Reprise POV: EU’s Digital Services Act marks increased privacy regulations for Online Platforms and Ad Land.

The world’s biggest online platforms and search engines have until January 1 2024 to comply with the EU’s ambitious and wide-ranging Digital Services Act (DSA), with direct implications for the UK’s advertising industry.

The DSA regulatory aims are largely three-fold: To make advertising more transparent, to create safer digital spaces where the fundamental rights of all users are protected, and to ensure a level playing field to foster innovation, growth, and competitiveness.

As with any extensive and actionable regulatory framework, there’s often initial market confusion around how to interpret the incoming rules and ensure compliance – but Reprise has you covered.

In this POV article, we will take a closer look at the DSA framework, the resulting implications for brands and advertisers, plus our recommendations and next steps to help you navigate the coming changes.

What is the DSA and why is it important?

Originally introduced by the European Commission, the DSA aims to give EU citizens more online protection, delivering safer environments for web and app users by creating new regulatory rules for online content, marketplaces and advertising.

For digital platforms offering online content, goods and services, this means the incoming DSA regulations will drive increased accountability with an agreed set of rules and harsher enforcement penalties, including financial sanctions of up to 6% of a company’s global turnover or even banning EU operations in the event of the most serious breaches.The DSA is another clear signal of the European Commission’s determination to drive greater accountability and challenge the power of Big Tech.

In 2022, Ursula von der Leyen, President of the European Commission, said: “What is illegal offline should be illegal online: the greater the size, the greater the responsibility of online platforms”. Meanwhile, in the press release announcing the changes, Commissioner for the Internal Market, Thierry Breton, noted the DSA marks the end of an era where large platforms have behaved as though “they are too big to care”.

The DSA essentials – the who, what and when

Among the DSA’s key provisions are restrictions and requirements related to content moderation and recommendation, personal information, targeted advertising and transparency. These requirements will apply to online intermediaries offering services in the EU.

“Intermediary Services” are grouped into four specific categories:

• Organizations offering network infrastructure (e.g. internet access providers, domain name registrars)
• Hosting services (e.g. cloud and webhosting services)
• Online platforms (e.g. online marketplaces, app stores, collaborative economy platforms and social media platforms)
• Very large online platforms (VLOPs), which reach more than 45 million consumers in Europe.

For advertisers, it’s worth noting that the DSA includes restrictions and transparency requirements related to the platforms’ processing of personal information for targeted advertising – all of which is expected to impact operations and create additional considerations for the brands that advertise on them.

Some DSA rules have applied since November 2022, but the regulation comes into full force across the EU from January 1 2024 and will have a direct impact on the UK.

Coming into effect for the biggest online platforms and search engines first, the incoming DSA means many are already taking action to comply. These businesses are defined as Very Large Online Platforms (VLOP) and Very Large Online Search Engines (VLSE) and any online platforms with over 45 million monthly active EU users qualifies for these categories.

The European Commission announced there will be 17 VLOPs and two VLSEs in February 2023, including Facebook, Instagram, Amazon, Apple AppStore, YouTube, Twitter, TikTok and various Google services.

A full list of VLOPs and VLSEs can be found here, along with the timescale for completion here.

Key points advertisers should be aware of

The roll out of the DSA will further enhance the controls and restrictions around advertising activity and content – much of which is already in effect on the largest platforms – and it’s worth exploring the most impactful changes in more detail:

• Ad targeting using sensitive data is completely banned. Despite this having already been a GDPR requirement, DSA will tighten controls. Online platforms are prohibited from targeting people with advertising using special category (sensitive) personal data. As defined by the GDPR, this includes data relating to health, race, ethnicity, biometrics, sexual orientation, sexual behaviour, political beliefs, religious faith or trade union membership.
• Profiling and targeting children is illegal. Protecting children is integral to the DSA. Platforms must continue to improve their systems to guarantee the privacy, security, and safety of minors. Online platforms are banned from creating profiles of children for ad targeting. This means that age targeting (under 18) will be heavily impacted on online platforms, and impossible to do in most platforms.
• Platforms must be 100% transparent on ads and algorithms. Anyone who sees an online ad will have the right to find out how and why they have been targeted. Some online ads (like standard display) already have this functionality, once again, DSA will tighten the rules to further enforce this on the biggest online platforms. The DSA rules mean that platforms must give consumers more rights and controls over the ads they see:
  • Ads must be clearly labelled so users can identify ads from content
  • VLOPs and VLSEs must keep a repository of every online ad served on their platforms
  • Records must document who paid for an ad, how it was targeted and what data was collected
  • Platforms also must be transparent about their recommendation systems and algorithms
  • Users must be given details on why they have received recommendations by a platform
  • Tougher rules on toxic content. Despite this already being available, the DSA will further enforce social media platforms to provide users with tools to quickly flag illegal content. Users will have new rights entitling them to be told why content moderation decisions have been made by the platform. Citizens will be able to notify any illegal content that they encounter, and contest decisions made by platforms when content is removed.

