibited. If such data is currently being used, it must be changed no later than the date of application of the DSA.
Significant regulation in the field of cookie banners
The DSA contains a significant provision for the design of cookie banners. These must not be misleading, e.g. by means of optical highlighting of a possibility (so-called dark patterns). Here, too, however, the exact wording is not yet known, which is why there are currently different accounts of the scope of this ban. Websites should not be allowed to ask for the user’s consent again after the user’s consent has been denied. The regulations thus create uniform standards at EU level (and anticipate the ePrivacyVO).
Clarifications are provided in the DSA regarding terms and conditions, which must be clear and available in plain language. In addition, like the GDPR, the law contains a risk-based approach, for example in the obligation to take measures against misuse of the systems.
For traceability of commercial users on online marketplaces, online platform operators (with the exception of smaller platforms) must have information about the traders offering products or services on their sites.
The obligation to create advertising databases by large online services is also apparently envisaged. It could also become significant that users must be able to use services without profiling. For a final evaluation, however, the final text of the regulation must first be available.
Our conclusion: Partly comprehensive need for action and significant effects on the advertising industry
The DSA is scheduled to go into effect next year. Due to the transition periods provided for in various parts of the law, mandatory application is expected at the beginning of 2024.
A final judgment on the need for implementation is not yet possible, as the final text of the law is not yet available. For large online providers, the new regulations will in some cases require extensive action; for smaller companies, this will be limited, not least because of the DSA’s tiered system. In particular, the limitation of tracking by means of data of minors and data of special categories iSv. However, Art. 9 GDPR is likely to have an impact on the advertising industry that should not be underestimated. Furthermore, according to the regulation, a website should be able to be used without profiling. The regulation – comparable to the GDPR – provides for severe fines. We will report on further details as soon as we have been able to assess the exact design of the regulations.
Related links:
EP PM:
PM of the COM:
Council PM: