The Digital Services Act: Adoption, Entry into Force and Application Dates
By Pim ten Thije, Researcher at the DSA Observatory.
Almost 18 months after the proposal was first published, the European Parliament officially adopted the Digital Services Act (DSA) at the start of July 2022. On 29 September 2022, the Council of the European Union will most likely adopt the new rules. But, when will the new far-reaching obligations apply to (very large) online platforms, when will national regulators be required to be in place, when will the European Commission assume its new regulatory powers, and when exactly will the DSA be the law of the European Union? For all those lost in the weeds of adoption, entry into force and (partial) application dates, the DSA Observatory recaps their meaning and gives estimations for the dates applicable to the DSA.
In summary: the EU co-legislators will have adopted the DSA on 29 September 2022. As such, the DSA enters into force at the very earliest on 27 October 2022, but more likely, just before Christmas 2022 (20 December 2022). Application of the rules to all parties is at the beginning of 2024 (15 months later). However, for very large online platforms (VLOPs) and the European Commission, the application date can already be between spring and the summer of 2023, a full year earlier. All online platforms that are not micro or small enterprises will have to start reporting their average monthly user count already 3 months after entering into force. And in principle, the European Commission can start using its enforcement powers between the end of October and Christmas 2022.
In the table below, you will find all the important dates regarding the DSA. This blog post further explains the meaning of these dates, their differences and how they are estimated.
|Event||Relative timeline||(estimated) date|
|Adoption of the DSA by the European Parliament||–||5 July 2022|
|Adoption of the DSA by the Council of the EU (COMPET)||Starting point||29 September 2022|
|Publication in the Official Journal of the European Union||Adoption date + 1 week to 2 months||7 October 2022 – 30 November 2022|
|Entry into force date||Publication date + 20 days||27 October 2022 – 20 December 2022|
|Application of the whole DSA to all online platforms||Entry into force date + 15 months||27 January 2024 – 20 March 2024|
|Final date to publish the number of average monthly active recipients for online platforms||Entry into force date + 3 months||27 January 2023 – 20 March 2023|
|Application of the whole DSA to providers of online platforms designated as VLOPs||Entry into force date + 10 days notification time + 4 months designation time, OR:
Entry into force date + max. 3 months data gathering + 4 months designation time
|9 March 2023 – 30 April 2023, OR:
2 February 2023 – 20 July 2023
Short recap: adoption, entry into force & application dates
Before we explain the calculation behind these dates, a short explanation about the differences between the date of adoption, date of entry into force and date of application is needed. The date of adoption is when both co-legislators (European Parliament and European Council) have signed off on a legal text: they accept the result of their political negotiations as a new regulation. However, this version is usually only available in English and can change slightly for legal and linguistic reasons.
The date of entry into force is next on the timeline and marks the formal legal existence of a legislative act of the European Union. The entry into force takes some period (often 20 days) after the publication of the legal text in the Official Journal of the European Union (OJ). However, the regulation does not apply nor have legal effect purely because it enters into force. But its final version is now known to all parties that might be possibly affected by its application later on.
Finally, the date of application is the day from which the law has legal effect: all relevant parties can rely upon and enforce the obligations and rights the law creates. The period between entry into force and application is called the “vacatio legis”. All parties affected by the law can use it to prepare for its application date.
After this terminology refresher, let us explain when the DSA is adopted, enters into force and applies.
Adoption: a done deal at the end of September 2022
The European Parliament adopted the final negotiation text of the DSA on 5 July 2022, just before its summer recess.* The European Council will likely adopt this text in its first Competitiveness Council meeting on 29 September 2022. Looking at a recent press release by Commissioner Breton musing about the DSA’s implementation, adoption by the Council is a done deal. However, the text will not be final: it is only available in English, contains some spelling mistakes, and misses exact dates for entry into force and application. All these matters need to be fixed by the Publications Office of the European Union before the DSA can enter into force.
Entry into force: translation as a bottleneck
According to Article 93(1), the DSA will enter into force 20 days after its publication in the Official Journal of the European Union. When that publication date is, we simply do not know. The Publications Office of the European Union, responsible for publishing all EU laws, does not want to estimate it. According to the Office’s helpdesk, the time between political adoption and publication depends “on many factors”, one of them being the translation. Thus, we can only estimate the date of entry into force of the DSA.
The time to translate the co-adopted English text into the 22 other official languages of the European Union can be a possible bottleneck. The DSA contains more than 300 pages of legal text, and the Publications Office must publish all 23 language versions of the DSA simultaneously. Therefore, the time until publication will largely depend on the time the legal linguists of the European Commission need after the Council has adopted the DSA. Translations could add a period between a few days to several months to the date of entry into force.
We can, however, estimate the entry into force of the DSA. The most positive estimation of entry into force is on 27 October 2022 (29 Sep. + a week + 20 days). It does assume that legal linguists have already been working on translating the text behind the scenes. More conservative estimations – providing the Publications’ Office of the EU with one or two months for translations – lead to entry into force dates on 20 November 2022 (29 Sep. + 1 month + 20 days) or 20 December 2022 (29 Sep. + 2 months + 20 days). All in all, entry into force before Christmas 2022 can be considered a relatively safe bet.
Application: 15 months for all, 0-7 months for VLOPs, directly for the Commission
There are three points in time that are essential regarding the application of the DSA: its general application 15 months after entering into force, in early 2024; its application to VLOPs (4 months after their designation as such, in early 2023), and the application of enforcement powers of the European Commission (directly after entry into force in late 2022). We go on to discuss all three in detail below.
