Image credit: Sumsub

To be Presented by Dr Marco Scialdone* at the Perfect Law Conference

The European Union’s Digital Markets Act (Regulation (EU) 2022/1925) and Digital Services Act (Regulation (EU) 2022/2065) represent a significant legislative effort to regulate the digital ecosystem. The DMA primarily targets the concentrated market power of large online platforms designated as “gatekeepers,” aiming to foster fairness and contestability within the markets for “core platform services” through a set of ex ante obligations. Gatekeeper status is presumed for undertakings meeting specific quantitative thresholds, notably an EU turnover exceeding €7.5 billion annually or a market capitalization over €75 billion, coupled with substantial user bases (over 45 million monthly active end-users and 10,000 annual business users in the EU) and evidence of a consolidated, durable position.

Key obligations imposed on gatekeepers by the DMA include strict limitations on combining and cross-using personal data without consent, prohibitions against self-preferencing their own services or products over those of third parties, mandates allowing end-users to install third-party applications (side-loading) and uninstall pre-installed software, obligations to ensure effective data portability, including continuous real-time access, and requirements for interoperability between the gatekeeper’s number-independent interpersonal communication services and those of other providers. These measures address characteristics like lock-in effects and data-driven advantages inherent in core platform services, which encompass online intermediation, search engines, operating systems, social networks, and advertising services, among others.

Complementing the DMA, the DSA establishes a framework for the responsibilities of intermediary service providers, aiming to create a safer, more predictable, and trusted online environment across the EU. Its objectives include safeguarding users’ fundamental rights, combating illegal content and disinformation, enhancing transparency in content moderation and advertising, and harmonizing disparate national rules. The DSA applies broadly to intermediary services offered to recipients within the EU. It employs a tiered system of cumulative obligations based on the service type:

• All Intermediaries: must establish points of contact, appoint legal representatives (if based outside the EU), maintain clear terms and conditions, and publish transparency reports.
• Hosting Services:must implement user-friendly notice-and-action mechanisms for reporting illegal content and provide clear justifications for content removal.
• Online Platforms: face additional duties, including internal complaint-handling systems, access to out-of-court dispute settlement, cooperation with “trusted flaggers,” implementation of “Know Your Business Customer” (KYBC) protocols for marketplaces, transparency regarding advertising (including targeting parameters), and prohibitions on deceptive “dark patterns” and advertising targeting minors or based on sensitive data.
• Very Large Online Platforms (VLOPs) and Search Engines (VLOSEs): platforms exceeding 45 million monthly active EU users face the most rigorous obligations. These include conducting mandatory annual risk assessments (covering systemic risks like illegal content dissemination, fundamental rights impacts, public health concerns), implementing effective risk mitigation measures, undergoing independent audits, enhancing transparency around recommender systems (offering non-profiling options), maintaining public ad repositories, providing data access for scrutiny, establishing an internal compliance function, and cooperating under potential crisis response mechanisms.

Enforcement relies on a combination of public oversight by the European Commission and national authorities (Digital Services Coordinators) and private enforcement actions by affected parties. A cornerstone of private enforcement for consumer protection is the Representative Actions Directive (RAD) (Directive (EU) 2020/1828). Explicit links are established through DMA Article 42 and DSA Article 90, both of which amend Annex I of the RAD to include infringements of the DMA and DSA, respectively. This provides a clear, harmonized pathway for designated Qualified Entities (QEs) to bring representative actions seeking injunctive relief or redress measures (like compensation, repair, or price reduction) on behalf of consumers harmed by violations of either regulation.

Private actions can be “standalone”, initiated directly before national courts without a prior regulatory finding of infringement, or “follow-on”, brought subsequent to a binding infringement decision by a competent authority, which simplifies proving the breach. The RAD mechanism is crucial for overcoming barriers faced by individual consumers, such as high costs and informational asymmetries, by empowering expert QEs to litigate collectively, including in cross-border scenarios vital for the digital single market.

However, a significant limitation persists: the RAD’s scope is confined to the “collective interests of consumers”, defined as natural persons acting outside their professional capacity. This excludes “business users” (e.g., app developers, online sellers) from utilizing the RAD framework for collective redress concerning DMA infringements, despite being primary intended beneficiaries of many DMA obligations. Such business users must rely on individual actions or potentially inconsistent national collective action mechanisms outside the RAD.

Significant practical obstacles remain, including securing adequate funding for resource-intensive collective actions, navigating the legal and technical complexity of digital market litigation (requiring specialized expertise and evidence), managing cross-border litigation challenges (jurisdiction, coordination, enforcement, opt-in requirements), and addressing potential procedural fragmentation due to variations in national RAD implementation (e.g., opt-in/out rules, QE criteria).

The ultimate effectiveness of this comprehensive regulatory framework will depend on vigilant monitoring of RAD implementation, the evolution of case law from both public and private actions and the successful navigation of funding and practical litigation challenges.