EU law compelling tech giants to disclose user data coming online

A new EU law looking to impose stricter online regulation on widely-used platforms and services operated by US-based ‘Big Tech’ comes into effect today, with the aims of protecting online privacies, safeguarding freedom of expression, and leveling the playing field for digital businesses. Among its requirements, the biggest platforms like Facebook and Google will have until February 17 next year to reveal their user numbers.

The Digital Services Act (DSA) was designed to combat online hate speech, disinformation and piracy in Europe, at a time when companies based in the US control much of the internet content seen by EU citizens. Under the new law, all social media platforms, online marketplaces and search engines operating in the EU will be obliged to react more quickly to remove content deemed in breach of EU regulations.

The suite of legislative measures, against which the world’s biggest technology companies had lobbied bitterly, represents the most significant overhaul of the laws governing the mostly US-based Big Tech’s continental Europe operations in more than two decades. EU’s competition commissioner Margrethe Vestager was the key architect of the bloc’s digital reforms, and she believes that the Digital Services Act is “better than the proposal that we tabled” back in 2020. She also proclaimed in a tweet that “Democracy is back.” European Commission President Ursula von der Leyen, meanwhile, called the agreement “historic.”

The rules of the DSA will be fully enforced from February 17, 2024, but officials will need the intervening time to decide which tech giants are big enough to need close observation. This will include measures to limit the use of sensitive private data in targeting ads at European users and will insist on more transparency for the algorithms that suggest content.

But the new rules will come into effect earlier for what Brussels calls Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) — those with more than 45 million active users in the EU. At current user numbers, this definition would hit around 20 firms, including Meta and its social networks Facebook and Instagram; Google and its video platform YouTube; and iPhone-maker Apple’s platforms.

The micro-blogging platform Twitter, recently bought by entrepreneur Elon Musk, will almost certainly also be included, along with Chinese video-sharing platform, TikTok, German retailer Zalando and Dutch hotel site Booking. Any site that could be big enough to make the cut must publish its European user numbers by February 17, 2023 and the DSA regulations will apply to them once the European Commission has confirmed the size of their user-bases.

This implies that, for the giants, the DSA’s rules — stricter for bigger platforms — could come into play in late 2023 rather than in February 2024, when they will apply to all digital platforms. The VLOPs could be fined sums equal to up to 6% of their global revenue or even be banned from the huge EU market in the case of serious, sustained breaches of the rules.

The DSA complements another new EU law, the Digital Markets Act or DMA, which prohibits anti-competitive behavior by the so-called “gatekeepers” of the internet and went into force in November.

EU data law follows landmark US settlement

The EU law going into enforcement comes just days after the most renowned VLOSE, Google, agreed to settle a landmark privacy case with 40 US states over accusations that the search engine giant misled users into believing location tracking had been switched off on their devices.

A statement said it was the largest multi-state privacy settlement by state authorities in US history, and included a binding commitment for improved disclosures by Google. “Digital platforms like Google cannot claim to provide privacy controls to users then turn around and disregard those controls to collect and sell data to advertisers against users’ express wishes — and at great profit,” said New Jersey Attorney General Matthew Platkin in the statement.

The rare joint lawsuit by 40 states grew from impatience over the failure of federal authorities to crack down on big tech amid legislative gridlock in Washington. Republican and Democratic lawmakers disagree on what national rules on online privacy should look like, with furious lobbying by tech companies to limit their potential impact.

Since 2018, the US tech giants have faced strict rules in Europe, with Google, Amazon and others subjected to hefty fines over privacy violations. The US case began after an article in 2018 from the Associated Press reported that Google tracked users even when they had opted out of the practice.

Other states involved included Arkansas, Florida, Illinois, Louisiana, North Carolina, Pennsylvania and Tennessee. Specifically in their case, evidence was shown that users continued to be tracked even after they disabled the location history option on their phones, as tracking continued through a separate ‘Web & App Activity’ setting.

In a statement, Google said that the allegations were based on product features that were no longer up to date. “Consistent with improvements we’ve made in recent years, we have settled this investigation, which was based on outdated product policies that we changed years ago,” the company said.

Under the settlement, Google will provide more detailed information on tracking activity in future.

 

With reporting © Agence France-Presse