Online platforms face likely Digital Services Act disclosure deadline of February 2023

The new disclosure duties are set out in the proposed new Digital Services Act – legislation that will alter the requirements on online intermediaries over the way they moderate content posted, and police the goods and services traded, on their platforms.

Representatives of the EU’s two law-making bodies, the European Parliament and Council of Ministers, reached political agreement on the Digital Services Act (DSA) back in April. The Parliament subsequently voted to approve the legislation in July. An updated version of the legislation (312-page / 686KB PDF) has, however, been prepared and endorsed by MEPs following a review by lawyer-linguists. The revised text was approved on 12 September but will only take effect if the Council also formally approves it.

Out-Law understands that the Council will vote on the DSA at a meeting on 4 October, provided the draft legislation is first endorsed by the Council’s Permanent Representatives Committee (COREPER). COREPER is expected to consider the DSA on 28 September.

Assuming the Council adopts the DSA, the legislation will then be formally published in the Official Journal of the EU (CJEU) – this usually happens approximately 20 days after such a vote. The DSA would then come into force a further 20 days after its publication in the OJEU, though the bulk of the DSA’s provisions would only take effect some 15 months later.

Under that anticipated timetable, businesses can expect that the DSA will come into force in the middle of November 2022, with the bulk of provisions then taking effect in the middle of February 2024. However, reporting obligations applicable to online platforms would begin to apply immediately from the date the DSA enters into force – with a three-month deadline set for compliance.

Under Article 24(2) of the DSA, online platform providers must “publish for each online platform or online search engine, in a publicly available section of their online interface, information on the average monthly active recipients of the service in the [EU], calculated as an average over the period of the past six months”. That proactive reporting duty is a recurring one that must be complied with on at a least a six-monthly basis following the initial disclosure.

In addition, Article 24(3) sets out reactive reporting obligations, which would also apply immediately the DSA comes into force.

Under those provisions, online platform providers would be obliged to share updated information on the average monthly active recipients of their services in the EU with national authorities responsible for supervising the application of the DSA in each EU country, referred to as ‘digital services coordinators’ in the DSA, or the European Commission, upon their request. The updated information would need to be provided without undue delay.

Both digital service coordinators and the Commission would have further powers, under Article 24(3), to require online platform providers to share “additional information as regards the calculation …, including explanations and substantiation in respect of the data used”.

The DSA empowers the European Commission to set out the methodology for calculating the number of average monthly active recipients in further EU legislation, known as delegated acts. Online platform providers are obliged to conform to that methodology if and once those acts are adopted. Otherwise, a non-binding recital of the DSA provides guidance on what is meant by the term ‘active recipient’. We have copied the relevant recital at the bottom of this article – it is clear from a reading of it, though, that the term is meant to refer to more than just a platform’s registered users.

The process of designation provided for under the DSA will take effect immediately once the DSA comes into force. Very large online platforms that are designated as such would need to comply with the obligations on them under the DSA within four months of being notified of that designation, regardless of whether that date is earlier than the date on which the bulk of the DSA’s provisions will take effect.

Among other things, under the DSA, very large online platforms would be obliged to identify, analyse, assess and mitigate ‘systemic risks’ arising from the design, functioning and use made of their services in the EU. Fines of up to 6% of the annual global turnover of could be levied on online platforms and search engines that fail to comply with their obligations under the legislation.

What is an ‘active recipient’?

Online platform providers face being required to disclose “information on the average monthly active recipients” of each of their platform and search engine services in the EU calculated as an average over the period of the past six months, under the Digital Services Act.

No specific methodology has yet been prepared by the European Commission to inform that calculation. However, guidance on what information online platforms need to report is contained in a non-binding recital to the DSA. Here is what recital 77 states:

“In order to determine the reach of a given online platform or online search engine, it is necessary to establish the average number of active recipients of each service individually. Accordingly, the number of average monthly active recipients of an online platform should reflect all the recipients actually engaging with the service at least once in a given period of time, by being exposed to information disseminated on the online interface of the online platform, such as viewing it or listening to it, or by providing information, such as traders on an online platforms allowing consumers to conclude distance contracts with traders.”

“For the purposes of this Regulation, engagement is not limited to interacting with information by clicking on, commenting, linking, sharing, purchasing or carrying out transactions on an online platform. Consequently, the concept of active recipient of the service does not necessarily coincide with that of a registered user of a service. As regards online search engines, the concept of active recipients of the service should cover those who view information on their online interface, but not, for example, the owners of the websites indexed by an online search engine, as they do not actively engage with the service.”

“The number of active recipients of a service should include all unique recipients of the service that engage with the specific service. To this effect, a recipient of the service that uses different online interfaces, such as websites or applications, including where the services are accessed through different uniform resource locators (URLs) or domain names, should, where possible, be counted only once. However, the concept of active recipient of the service should not include incidental use of the service by recipients of other providers of intermediary services that indirectly make available information hosted by the provider of online platforms through linking or indexing by a provider of online search engine.”

“Further, this Regulation does not require providers of online platforms or of online search engines to perform specific tracking of individuals online. Where such providers are able to discount automated users such as bots or scrapers without further processing of personal data and tracking, they may do so.”

“The determination of the number of active recipients of the service can be impacted by market and technical developments and therefore the Commission should be empowered to supplement the provisions of this Regulation by adopting delegated acts laying down the methodology to determine the active recipients of an online platform or of an online search engine, where necessary, reflecting the nature of the service and the way recipients of the service interact with it.”