Earlier this week the Digital Services Act and the Digital Markets Act were both passed by the European Parliament, finally guaranteeing that both acts will come into force across the Union.
These two acts will soon be adopted by the European Council (July for the DMA, September for the DSA), and come into force 20 days after publication. The DSA will then apply from the 1st January 2024 or 15 months after it comes into force (whichever comes later). Meanwhile the DMA will apply six months after coming into force.
The two pieces of legislation, which are designed to create a more level playing field and a better experience for European users on the internet, will have big implications for digital advertising. But due to the nature of the legislative process, whereby articles are tweaked, added in, and scrapped during a lengthy process of negotiations between small committees and large trialogue debates, has made it hard to know exactly what the impact would be.
Now that we have the final text and it’s been passed by Parliament, we can say with much more certainty what the laws set out to do. Here are the major direct implications for the digital advertising industry.
Targeting of minors will be banned
The possibility arose earlier in the legislative process of a total ban on use of personal data in targeted advertising – which would have neutered a big part of the ad tech industry in Europe.
Such a clause never made it through the committee stage. But a proposal to ban the profiling of minors for advertising purposes has been included.
The final text reads “Providers of online platforms shall not present advertising on their interface based on profiling […] using personal data of the recipient of the service when they are aware with reasonable certainty that the recipient of the service is a minor.”
As VideoWeek has previously reported, this could potentially cause bigger problems in cases where businesses find it hard to know whether they’re interacting with a minor or not – and what exactly counts as “reasonable certainty”. What the text does say is that businesses won’t be required to “process additional personal data in order to assess whether the recipient of the service is a minor”, and that the Commission may consult on how businesses can properly comply with this measure.
Use of sensitive data will be banned
There will also be firmer protections for all users’ personal data as well, as targeting based on special categories of sensitive data, which are outlined in the General Data Protection Regulation, is explicitly banned.
“Providers of online platforms shall not present advertising to recipients of services based on profiling […] using special categories of sensitive data”.
Sensitive data includes racial or ethnic origin, political opinions, religious or philosophical beliefs, health, and sexual orientation.
Use of sensitive data is already regulated under GDPR, and most industry standards prohibit its use in advertising. But this new regulation specifically outlaws its use, even if any of the lawful bases for processing of sensitive data are met (including consent).
More transparency will be required
Another significant requirement – and one that quite a few platforms already put into practice to a greater or lesser extent – is greater transparency around who is placing ads, and which criteria were used to target it.
Providers of any online platforms will be required to provide some information, “include information on the method used for presenting the advertisement – for example whether it is contextual or other type of advertising – and, where applicable, the main profiling criteria used; it should also inform the recipient about any means available for them to change such criteria”, according to the text.
And the largest online platforms will have extra requirements, including a mandate to keep a public library of ads they’ve delivered, in order to help combat dangerous and illegal advertising.
“Very large online platforms or very large online search engines should ensure public access to repositories of advertisements presented on their online interfaces to facilitate supervision and research into emerging risks brought about by the distribution of advertising online, for example in relation to illegal advertisements or manipulative techniques and disinformation with a real and foreseeable negative impact on public health, public security, civil discourse, political participation and equality,” reads the final text.
Dark patterns will be banned
“Dark patterns” whereby online actors use manipulative methods to cause people to do things they’d otherwise not do, are prohibited under the DSA.
“Providers of intermediary services should therefore be prohibited from deceiving or nudging recipients of the service and from distorting or impairing the autonomy, decision making, or choice of the recipients of the service via the structure, design or functionalities of an online interface or a part thereof,” says the final text. “This should include, but not be limited to, exploitative design choices to direct the recipient to actions that benefit the provider of intermediary services, but which may not be in the recipients’ interests, presenting choices in a non-neutral manner, such as giving more prominence to certain choices through visual, auditory, or other components, when asking the recipient of the service for a decision.”
While dark patterns are hard to define very specifically, leaving room for judgement in future rulings, they could be applied to consent mechanisms used for gaining consent for personalised advertising. Indeed, many existing consent mechanisms could arguably be said to be using dark patterns to bump-up opt-in rates (for example, by requiring one click to opt-in, and two clicks to opt-out).
Dark patterns could also be found in ads themselves, which use misleading practices to cause users to click, download, or even purchase products unintentionally.
Ad platforms may be designated ‘Gatekeepers’
The Digital Markets Act is aimed solely at the biggest of the online giants which have massive power to shape the fortunes of others through their sheer size, meaning it won’t apply to all businesses. Obviously there will be plenty in the industry who hope that it will rein in the likes of Google, Meta, and Apple, thereby creating more opportunities for independent ad tech.
But significantly, under the final text of the DMA, advertising businesses are one of the categories of company which may be regulated by the DMA. This could have longer-term impacts, limiting the ability of any one ad business to become too powerful (even businesses which aren’t yet dominant players in the space).
