A guide for online intermediaries on the scope of the EU Digital Services Act

A tiered system of regulation applies, with obligations of varying stringency depending on the nature and size of the services provided. For intermediaries to understand exactly what obligations they must comply with, they must first determine how their services should be categorised for the purposes of the DSA. In this guide, we look at which services are in scope of the DSA and examine the different categories those services might fall under.

Which services does the Digital Services Act apply to?

The Digital Services Act applies to three types of ‘intermediary service’. These are mere conduit services, caching services, and hosting services. Fairly instructive definitions for each of the three types of service are set out in Article 3 of the DSA and examples are cited in recital 29, but the term essentially applies to:

• facilitating access to or the transmission of information over a communication network;
• temporarily storing information as it is transmitted over such networks in order to improve the efficiency of that data exchange;
• storing information provided by service users at their request.

Examples of hosting services include cloud computing, web hosting, paid referencing services or services enabling sharing information and content online, including file storage and sharing, though ultimately whether a service is in scope of the DSA or not will depend on its “technical functionalities”.

Substantial connection to the EU

In first place, intermediary services are only subject to the DSA to the extent that: they are offered in the EU, and; the people or businesses that receive the respective services have their place of establishment or are located in the EU. It is irrelevant where the providers of those services themselves are established or located.

Whether an intermediary service is ‘offered’ within the EU mainly depends on whether the provider has a ‘substantial connection’ to the EU. Article 3 of the DSA explains that this will be the case if the provider is established in the EU or other criteria apply.

Recital 8 of the DSA further suggests providers will be considered to have a ‘substantial connection’ to the DSA if the number of people or businesses receiving their services in one or more EU countries is “significant” relative to the population of that member state or states.

Targeting activities towards an EU market will also be considered to be evidence of a ‘substantial connection’. Factors specified as relevant in this regard include the language of services or advertising, the currency the services support, the possibility of ordering products or services, the use of top-level domains, the availability of apps, and the way customer relations are handled. Recital 8 makes clear, however, that just because a website is technically accessible in the EU does not necessarily mean that the business behind that website has a substantial connection to the EU.

The different categories

For online platforms, establishing whether they offer intermediary services within the scope of the DSA is only the first step towards understanding the extent of the requirements they face. The next step is understanding which category of intermediary service they fall into.

While there are exceptions for micro, and small and medium-sized, enterprises, categorisation is generally as follows:

• All in-scope intermediary services are subject to due diligence and transparency obligations, set out in Section 1 of Chapter III of the DSA.
• Section 2 of Chapter III contains a further set of requirements that providers of hosting services, including online platforms, must comply with.
• Section 3 of Chapter III outlines additional provisions that are specific to online platforms.
• Section 4 of Chapter III contains further rules again for online platforms that allow consumers to conclude distance contracts with traders.
• Section 5 of Chapter III details additional obligations that only providers of very large online platforms and very large online search engines must comply with.

The stark differences in legislative requirements across the categories makes it absolutely vital for providers of intermediary services to determine which bits of the legislation applies to them. This can be a particularly complex task where a provider offers a range of different, but dovetailed services.

It is perfectly possible, for example, that some of the services provided by an online intermediary fall within the scope of the DSA while others do not, or that the services fall into the different categories provided for under the regulation. It is important that each service is considered individually to determine whether and to what extent the DSA’s provisions apply to it. There is some guidance buried within the DSA to help with categorisation.

What constitutes an online platform under the DSA?

As explained above, one of the main distinctions that intermediary service providers need to be aware of is the difference between a hosting service and an online platform service. Online platforms are considered a subcategory of hosting service provider under the DSA. The difference between the two is that online platforms not only store information, they disseminate it too.

The matter is not as clear cut as that, however, as factors such as who a hosting service provider is disseminating information to, and how core that dissemination is to their service offering, dictate whether they qualify as online platform service providers or not. Only where hosting service providers disseminate information to the public could they be considered online platforms under the DSA.

Notably, recital 14 explores the concept of ‘dissemination to the public’. It clarifies, among other things, that information is only considered to be disseminated to the public under the DSA if it has been directly requested by the recipient of the service and is made generally available.

Hosting service providers that disseminate information to registered users could be considered to be online platforms for the purposes of the DSA if the users have been automatically registered. If registered users' access to information has been determined by a human decision or selection process, the provider will not qualify as an online platform.

Even if hosting service providers do disseminate information to the public, they would only be considered online platforms for the purposes of the DSA if the dissemination feature or function of their service offering is more than minor or ancillary.

Recital 13 goes into more detail about that exception and cites real world examples: the comments section of a newspaper website is unlikely to qualify as an online platform service given the website’s main purpose would be publishing news, but the storage of comments by a social network provider would qualify as an online platform service even if it is ancillary to the publishing of those posts. A reading of the recital also suggests that cloud computing or web-hosting services providers are unlikely to fall within the scope of the DSA even if they happen to disseminate information occasionally.

What constitutes a very large online platform under the DSA?

Online platforms will qualify as ‘very large online platforms’ if they have a number of average monthly active recipients for their service in the EU that is “equal to or higher than 45 million”, calculated as an average over a period of six months, and they have designated as very large online platforms by the European Commission under the process set out in the DSA.

The 45 million threshold equates to approximately 10% of the EU population currently and is subject to review and amendment over time. The DSA empowers the European Commission to set out the methodology for calculating the number of average monthly active recipients in further EU legislation, known as delegated acts. This methodology has still to be published, so there is a lack of clarity currently on how the calculation must be done. Still, online platform providers are obliged to conform to that methodology if and once those acts are adopted.