How do you prepare for the DSA or DMA, if it applies to you?

The EU is trying to make the online environment safer with a package of new measures. This concerns the DMA and the DSA. The rules are completely different, we explain the details.

The Digital Services Act package already passed the European Parliament in 2022. This package, in turn, came from a European Commission proposal dating back to late 2020. The general implementation of the rules will follow very soon. In short, the whole political process and its administration take time. But several months are also always provided as preparation time for companies. We are at the end of this period so it is a good idea to check whether everything has been put in order.

The Digital Services Act (DSA).

Preparations for the Digital Services Act should actually have been made. In fact, as of Feb. 17, the legislation officially goes into effect. This means that violations become punishable, but in this case also expands the group of companies subject to the legislation.

Who must comply?

The DSA applies to 19 comprehensive platforms and search engines as of August 2023. That’s just the tip of the iceberg. The rest got time to prepare until Saturday, Feb. 17, 2024. This includes the rest of the online platforms on which products and services are sold. This goes beyond digital sales platforms to include app stores and social media platforms. Furthermore, hosting providers for the cloud and web hosting, among others, are covered by the DSA. Finally, the legislation covers the services that make all this happen, including Internet service providers.

The delineation of the target market for the DSA is not always very straightforward. For example, Europe has already had to determine how AI tools will have a place in this law. “We ended up dividing this into two categories. AI tools that are part of a platform fall under the DSA anyway. There is no doubt about that. For stand-alone AI tools, the question is whether the tool is a platform or a search engine. We leave this determination to a lawyer who checks the definition of the tool,” explained an official spokesperson for the European Commission.

The dividing line between large and small platforms is at the limit of 45 million active users. However, the definition of a platform often still causes confusion and it is also not clear in all cases when a company can be counted as a tool to help other online platforms. The European Commission puts the responsibility in the hands of the platforms to determine for themselves whether they have to comply with the DSA, as, incidentally, continues for other regulations. “We don’t have numbers available on how many platforms have to comply. The beauty of the internet is that a website is created in a minute. Therefore, it is difficult to keep track of how many websites are selling products or services.”

What rules?

The legislation focuses on several aspects to make digital services safer. For example, it holds these companies accountable for unsafe content and illegal products that continue to circulate on their platforms for a long time. ‘Dark patterns’ such as misleading elements in the construction of a website are also banned from now on. In addition, rules for personalized advertising get stricter by mainly restricting the possibilities around the use of personal data. Furthermore, children and young people are no longer allowed to see advertisements. Finally, there should be more openness about algorithms on which online services work and make recommendations to potential consumers. To this end, providers will draw up a public transparency report at least once a year.

Europe wants to prevent legislation from killing smaller online services itself. “Most small and micro-platforms hardly get any additional rules through the DSA,” an official spokesman for the European Commission said in this regard. Platforms that fall below the limit get fewer rules according to the size of the online service they have and its potential impact on society.

From the moment they employ fewer than 50 people and have an annual turnover not exceeding 10 million euros, certain rules do not apply. However, this group must provide a contact person to whom users can always turn with questions and comply with the other basic rules. An annual transparency report is, however, not required for this party. This still imposes quite a few additional obligations on smaller platforms, in our opinion.

What fines?

The legislation is stricter for large companies that draw millions of users. They face additional rules. In addition, they face higher fines for violations of the DSA. The fee is a percentage of annual sales, more specifically, six percent.

Platforms covered by the legislation as of Feb. 17 will get other amounts of fines. The exact amount depends on the place of their headquarters. Each member state must specify the fine in national legislation. Supervision of violations also happens through the EU member states. Each country will get its own national regulatory authority.

However, not all online platforms are originally European. These platforms do have to make a point of contact in Europe for the DSA. That point will determine under whose jurisdiction the company falls.

We already gave a comprehensive overview of the rules that apply to the biggest online platforms and search engines in this article: Big Tech gets new rules from EU, what will you notice as a user?

The Digital Markets Act (DMA)

The bulk of companies that must comply with the package of new legislation to make the online environment safer and ensure fair competition will have to follow only the rules of the DSA. This is because the Digital Markets Act has much more specific criteria and applies only to specific companies the EU designates.

The EU designates these companies with the term “gatekeeper”. To be a gatekeeper, an organization must meet the following conditions. First, a gatekeeper operates in at least three member states with an annual turnover of €7.5 billion or a market share of €75 billion. In addition, a gatekeeper has 45 million users per month or 10,000 business European users per year. Finally, a gatekeeper must meet both conditions for three years.

The rules cover several things, including the obligation to be interoperable and more mindful of user privacy. Own products and services may also no longer be favoured over those of competitors through intrusive push notifications, for example. App stores from Apple and Google, for example, may no longer have an exclusive right to offer an app store. Purchases in an app must henceforth also be possible through payment options other than those offered by Google and Apple through their app stores.

Starting in March 2024, the rules will become punishable. Violations hold fines of up to ten percent of the company’s total annual revenue. The fine will rise to a maximum of 20 percent for upfollowing violations.

Unclarity for DSA

The DMA is much clearer in terms of delineation and fines to comply. The gatekeepers are designated and know exactly which services are covered by the legislation and which are not. For the expansion of the DSA that goes into effect on Feb. 17, the details are more unclear. Platforms have to gather the information themselves, and Europe only helps reach them through the press and through the initiatives from the European Union. Only after that is it still largely up to these companies to find out what amount of fines have been agreed upon and exactly which rules apply.