Garrigues Digital_

The first major milestone following the entry into force of the Digital Services Act (DSA) is determining the size of the online platforms and search engines that provide services in the European Union. This is a key question, since the due diligence obligations incumbent on very large platforms are considerably heftier. The first step is for platforms and search engines to report the average monthly active recipients (AMAR) of the service in the EU. The Commission will then identify those that should be considered “very large” on account of having more than 45 million active users (10% of the European population).

As we have analyzed in several posts, the obligations the DSA imposes on service providers are more or less onerous depending on how closely engaged they are with users and on their size. Obligations are progressive and cumulative based on whether the provider offers intermediary or hosting services or is a platform or search engine. In addition, a new category was created for “very large” platforms and search engines, to which European lawmakers have imposed additional obligations in view of their impact in the EU.

Now that the obligations envisaged in the DSA have come front and center, it is time to get to work with the first step: determining whether platforms and search engines are “very large”. Only after this is determined can providers know their exact obligations under the DSA and when they need to start complying with them.

1. What are “very large” online platforms and search engines?

Very large online platforms and very large online search engines are those that have a number of average monthly active recipients of the service in the Union equal to or higher than 45 million (10% of the total EU population).

These businesses have until February 17, 2023 to publish the number of average monthly active recipients on their interfaces. They must also report this information to the Digital Services Coordinator for their Member State of establishment (the designation process is still underway in Spain) and to the Commission, at their request.

The European Commission will assess whether a platform should be designated a very large online platform or search engine and, in the event of discrepancy with the information furnished by the provider, the provider will have a period in which to submit its views on the Commission’s preliminary findings.

The list of very large online platforms and search engines will be published in the Official Journal of the European Communities, most likely in early April 2023.

2. How is the number of active users calculated?

This is the million-dollar question. Although the DSA envisages the possibility of the Commission publishing delegated acts to determine the methodology to be used to calculate the AMARs of the service, no one expects these to be ready before the February 17, 2023 deadline and, in fact, we are not aware that they are currently being prepared.

Consequently, the only guidance we have at this time is the text of article 33 of the DSA, its Recital 77, common sense, and references to other areas in which recipients have had to be counted. From the DSA, we can extract the following principles:

• The AMAR must be calculated individually for each of the provider’s services.
• For platforms, “active” recipients means those that actually engage with the service, at least once, by either being exposed to information disseminated on the online interface of the online platform or by providing information themselves. The DSA clearly establishes that the concept of AMAR does not necessarily coincide with that of a registered user, but it is vaguer when it merely states that engagement is not limited to interacting with information (e.g.. clicking on, commenting, linking, sharing, purchasing, or carrying out transactions).
• As regards online search engines, the DSA considers that active recipients are those users who view information on the online interface, but not the owners of the websites indexed by the search engine.
• Only the unique users of the service should be counted, and therefore the way in which they access the service is irrelevant.
• Likewise, providers should not count any incidental use of the service by recipients of other providers of intermediary services, such as through indexing.
• Lastly, if it is technically viable and does not breach data protection regulations, platforms and search engines can discount automated users such as bots or scrapers.

The guidance laid out in Recital (77) of the DSA is useful, but the absence of a specific calculation method introduces a high degree of uncertainty, even among digital services providers themselves, which have to decide, on their own, what the best methodology is, knowing that the European Commission will have the last word. It is not a stretch to think that many of the DSA’s more ambiguous aspects will end up before the Court of Justice of the European Union.

The European Commission has, however, published a Q&A guide to help resolve some of these doubts. The Guidance on the requirement to publish user numbers was released on February 1, 2023.

3. What are the consequences of being designated a “very large” platform or search engine?  

Once the Commission notifies a platform or search engine that it has been designated as “very large”, it will have four months to comply with the obligations laid out in Chapter III, Section 5 of the DSA: Additional obligations for providers of very large online platforms and of very large online search engines to manage systemic risks. A brief overview of these obligations follows:

• Risk assessment: diligently analyze and assess any systemic risks in the Union stemming from the design or functioning of their service, including, for example, the use of artificial intelligence.
• Mitigation of risks: implement reasonable, proportionate and effective risk mitigation measures, tailored to the specific systemic risks identified, with particular consideration for the impacts of such measures on fundamental rights (e.g., privacy, freedom of expression and information, etc.).
• Crisis response mechanism: collaborate with the Commission when crises occur, such as serious threats to public security or public health.
• Independent audit: submit to an independent annual audit to assess compliance with the due diligence obligations set out in the DSA.
• Recommender systems: provide users of its services with at least one option for each of its recommender systems which is not based on profiling.
• Additional online advertising transparency: compile and make publicly available a repository containing information on the advertising content presented.
• Data access and scrutiny: provide the Commission, at its request, with access to data that are necessary to monitor and assess compliance with the DSA.
• Compliance function: designate one or more compliance officers with sufficient authority, stature and resources to monitor the provider’s effective compliance with the DSA.
• Transparency reporting obligations: publish reports on content moderation, including the resources the platform uses in that activity.

In addition, providers of very large online platforms and of very large online search engines must pay the Commission an annual supervisory fee to cover the costs the Commission incurs in relation to its supervisory tasks.