Application in entirety: 15 months
The whole of the DSA will be the law of the European Union “15 months after entry into force or on 1 January 2024, whichever is later”. Building on the estimations above, the DSA will apply at the very earliest from 27 January 2024. A more conservative estimate (2 months for translations) leads to 20 March 2024 as its application date. Importantly, at this moment, Member States must have designated a national Digital Services Coordinator to coordinate the national efforts in line with the DSA (at the latest 15 months after entry into force, Article 49).
Application to VLOPs: 4 months at least
Especially providers of (very large) online platforms with large amounts of ‘recipients’ in the European Union should not sit back and wait until March 2024. Some provisions of the DSA can apply to these services almost a year earlier, from February 2023 (7 months after entry into force). The articles that apply from entry into force oblige providers of online platforms to publish data about their ‘active recipients’ (Articles 24(2)-(3), within 3 months) and let the Commission designate very large online platforms (Articles 33(4)-(6), 4 months to take effect).
Article 24: average monthly active recipients
Article 24(2) of the DSA obliges all providers of an online platform to publish “information on the average monthly active recipients of [its] service in the Union” at the latest three months after entry into force of the DSA and every six months after that. The Commission needs these numbers to determine if a provider meets the threshold of 45 million recipients and will qualify as VLOP. The first deadline to publish this new number lies between the end of January 2023 and March 2023 (three months after entry into force). However, platforms will need time to determine what constitutes an “active recipient”.
A few articles (Articles 3(I), (m), (p), 24(2)-(3)) and recitals (Recital 77) are relevant for understanding the definition of an “active recipient”. The term seems to capture a user uploading a picture to, for example, a photo-sharing service like Instagram, a person without an account receiving a document through Dropbox or Google Drive, and even a website owner using a traditional hosting service to host its website. An active recipient does not need to be a registered user. But the second paragraph of Recital 77 suggests that those merely exposed to a link to a piece of content do not qualify. The Commission may lay down a methodology to explain to providers how to count their active recipients.
An exemption to this obligation applies to micro and small enterprises providing an online platform under Article 19(1). Therefore, only companies with more than 50 employees or an annual turnover and/or annual balance sheet larger than 10 million EUR are obliged to publish the number themselves. However, per Article 24(3), the Commission can still request the number of average monthly active recipients from any platform. Presumably, this is to be able to designate start-ups with few employees or little revenue but a large number of recipients as VLOPs, such as Instagram in its infancy.
Article 33(4)-(6): designating VLOPs
Article 33 allows the European Commission to designate online platforms as very large online platforms (VLOPs) if it has more than 45 million average monthly active recipients. Once a platform is designated as a VLOP, a whole range of extra obligations regarding transparency, risk governance and data access (Articles 34-42) apply. The European Commission can base its designation of a VLOP on one of three data sources. Its choice will determine when the first VLOP will be designated. This date could vary between February 2023 and July 2023, based on the data source used by the Commission for its decision.
Per Article 33(4), the Commission can base its designation of a VLOP on one of three sources:
- (A.) data reported by the provider of the online platform according to Article 24(2), or
- (B.) information requested under Article 24(3), or
- (C.) any other information available to the Commission.
Under option A, a provider has three months to report its active recipients. Option B has no set time limit: the Commission requests the number of active recipients and must wait for a response. Lastly, the Commission can base its designation on “any other information” available (option C). Option C could also be the quickest, as information could come from providers’ readily available quarterly earnings reports, shareholder documentation, court filings or information directly acquired from platforms. Such information should, however, pertain to the use of the service within the European Union, and many candidates for VLOP-status only report on their worldwide user numbers.
Depending on the option chosen by the Commission, online platforms like Facebook or TikTok could get a notification of their designation as VLOPs already the moment the DSA enters into force (option C) or as late as Jan.-Mar. 2023 (option A). The whole of the DSA would then apply to them four months later: between February and July 2023.
Article 64 – 88: powers and obligations for the European Commission
On the date of entry into force of the DSA, the European Commission immediately garners several powers and two obligations regarding the enforcement and implementation of the regulation. These powers include, among other things, the ability to request information, take interviews, conduct inspections, impose interim measures and issue fines (Articles 67 – 74). Regarding obligations, the Commission must provide the parties it investigates with a right to be heard (Article 79) and publicise its decisions (Article 80).
Additionally, the Commission can start adopting implementing (Article 83) and delegating acts (Article 87). Thereby it can further specify procedures under the DSA mostly applicable to VLOPs, such as: the procedures for independent audits (Article 37(7)); the technical conditions for data access and scrutiny (Article 40(13)) and the supervisory fees to be paid (Article 43). These powers and obligations of the Commission will already apply later this fall.
Highlights: what to expect when?
This blog post shows that the adoption, entry into force and application of the DSA are rapidly approaching. Member States have until the start of 2024 to sort out who will be their Digital Services Coordinators and how they will enforce the DSA. Providers of online platforms must hurry to calculate and publish their “active recipients” at the start of 2023 and, if they have many, comply with the DSA’s extra obligations for VLOPs from the spring or summer of 2023. Finally, the Commission will be the most rushed: to hire staff, clarify procedures, designate VLOPs (fall or winter 2022) and start its first enforcement cases in spring or summer 2023.
*This blog uses the Article and Recital numbers from the Corrigendum of 7 September 2022 to the EP-adopted version of the DSA on 5 July 2022. Most likely, the new order and numbers of articles and recitals will prevail in the final version of the DSA that enters into force.