The use of digital services in the EU has increased remarkably over the years, with more than 90 percent of EU households having access to the Internet last year¹. While digital services can improve living standards for their users, if not regulated they also entail some risks. In order to minimize such risks, such as, for instance, disinformation and dissemination of illegal contents, the European Commission proposed the Digital Services Act (DSA).

A. What is the DSA

The DSA is aimed at ensuring a safe, predictable and trustworthy online environment by imposing certain obligations on intermediary services providers (i.e. i) “mere conduit,” ii) “caching” and ii) “hosting” service providers). The ultimate purpose of the DSA is to ensure that intermediary service providers carry out proper content moderation. Lawmakers understand that government authorities cannot fully supervise the digital environment, yet each relevant stakeholder is required to actively intervene.

Furthermore, the DSA completes the Digital Markets Act (DMA)’s framework in relation to the digital advertising (together they are known as the Digital Services Package). Both DSA and DMA introduce limitations and obligations on the big platforms that process personal data, with significant impacts on current digital advertising practices. We discussed the key issues related to DMA in our article “The DMA, data monetization and digital advertising: three reasons to care”.

B. Key issues to consider when using digital advertising

In addition to the obligations related to content moderation, more detailed obligations are now introduced by the DSA to govern digital advertising.

I. Bans on targeting minors

The DSA is intended to address one of the most discussed topics connected to digital advertising—the prohibition on targeting minors. Article 24b prevents targeted advertising when “[providers of online platforms] are aware with reasonable certainty that the recipient of the service is a minor”. In order to verify a user’s age, the DSA suggests that no additional personal data should be processed: While such approach is in line with the GDPR principle of minimization, it remains to be clarified how to practically comply with such obligations. Certain clarifications may be inferred from Article 8 of the GDPR, which prohibits the processing of minors’ data, based on their consent, if a service is “offered directly to a child” in relation to the offer of information society services. It can be argued that when the service is “offered directly to a child” (i.e. services intended for minors or implicitly addressed to them, in the opinion of the EDPB, relating to the application of Article 8 GDPR), the platform should be considered as “aware with reasonable certainty” that a user is a minor and, accordingly, no additional information is required and the whole service should be devised as if all users are minors.

That said, some commentators construed the DSA and GDPR provisions as jointly implying that, if the service does not address minors, no specific age verification systems can be effectively in place, as providers of online platforms may end up in not collecting additional data to verify the age of the user, in an attempt to strictly comply with the GDPR principle of minimization.

Further clarifications on this point are undoubtedly expected from the EDPB and the local supervisory authorities.

II. Obligations in serving targeted advertising

DSA has introduced significant obligations on online platforms providers which offer advertising on their interfaces. In particular, the DSA requires that on each advertisement the following information is displayed in real time. More in particular, it is required to:

• clarify that the information presented is an advertisement (e.g. use of prominent markings);
• inform on which is the (natural or legal) person on whose behalf the advertisement is presented;
• indicate who paid for the advertisement (if not corresponding to the one mentioned above);
• provide meaningful information about the main parameters used to determine the recipients to whom the advertisement is presented (e.g. depending on whether the advertisement is contextual or another type) and, where applicable, about how to change such parameters.

The above obligations, intended to enforce transparency, impose a significant burden for all platforms. Furthermore, it is required to identify the “chain” behind the display of a specific advertisement as well as to disclose the underlying criteria that lead to a specific profiling. The ultimate purpose of the DSA is, in fact, to ensure that the users are fully aware that they have been “targeted”, i.e. that the advertisement is intended to be more effective as it is specifically addressed to them.

Although it is not possible to fully determine the consequences of above mentioned obligations, there will likely be a disruptive effect for the online advertising market. For instance, it is expected a re-shaping of the so-called RTB advertising chain (“real-time bidding”, which allows buying and selling ads in real time through an instant auction).

III. Obligations in keeping “repositories of advertisements”

The DSA also sets out an obligation for providers of online platforms to keep ad repositories, clarifying:

… the name of the product service or brand and the object of the advertisement, and related data on the advertiser and, if different, the natural or legal person who paid for the advertisement, and the delivery of the advertisement, in particular when targeted advertising is concerned […] information about targeting criteria and delivery criteria, in particular when advertisements are delivered to persons in vulnerable situations, such as minors.

This obligation is aimed at ensuring proper oversight of the companies that determine the content of the targeted advertisement, with the aim, once again, of achieving greater transparency.

C. Conclusions

Whether the DSA will achieve the objective of making Internet a safer and more trustworthy place, is yet to be determined.

That said, there are little doubts about a significant impact over the advertising industry. While we are waiting for additional guidelines from the authorities that will have to enforce the new legal framework, all key stakeholders will need to start re-shaping their strategies now.

We will be pleased to assist and further discuss about how to prepare for the new obligations. Don’t hesitate to get in touch!

1. Digital economy and society statistics - households and individuals - Statistics Explained (europa.eu)