The EU Digital Services Act partially entered into force in late 2022 and all ‘online platforms’ and ‘online search engines’ were required to publish information on average monthly active recipients by 17 February 2023 and every six months thereafter. Technology partners, Michael Madden and Wendy Hederman provide an overview of this somewhat challenging transparency obligation.

The EU Digital Services Act (DSA) partially entered into force in late 2022. The obligations under the DSA apply to most types of services from 17 February 2024, but Article 24(2) required that all ‘online platforms’ and ‘online search engines’ publish information on their average monthly active recipients (AMARs) by 17 February 2023 and every six months thereafter. We provide an overview of this transparency obligation as it applies to online platforms, although many of these observations apply equally to online search engines.

Who?

An online platform is a service that, at the request of a recipient of the service, stores and disseminates information to the public. Examples of online platforms include social networks and online marketplaces. A recipient of these services includes any person or entity that uses the service, in particular, for the purposes of seeking information or making it accessible.

Why?

The purpose of this obligation is to identify ‘very large online platforms’ (VLOPs). VLOPs are online platforms with AMARs of at least 45 million, a figure which roughly corresponds to 10% of the EU population. They are subject to more onerous obligations under the DSA by reason of their greater reach and disproportionate societal impact.

When?

At least once every six months, online platforms are required to publish information on AMARs, calculated as an average over the previous six months. However, below-threshold platforms which are potentially susceptible to exponential growth, e.g. with high annual turnover or market capitalisation, can be required to provide more frequent reporting. Also, regulators can request AMAR information at any time from an online platform, as well as information on the data used and the methodology for its calculation.

Where?

The DSA applies to online platforms established in the EU or, in the absence of such establishment, where the number of recipients of the service in one or more Member States is significant or where the service provider targets activities towards one or more Member States. The obligation to calculate AMARs applies regarding service recipients located in the EU.

How?

How AMARs should be calculated in practice can be a complex question and will depend on the nature of each service and the way recipients interact with it. The overarching objective is to:

• Identify users that actually engage with the service at least once in a given period, and

• Where possible, identify only the number of unique recipients, in that they are counted only once

Difficulty with identifying actual engagement

The concept of actual engagement does not necessarily coincide with that of registered user of a service. Providing information to a service clearly constitutes actual engagement. Actual engagement also includes interacting with information on the service by, for example, clicking on, commenting, linking or sharing information, or carrying out transactions. However, actual engagement is not limited to these categories of interaction. It is also sufficient that recipients are merely exposed to information such as by “viewing or listening” to it.

This potentially casts a wide net and brings some uncertainty to determining who should be counted as an active recipient. In line with the overarching objectives of the DSA and the EU principle of proportionality, any such exposure must presumably be meaningful. However, in the absence of clear guidance on measurement criteria, it has been difficult for many online platforms to determine whether a brief viewing of information by a user should be considered as actual engagement and therefore counted in the platform’s AMAR numbers. With this uncertainty, there is a real risk of online platforms inadvertently over or under-reporting AMARs.

Difficulty with identifying unique recipients

Identifying unique recipients also inevitably presents problems for online platforms. For example, it is often not possible to account for situations where a single user utilises more than one device or interface to access a service in a given period. This is one element that could lead to over-reporting. Also, the DSA allows online platforms to exclude automated users such as bots or scrapers from AMARs, but only where this does not involve further processing of personal data or tracking. However, given the implications of being designated as a VLOP, and the need to avoid inappropriate designation on the basis of poor or inaccurate data, there are clear incentives for online platforms to engage in enhanced tracking of individuals than would otherwise be the case. This is despite the DSA ostensibly discouraging this.

Comment

The European Commission is entitled to issue guidance in the form of a Delegated Act on the methodology for calculating the number of AMARs. However, there is no sign yet if and when it will do this. It has published informal guidance, but this largely merely repeats the wording of the DSA. This situation is far from ideal given the complexities and legal uncertainties associated with this obligation, some of which we note in this article.

Until clearer guidance is available, online platforms should carefully consider and document the data set(s) and methodology used to calculate AMARs, so that they can explain and substantiate this if queried by a regulator. In particular, they should clearly document the reasons for the criteria they applied for including/excluding users from the calculation.

For more information and expert guidance on the likely impact of the DSA and its obligations on your business, contact a member of our Technology team.

The content of this article is provided for information purposes only and does not constitute legal or other advice.