The Digital Services Act: Adoption, Entry into Force and Application Dates

Short recap: adoption, entry into force & application dates

Before we explain the calculation behind these dates, a short explanation about the differences between the date of adoption, date of entry into force and date of application is needed. The date of adoption is when both co-legislators (European Parliament and European Council) have signed off on a legal text: they accept the result of their political negotiations as a new regulation. However, this version is usually only available in English and can change slightly for legal and linguistic reasons.  

The date of entry into force is next on the timeline and marks the formal legal existence of a legislative act of the European Union. The entry into force takes some period (often 20 days) after the publication of the legal text in the Official Journal of the European Union (OJ). However, the regulation does not apply nor have legal effect purely because it enters into force. But its final version is now known to all parties that might be possibly affected by its application later on.  

Finally, the date of application is the day from which the law has legal effect: all relevant parties can rely upon and enforce the obligations and rights the law creates. The period between entry into force and application is called the “vacatio legis”. All parties affected by the law can use it to prepare for its application date.  

After this terminology refresher, let us explain when the DSA is adopted, enters into force and applies.

Adoption: a done deal at the end of September 2022

The European Parliament adopted the final negotiation text of the DSA on 5 July 2022, just before its summer recess.* The European Council will likely adopt this text in its first Competitiveness Council meeting on 29 September 2022. Looking at a recent press release by Commissioner Breton musing about the DSA’s implementation, adoption by the Council is a done deal. However, the text will not be final: it is only available in English, contains some spelling mistakes, and misses exact dates for entry into force and application. All these matters need to be fixed by the Publications Office of the European Union before the DSA can enter into force.

Entry into force: translation as a bottleneck 

According to Article 93(1), the DSA will enter into force 20 days after its publication in the Official Journal of the European Union. When that publication date is, we simply do not know. The Publications Office of the European Union, responsible for publishing all EU laws, does not want to estimate it. According to the Office’s helpdesk, the time between political adoption and publication depends “on many factors”, one of them being the translation. Thus, we can only estimate the date of entry into force of the DSA.  

The time to translate the co-adopted English text into the 22 other official languages of the European Union can be a possible bottleneck. The DSA contains more than 300 pages of legal text, and the Publications Office must publish all 23 language versions of the DSA simultaneously. Therefore, the time until publication will largely depend on the time the legal linguists of the European Commission need after the Council has adopted the DSA. Translations could add a period between a few days to several months to the date of entry into force.  

We can, however, estimate the entry into force of the DSA. The most positive estimation of entry into force is on 27 October 2022 (29 Sep. + a week + 20 days). It does assume that legal linguists have already been working on translating the text behind the scenes. More conservative estimations – providing the Publications’ Office of the EU with one or two months for translations – lead to entry into force dates on 20 November 2022 (29 Sep. + 1 month + 20 days) or 20 December 2022 (29 Sep. + 2 months + 20 days). All in all, entry into force before Christmas 2022 can be considered a relatively safe bet.

Application: 15 months for all, 0-7 months for VLOPs, directly for the Commission

There are three points in time that are essential regarding the application of the DSA: its general application 15 months after entering into force, in early 2024; its application to VLOPs (4 months after their designation as such, in early 2023), and the application of enforcement powers of the European Commission (directly after entry into force in late 2022). We go on to discuss all three in detail below. 

Application in entirety: 15 months 

The whole of the DSA will be the law of the European Union “15 months after entry into force or on 1 January 2024, whichever is later”. Building on the estimations above, the DSA will apply at the very earliest from 27 January 2024. A more conservative estimate (2 months for translations) leads to 20 March 2024 as its application date. Importantly, at this moment, Member States must have designated a national Digital Services Coordinator to coordinate the national efforts in line with the DSA (at the latest 15 months after entry into force, Article 49). 

Application to VLOPs: 4 months at least 

Especially providers of (very large) online platforms with large amounts of ‘recipients’ in the European Union should not sit back and wait until March 2024. Some provisions of the DSA can apply to these services almost a year earlier, from February 2023 (7 months after entry into force). The articles that apply from entry into force oblige providers of online platforms to publish data about their ‘active recipients’ (Articles 24(2)-(3), within 3 months) and let the Commission designate very large online platforms (Articles 33(4)-(6), 4 months to take effect).  

