Europe’s Digital Services Act

The European Union’s Digital Services Act (DSA) came into force in November 2022, & will be fully applicable for all entities from 17 February 2024.

However, before the date of enforcement, the work has begun in earnest within the European Commission (EC) to interpret, clarify and implementate what the legislation means to businesses in practical terms.

Although the Act focuses on search engines, online businesses and content providers, it goes without saying that the DSA will have an effect on the wider ad tech industry which has a symbiotic relationship with all of the above.

The DSA’s aims complement the measures in the Digital Markets Act, which tackles the economic concerns over the very large online platforms’ (gatekeepers) advertising models.

Background

The DSA’s main goal is to create a safe and trustworthy online environment, and to protect the digital space against the spread of illegal content, online disinformation, and other societal risks.

When adopting the DSA in July 2022, the EU Parliament praised it as “strong, ambitious regulation of online platforms” enabling “the protection of users’ rights online”.

The DSA will apply to four categories of services that each build on one another.  The obligations of each category match their role, size and impact in the online ecosystem.

“Intermediary services” (IS) are services that transport, cache, or store third-party information.  This includes Adtech intermediaries.
“Hosting services” (HS) are intermediary services that store third-party information.
“Online platforms” (OP) are hosting services that also disseminate the stored third-party information.
“Very large online platforms” (VLOP) are online platforms with more than 45 million registered users in the EU that have been given the designation by the European Commission.

The DSA provides specific content moderation, advertising, interface design, and reporting obligations for all four categories of services, and the intensity of regulation increases from intermediary services to very large online platforms.

Even though Adtech Intermediaries are not explicitly bound by the terms of the DSA, because they hold the information online platforms will need to make DSA-required disclosures, intermediaries will likely be expected - and potentially contractually bound - to collect and deliver information to the platforms.

How does the DSA aim to regulate online advertising?

The DSA complements existing ePrivacy Directive & the General Data Protection Regulation, which already establishes rules on users' consent or their right to object to targeted digital marketing.

The DSA introduces two new restrictions concerning targeted advertising on online platforms:

• The targeting of minors will be banned. While the European Parliament did not want to implement a total ban on the use of personal data for targeted advertising, they are set on banning the profiling of minors for advertising purposes.
• The use of sensitive data will also be banned. There will also be more rigid protections for all users’ personal data. Therefore, there cannot be any ad targeting based on special categories of sensitive data as outlined in the GDPR. Sensitive data includes racial or ethnic group origins, political opinions, religious or philosophical beliefs, health, and sexual orientation.

More transparency will be required.

• There must be greater transparency concerning who is placing ads and which criteria were used to target the users.  Providers of all online platforms will be required to prove where their information came from. They will also need to showcase their targeting methods used for presenting ads.  Very Large Online Platforms will have additional transparency requirements, including a mandate to maintain a public library of ads they’ve delivered.
• Dark patterns will also be banned. Dark patterns refer to the manipulation methods to cause people to do things they wouldn’t otherwise do. Therefore, any providers of intermediary services online are prohibited from deceiving users from the initial point of the autonomy they have in decision making.

Why should intermediaries care?

While this new legislation is in favour of fairness for businesses of all kinds, its stricter privacy and transparency regulations will affect how publishers and Adtech intermediaries conduct their business.  It will affect business models and technical processes.

The greater transparency throughout the advertising process means that the buy-side will now have to disclose how they collect user data and the algorithms they use, which can be considered trade sensitive information.

The IAB EU wants to standardise a technical approach for intermediaries, and help ensure a consistent, low-friction experience for companies and consumers alike.  They are working with its membership to ensure that the industry has a coordinated response to the European Commission on the practical implications.

For instance, they will ensure that all parties have the signals needed to properly facilitate display to users.