What are the resulting implications for advertisers?

Specifically for online retailers, the DSA is more focused on marketplaces like Amazon, which hosts third party sellers, rather than brands selling their own products through a dedicated platform – hence, the measures on verifying third parties and obliging platforms to know more about the sellers they host.
If brand ecommerce sites are already adhering to GDPR rules, they should not take further measures as long as they are not hosting third parties.

• Brands marketing to children cannot profile kids. Minors’ data is already classed as highly sensitive by GDPR but the DSA goes further. Clients in relevant categories cannot target ads to children (under 18) based on personal information, regardless of whether explicit consent has been given by the child or parent. The restrictions around kids’ data are already tight but the DSA draws an even clearer line: there is zero scope for lawfully using children’s data to target them with ads.
• Restrictions are tightened for healthcare & pharma clients. Healthcare and pharma clients already face GDPR restrictions on sensitive data processing but the DSA brings greater certainty. Any healthcare or pharma clients targeting people with a medical condition, such as diabetes sufferers, cannot use personal health data even if the data subject has given their explicit consent. EU publishers of health websites and apps face the same restrictions and cannot collect users’ personal medical data to serve targeted ads.
• Ad transparency requirements may push up opt-out rates. The DSA will make it easier for consumers to discover how they have been targeted by an online ad. Extra transparency may increase the proportion of users of VLOPs and VLSEs who opt out from sharing personal data and being tracked online. The data ‘signal loss’ already caused by third-party cookie deprecation, App Tracking Transparency and increasing privacy awareness could accelerate if consumers take more action to avoid being tracked and targeted.
• Platforms may pass on increased costs to agencies & brands. Platforms may attempt to pass some new obligations on to agencies and advertisers by changing their access agreements. Some clients may pass any obligations with online platforms and search engines onto their agency to administer on their behalf.
• Agency teams should closely monitor Amazon trends. The DSA rules on exposing recommendation systems to scrutiny may impact Amazon more than any other big platform, depending on how consumer behaviour changes.

Reprise recommendations and next steps

As with any incoming framework, it is difficult to forecast the extent of the impact the DSA will have across media. Much will depend on how the large platforms decide to respond and interpret the DSA regulation into how they operate.

We anticipate that media partners will have different approaches to how they comply with DSA regulations. The clarity of enforcement will only emerge as the regulation is fully implemented and platforms develop their strategies.

While the DSA primarily applies to platforms, we will be supporting our clients by taking the following steps:

1. Stay informed and engaged:
   o We will be staying close to our platform and publisher partners to continue to understand their responses and interpretation of DSA – ensuring we give our clients the most up to date information as it becomes available.
2. Assess audience targeting:
   o We will evaluate all audience targeting across all campaigns and media plans to identify any anomalies that may conflict with DSA requirements. We will be considering the perspective of the consumer in light of transparency requirements such as “why am I seeing this ad” or similar enquiries.
3. Prepare for compliance:
   o We will gather necessary platform compliance requirements to be ready to make any necessary changes to our planning and activation on platforms.
4. Evaluation of partner approaches:
   o We will continue to reflect on the transparency and choice offered by our media partners, particularly in anticipation of the withdrawal of the use of third-party cookies, and its impact on our ability to target the intended audience.
   o We will assess the suitability and balance between scale (reaching a large audience) and transparency / choice for users.

With these actionable steps, Reprise is in the prime position to proactively adapt and navigate the DSA’s impact and its implications for our client’s media activities.

If you’d like to discuss the actions you need to take to prepare for the DSA roll out, please contact london@reprisedigital.com