We previously published some Insights on the Digital Services Act (DSA), which came into force on 16 November 2022.

Whilst the vast majority of the DSA’s requirements will not come into effect until 17 February 2024, online platforms/search engines (including non-EU online platforms/search engines providing services to consumers or business users established or resident in an EU member state) must publish information on the “average monthly active recipients” (AMAR) of its services in the EU (calculated as an average over the past 6 months) in a publicly available section of their online interface by 17 February 2023 and every six months thereafter.

The European Commission (EC) will use this figure to determine which intermediary services to designate as Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs). As outlined in our previous article, services with AMARs of 10% or more of the total EU consumers (currently 45 million) will be subject to additional stringent obligations and must pay a fee for their supervision.

What is an Active Recipient? 

Article 3(b) of the DSA defines a “recipient of the service” as “any natural or legal person who uses an intermediary service, in particular for the purposes of seeking information or making it accessible.”

Recital 2 clarifies that the (commercial) intention of such a natural or legal person using an intermediary service does not impact their status as a recipient of the service – so business users (e.g. traders and third party advertisers), consumers and other users should be counted as recipients of the service.

The “active” recipient is a new DSA category of recipients which is defined differently for online platforms and search engines.

Active Recipients of online platforms

Article 3(p) of the DSA defines an active recipient of an online platform as “a recipient of the service that has engaged with an online platform by either requesting the online platform to host information or being exposed to information hosted by the online platform and disseminated through its online interface (our emphasis added)”.

An active recipient can be engaged with an online platform in two ways: by (a) requesting an online platform to host their information or (b) being exposed to information on the online platform. Both types of recipients must be actively “engaged” with an online platform.

Recital 77 defines “engagement” widely and specifies that includes but is not limited to: “[I]nteracting with information by clicking on, commenting, linking, sharing, purchasing or carrying out transactions on an online platform.”

Active Recipients of online search engines

Article 3(q) of the DSA  defines an active recipient of an online search engine as “a recipient of the service that has submitted a query to an online search engine and been exposed to information indexed and presented on its online interface (our emphasis added)”. So an individual who submits a search term in their address bar/on a search engine’s website (‘submitted a query’) and is (re)directed to search results (‘exposed to information index and presented on its online interface’) will be an active recipient of that search engine.

Recital 77 of the DSA clarifies the main elements of both definitions.

EC Guidance

The EC published guidance on the identification and counting of active recipients on 1 February 2023 (Guidance) (only two weeks before the reporting deadline of 17 February 2023). The Guidance provides answers to a number of questions it received from service providers based on the information available to it at the date of publication. As such, it may be subject to review based on practical experience acquired in the months to come.

Calculating AMAR

Article 33(2) of the DSA states that only active recipients located in the EU at the time they engage with the platform/search engine should be counted. Despite the Guidance, it remains unclear how and whether recipients that conceal their location (through a VPN) should be included and how a provider should determine where a user is located (e.g. based on IP address or language settings etc?).

Recital 77 clarifies that providers can discount visits from “automated” recipients (e.g. bots and scrapers) if this can be done “without further processing of personal data and tracking”. The Guidance states that providers that have the technical means to identify inauthentic users may discount them from its AMAR calculations.

Recital 77 also allows providers to discount “non-unique” visits to avoid double counting – so providers are only required to count a user once where such a user uses different interfaces (e.g. website and mobile app) to access the provider’s service(s). However, both Recital 77 and the Guidance emphasise that the obligation to count active users does not require or permit the provider to profile and track users to avoid double counting. In other words, the user reporting requirement does not provide a legal ground to process personal data or track users. Ironically, the ability to discount non-unique/authentic recipients might encourage the enhanced tracking of service users.

Many online platforms ‘embed’ information from their platforms on external websites or apps and many online search engines use auto-complete functions. The Guidance does not address whether recipients of embeds and auto complete suggestions are “active recipients”. 

Whilst the Guidance offers helpful clarity on the new DSA concept of “active recipient” in the context of multi-sided platforms and the circumstances under which certain types of users can be validly discounted, the accurate calculation of AMAR is not yet an exact science. And this is only one initial part of myriad obligations in the DSA – watchout for more complexities over the coming months.

Keep an eye out for further LS articles on the DSA, UK/EU AI Regulation and the UK’s Online Safety Bill (as well as related commentary on the UK’s recent proposals for data reform) as they progress through their respective legislative processes.  A more detailed article on the DSA can be accessed here.