The European Parliament has voted by overwhelming margins to adopt two bills, the Digital Services Act (DSA) and the Digital Markets Act (DMA), that will subject online platforms and “gatekeeper” tech firms to extensive new requirements that may require major changes in how US tech giants do business.
The European Union’s legislature passed the DSA by a 539-to-54 margin, with 30 abstentions, and approved the DMA in an even more lopsided vote: 588 yays, 11 nays, and 31 abstentions.
The sprawling text (PDF) of the Digital Services Act covers social platforms, online marketplaces, and search engines. It sets up a “notice and action” regime that requires the swift removal of illegal content as reported by users while requiring greater transparency by covered companies about their enforcement. Other transparency rules cover targeted advertising and recommendation algorithms, including a requirement that platforms provide one “recommender system” not based on personal profiling.
The DSA further requires online markets—referred to as “platforms allowing consumers to conclude distance contracts with traders,” but which you may think of more concisely as “Amazon”—to verify their sellers’ identities and make random checks for illegal goods or services being offered.
This law adds extra compliance requirements to “very large” online platforms, defined as those reaching more than 10% of the EU’s population (so 45 million or more monthly active users), a bit like how banking regulators have treated the largest financial institutions since the 2007-2008 financial crisis. They must regularly assess and mitigate the systemic risks of their services, including “any actual or foreseeable negative effects on civic discourse and electoral processes.
In the bargain, the DSA bans all targeted advertising of minors and prohibits “dark patterns,” or misleading interfaces that try to trick users into making choices against their own interests.
The less-lengthy text (PDF) of the Digital Markets Act, meanwhile, amounts to a legal battering ram aimed at sufficiently large “gatekeeper” companies that provide such core functions as operating systems, social networking, online messaging, web search, app stores, and online ads. It covers firms with at least 45 million monthly active users and either €7.5 billion in EU-wide revenue over the previous three years or a market cap of at least €75 billion.
The DMA bans covered gatekeepers from engaging in such self-preferencing conduct as requiring developers to use their own payment mechanisms (a profit-padding tactic at both Apple and Google); locking users into their own app stores; not allowing a choice of browsers, search engines, and personal assistants; blocking the interoperability of messaging apps; and using data collected from users of these core services for advertising.
The DMA promises to make the smartphone experience in the EU enormously different, something Apple has denounced for threatening the privacy of its users, although the DMA’s text allows gatekeepers to impose their own security measures on alternative app-download mechanisms.
Both the DSA and the DMA follow the template of the EU’s General Data Protection Regulation in imposing sweeping and detailed rules on tech firms, with equally outsized fines possible for those found guilty of violating them. The former allows fines of up to 6% of a covered company’s global income in the previous financial year, while the latter permits penalties of up to 10% of a gatekeeper firm’s global income in the previous financial year, with possible fines of up to 20% of global income for repeat offenders.
And like the GDPR, these bills have yet to be matched in the US by the passage of any comparable legislation, despite a similar level of concern here over the power of the largest technology companies.