Enforcement of the Digital Services Act (DSA) really took off in 2024. This European law should force major online platforms and search engines to be transparent, better protect users and use technology responsibly. With the recent announcement of millions in fines for Apple and Meta for violating the Digital Markets Act (DMA), the DSA's twin brother, the question arises as to what impact the DSA has made after more than a year. A critical look reveals that, despite the good intentions, the practical implementation leaves much to be desired as yet.
Major reasons for this are the vagueness of the rules and the limitations of the mandatory audits required by the DSA. Especially with digital legislation increasingly becoming the focus of the geopolitical power play between the EU and the US - fueled by Donald Trump's re-election - this is a missed opportunity.
Although most Europeans may not realize it, they use digital services covered by the DSA on a daily basis. This is because the law is designed to protect users from harmful or illegal content on search engines and online platforms. Think transparency about algorithms, the ability to complain or object, and the right to know why certain content is removed or recommended.
For the largest platforms, the law goes even further. They must identify and manage so-called "systemic risks" - such as spreading fake news or the risk of addiction. Annually, they must undergo an audit by an independent party to verify compliance. Non-compliance can lead to serious fines. It sounds like a robust package of measures. But in practice, it falters in several ways.
A fundamental problem is that the law is largely process-oriented and uses open standards. For example, platforms themselves must take "appropriate measures" and ensure "transparent" systems. But what exactly that means is hardly elaborated on.
European rules leave the interpretation of those standards largely up to the platforms themselves. This creates the risk that compliance becomes primarily a paper exercise, following the letter of the law - but not the spirit of it. Moreover, the requirements are the same for all platforms, while the risk profile varies enormously. Moderating products on a webshop like Zalando is fundamentally different from filtering political content on a social platform like X or TikTok.
The annual external audit should correct this. But auditors face a difficult task. The lack of clear standards forces them to follow the platforms' interpretation, or give their own interpretation to vague terms such as "timely," "user-friendly" or "reasonable.
In addition, fathoming the complex technology behind large platforms - such as algorithms that are constantly being modified - is a particularly difficult task within the timeframe of an audit. This creates the risk of false assurance: a positive audit does not necessarily say anything about actual compliance, but rather the extent to which a platform can properly document its processes.
The first round of audits in 2024 shows this well. Not a single platform passed the assessment without comments. Interestingly, platforms with a marketplace model scored worse than social media, even though that is precisely where the greatest social risks lie and by far the most incidents occur.
The DSA hits the right topics, but now lacks the clout to really force change. Three adjustments are needed to make the law more effective:
More concrete standards so that it is clear what is expected of platforms - both process and content.
Clear distinction by platform type to apply rules proportionally to risk profile.
More focused oversight through audits, focusing on real risks and incidents rather than documentation and process descriptions.
Especially in today's digital landscape, where European citizens have to deal daily with the choices of a handful of dominant tech companies, it is important that legislation also proves its protective effect in practice.
The DSA is an important step in the regulation of online platforms in Europe. But as it stands, it remains too much about good intentions without hard guarantees. If we want this law to be more than a symbolic tool of power in the geopolitical game between the EU and the US, further development is necessary.
