EU’s first DSA designations cover 19 services

The European Commission designated 19 services on 25 April for the Digital Services Act’s first large-platform obligations: 17 online platforms and two search engines. The list reaches beyond social networks into shopping, app stores, maps and Wikipedia.

Photo: European flags. © Håkan Dahlström, Spain, 2010 (CC BY 2.0, via Wikimedia Commons). Resized and cropped. Historical EU illustration, not the announcement.

The platforms are AliExpress, Amazon Store, Apple AppStore, Booking.com, Facebook, Google Play, Google Maps, Google Shopping, Instagram, LinkedIn, Pinterest, Snapchat, TikTok, Twitter, Wikipedia, YouTube and Zalando. Bing and Google Search are the two search engines.

Which clock starts now?

Under Articles 33 and 92, the four-month compliance period runs from notification to each provider. The general application date remains 17 February 2024. Today’s decisions identify services for earlier application; the regulation is already in force.

Audience means more than account holders

The threshold is at least 45 million average monthly active recipients in the EU, together with Commission designation.

The Commission’s counting guidance makes that audience broader than a platform’s registered customers. A shopper who looks at listings without buying counts. So does someone exposed to content while logged out. Traders and advertisers can count too, rather than only consumers.

Providers calculate a monthly average across the preceding six months. They should avoid counting the same recipient twice across devices or interfaces where possible, but the guidance says this obligation neither requires nor permits profiling and tracking people to eliminate duplicates. Identifiable bots and scrapers may be discounted.

For a marketplace, sales totals or membership numbers therefore can’t stand in for the relevant audience. Exposure matters before a purchase, and the legal counting exercise doesn’t create a new permission to monitor visitors.

The Commission says designated services must assess systemic risks, including effects on minors and freedom of expression, and submit their first assessment within four months of notification. Risk management and compliance also face independent external audits.

Changes users can inspect

Article 38 requires an option without profiling for each recommender system a designated service uses. It doesn’t prescribe a chronological feed.

Article 39 requires designated services that display ads to keep a searchable public repository, with API access, while an ad runs and for a year after its last display. Records identify the advertiser, a different payer if applicable, targeting parameters and aggregate reach, without recipients’ personal data.

If an ad is removed as illegal or against platform rules, the repository substitutes removal information for its content and sponsor details. The disclosure changes rather than disappears.