Two years on from the Digital Services Act

The question

How has the European Commission (Commission) enforced the Digital Services Act (DSA) since its inception?

The key takeaway

In its first two years of application, the Commission has taken an active role in monitoring and enforcing the provisions of the DSA, with at least 22 online platforms receiving requests for information, and some of these platforms (see below) being the target of more significant action.

The background

The DSA came into force on 16 November 2022, with most of its operative provisions taking effect across all EU Member States on 17 February 2024 (for further context of the parliamentary process of the DSA, see our Snapshots Spring 2023 article). The main aim of the DSA is to implement a new framework of obligations applying to all digital services to keep users safe from illegal goods, content or services, and to protect their fundamental rights online. The rules apply to providers of online intermediary services (eg online platforms, online marketplaces, and hosting providers) to consumers and business in the EU.

The DSA operates on a tiered system whereby different obligations apply to entities depending on their size and the services they provide. The two groups of companies that receive the highest level of scrutiny under the DSA are “very large online platforms” (VLOPs) and “very large online search engines” (VLOSEs). A company is given this designation by the Commission if it has more than 45 million users per month in the EU. Receiving this designation means the VLOP or VLOSE must comply with a number of additional obligations set out in the DSA, for example, auditing, monitoring and data sharing with authorities to reduce systemic risk in the EU.

The development

The DSA broadly gives the Commission both investigative and sanctioning powers, and almost two years to the day in which the DSA came into force, the Commission has exercised its powers under the DSA with increased regularity.

As at writing, the Commission has sent requests for information or started formal proceedings against 22 online platforms in relation to a variety of issues including illegal products, dark practices, misinformation, risk to minors, and advertising practices.

The first formal proceedings under the DSA were initiated against the platform X (formerly known as Twitter) in December 2023. The investigative stage has focused on infringements relating to illegal content, the controls X has in place to combat misinformation and transparency and the suspected deceptive design of the ‘blue checks’ on the platform. As of July 2024, the Commission has informed X of its preliminary findings, highlighting that its current practices are: (i) not compliant with the transparency rules on advertising; (ii) deceiving for users as the blue checks denotes a form of verification has taken place (which it has not); and (iii) that X has prohibited “eligible researchers from independently accessing its public data”. X now has the chance to raise a defence against the preliminary findings, however failure to raise a successful defence would lead to the Commission adopting a non-compliance decision finding that X is in breach of Articles 25, 39 and 40(12) entailing potential fines of up to 6% of total worldwide annual turnover.

Under a similar process, the Commission opened two formal proceedings against Meta in April and May 2024 concerning the Facebook and Instagram platforms. The April proceedings centred on four DSA compliance issues: handling of deceptive ads and disinformation, transparency in political content demotion, lack of real-time election monitoring tools due to the deprecation of “CrowdTangle” and inadequate user-friendly mechanisms for flagging illegal content and handling complaints. The Commission’s May investigations relate to the use of the platforms by minors, including the potential for the services to reinforce addictive behaviours, the adequacy of measures used to maintain privacy, safety and security and the controls surrounding minors’ access to inappropriate content. The Commission will now conduct further investigation, gathering evidence through requests for information, interviews, and inspections. The formal proceedings allow the Commission to take enforcement actions, including interim measures or non-compliance decisions, and to accept any commitments Meta may offer to resolve the issues.

In the retail sphere, Temu and Shein were both issued with requests for information in June 2024, with the latter only receiving its designation as a VLOP in April 2024. The Commission gave both platforms around a month to detail their measures for complying with DSA obligations on the “Notice and Action” mechanism for reporting illegal products, user-friendly interfaces free from deceptive “dark patterns,” protection of minors, transparency of recommendation systems, trader traceability, and compliance by design. On 31 October 2024, the Commission opened formal proceedings to evaluate whether Temu may have violated the DSA in relation to the sale of illegal products, the service’s potentially addictive design, its purchase recommendation systems, and researcher data access. The Commission will continue to gather evidence in its consideration of whether to bring further enforcement action against Temu, however it may also consider Temu’s efforts to remedy these practices.

Why is this important?

Since the DSA’s provisions took effect in February this year, the Commission has been on a war path to exercise their powers against any online platforms it considered problematic under the DSA. As Thierry Breton, Commissioner for Internal Market, said about the proceedings against X, “[the formal proceedings] makes it clear that, with the DSA, the time of big online platforms behaving like they are “too big to care” has come to an end.” The preliminary findings against X suggest that the Commission is preparing to impose potentially significant fines against it (noting again the maximum limit being 6% of total worldwide annual turnover).

Any practical tips?

The proceedings against the platforms discussed above have detailed specific areas of concern relating to the user experience on their respective sites and other VLOPs should ensure they stay abreast with Commission proceedings to ensure that they do not fall foul of similar DSA infringements. In particular, the proceedings against X mark the first time in which the Commission has taken an action against a VLOP to the second stage which is likely to have ramifications for other platforms facing similar proceedings. The result of this second stage will be an important gauge as to how VLOPs can manage this process and how cooperation with the findings of a Commission investigation may help in avoiding or reducing the potential financial penalties.

Winter 2024