Article 24: average monthly active recipients 

Article 24(2) of the DSA obliges all providers of an online platform to publish “information on the average monthly active recipients of [its] service in the Union” at the latest three months after entry into force of the DSA and every six months after that. The Commission needs these numbers to determine if a provider meets the threshold of 45 million recipients and will qualify as VLOP. The first deadline to publish this new number lies between the end of January 2023 and March 2023 (three months after entry into force). However, platforms will need time to determine what constitutes an “active recipient”. 

A few articles (Articles 3(I), (m), (p), 24(2)-(3)) and recitals (Recital 77) are relevant for understanding the definition of an “active recipient”. The term seems to capture a user uploading a picture to, for example, a photo-sharing service like Instagram, a person without an account receiving a document through Dropbox or Google Drive, and even a website owner using a traditional hosting service to host its website. An active recipient does not need to be a registered user. But the second paragraph of Recital 77 suggests that those merely exposed to a link to a piece of content do not qualify. The Commission may lay down a methodology to explain to providers how to count their active recipients.  

An exemption to this obligation applies to micro and small enterprises providing an online platform under Article 19(1). Therefore, only companies with more than 50 employees or an annual turnover and/or annual balance sheet larger than 10 million EUR are obliged to publish the number themselves. However, per Article 24(3), the Commission can still request the number of average monthly active recipients from any platform. Presumably, this is to be able to designate start-ups with few employees or little revenue but a large number of recipients as VLOPs, such as Instagram in its infancy.

Article 33(4)-(6): designating VLOPs 

Article 33 allows the European Commission to designate online platforms as very large online platforms (VLOPs) if it has more than 45 million average monthly active recipients. Once a platform is designated as a VLOP, a whole range of extra obligations regarding transparency, risk governance and data access (Articles 34-42) apply. The European Commission can base its designation of a VLOP on one of three data sources. Its choice will determine when the first VLOP will be designated. This date could vary between February 2023 and July 2023, based on the data source used by the Commission for its decision. 

Per Article 33(4), the Commission can base its designation of a VLOP on one of three sources:   

• (A.) data reported by the provider of the online platform according to Article 24(2), or 
• (B.) information requested under Article 24(3), or
• (C.) any other information available to the Commission.
  

Under option A, a provider has three months to report its active recipients. Option B has no set time limit: the Commission requests the number of active recipients and must wait for a response. Lastly, the Commission can base its designation on “any other information” available (option C). Option C could also be the quickest, as information could come from providers’ readily available quarterly earnings reports, shareholder documentation, court filings or information directly acquired from platforms. Such information should, however, pertain to the use of the service within the European Union, and many candidates for VLOP-status only report on their worldwide user numbers. 

Depending on the option chosen by the Commission, online platforms like Facebook or TikTok could get a notification of their designation as VLOPs already the moment the DSA enters into force (option C) or as late as Jan.-Mar. 2023 (option A). The whole of the DSA would then apply to them four months later: between February and July 2023. 

Article 64 – 88: powers and obligations for the European Commission 

On the date of entry into force of the DSA, the European Commission immediately garners several powers and two obligations regarding the enforcement and implementation of the regulation. These powers include, among other things, the ability to request information, take interviews, conduct inspections, impose interim measures and issue fines (Articles 67 – 74). Regarding obligations, the Commission must provide the parties it investigates with a right to be heard (Article 79) and publicise its decisions (Article 80). 

Additionally, the Commission can start adopting implementing (Article 83) and delegating acts (Article 87). Thereby it can further specify procedures under the DSA mostly applicable to VLOPs, such as: the procedures for independent audits (Article 37(7)); the technical conditions for data access and scrutiny (Article 40(13)) and the supervisory fees to be paid (Article 43). These powers and obligations of the Commission will already apply later this fall. 

Highlights: what to expect when? 

This blog post shows that the adoption, entry into force and application of the DSA are rapidly approaching. Member States have until the start of 2024 to sort out who will be their Digital Services Coordinators and how they will enforce the DSA. Providers of online platforms must hurry to calculate and publish their “active recipients” at the start of 2023 and, if they have many, comply with the DSA’s extra obligations for VLOPs from the spring or summer of 2023. Finally, the Commission will be the most rushed: to hire staff, clarify procedures, designate VLOPs (fall or winter 2022) and start its first enforcement cases in spring or summer 2023.  

 

*This blog uses the Article and Recital numbers from the Corrigendum of 7 September 2022 to the EP-adopted version of the DSA on 5 July 2022. Most likely, the new order and numbers of articles and recitals will prevail in the final version of the DSA that enters into force.