Digital Services Act: New obligations for many online services as of 17 February already

It seems that many online service operators still pay much less attention to the Digital Services Act than they should. The DSA will be a real game changer - for "online platforms" more than for other intermediary services. Therefore, we want to discuss what characterizes an online platform.

An online platform is – slightly simplified – defined as a hosting service that, at the request of a user of the service, stores and disseminates information to the public (unless it is a minor and purely ancillary feature). A hosting service is any service that stores information provided by, and at the request of, a user of the service.

The problem with this definition is that it is so wide: Pretty much anything a user of an online service does has something to do with information which is stored somewhere. Users fill in their names and contact details in a web form, choose a nickname under which they are known online, leave comments on a website, review and rate products in an online shop, communicate with others in a chat, store preferences for their news websites, customize avatars in a virtual world, build worlds or otherwise interact with an online game. Business might have their profiles on a delivery service, details on their vehicles in a taxi app, or their products in an online marketplace. Most of this information is stored somewhere by the operator of such service. And, as said above, a hosting service is any service that stores information provided by, and at the request of, a user of the service. This means that online services which do just that might be considered hosting services (the definition of a hosting service is almost identical to the one which was introduced in the e-Commerce Directive – under the e-Commerce Directive, there is some case-law on the definition of hosting service but not a lot which would help us narrow down this overly broad definition). However, even providers who have not been able to invoke the exclusion of liability under the host-provider privilege to date may be affected by the due diligence obligations as a hosting provider.

As soon as this information is not only stored but shared with the public, the service might even be qualified as an online platform. The DSA contains many new obligations for online platforms. Most of them are only to be complied with by February 2024, but some as early as 17 February 2023 – especially the average number of monthly active users has to be published (very large online platforms with more than 45 million active users are another category with much more burdensome obligations). As of February 2024, all the other obligations apply – for online platforms, they include the obligations to set up an internal complaint-handling system and an out-of-court dispute settlement system, to give priority treatment to trusted flaggers of problematic content, to implement measures and protection against misuse, transparency reporting obligations, restrictions on online interface design and organization (including restrictions of so-called "dark patterns"), to establish rules for advertising on online platforms (with restrictions for personalized advertising which are stricter than GDPR provisions), to implement rules for recommender system transparency and the online protection of minors.

Some of these obligations can be quite onerous. They require very relevant implementation efforts as – depending on the service – its core processes might have to be reviewed.

It also seems that the definition of online platform might be broader than it should be, covering services the legislator did not have in mind. Companies are therefore well-advised to examine carefully if their services are in fact online-platforms on a feature-by-feature-basis. This may require legal analysis, e.g. in case the information which is stored consists of elements provided by the operator of the service which leaves little room for abuse, in case the service provider exercises control over the information which is stored or disseminated, or on the question whether a "dissemination" is "public" and is performed "at the request" of the user. A diligent analysis may also have to include a technical analysis, e.g. what type of information is actually stored, and where. Finally, it should be assessed whether the "minor or ancillary feature" exception can be applied.

These assessments must be carried out individually: For example, in some online shops, the review and rating system may be more important than in others, replays of some online games may be stored just on the user's PC while others store it on the server and let users share them, and the influence a service operator exercises on the information it stores and shares can vary widely.

ADVANT will host a webinar on the Digital Services Act on 16 February 2023 at 05:00 p.m. CET. Webinar registration | Microsoft Teams

Dr Andreas Lober