A. Overview
With the Digital Services Act (DSA), the European Union has established uniform rules for content moderation by online platforms and search engines. The aim is to create a secure, predictable and trustworthy online environment for users of platforms and search engines.
The DSA contains a new legal regulation for researchers' access to the data of very large online platforms and search engines. Art. 40 DSA entitles researchers and European research institutions to access data from these online platforms to research systemic risks.
Previously, there were no European regulations on access to research data from online platforms or search engines. Data from Instagram, TikTok, Google Search or X (formerly Twitter), among others, was not accessible to researchers, or only to the extent permitted by the companies. Despite the enormous importance of these platforms for public communication, mental health and political elections, there are still major gaps in research.
The DSA now gives researchers legally binding rights to access data from online platforms and search engines. This is subject to certain conditions and procedures, which are described in Article 40 of the DSA.
B. Introduction into the Digital Services Act
The Digital Services Act has been directly applicable in all member states of the European Union, including Germany, since February 17, 2024. It is not be confused with Germany's Digitale Dienste Gesetz. This law only applies in Germany, serving to implement individual rules of the DSA and adjusting other laws to the provisions of the DSA.
The DSA contains special regulations for so-called Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs). These are providers that have more than 45 million users per month in the European Union. The European Commission provides a list of providers that are considered VLOPs and VLOSEs (hereinafter referred to as VLOPs).
To implement and enforce the DSA, each member state of the European Union appoints a so-called “Digital Services Coordinator” (DSC). In Germany, this will be the Bundesnetzagentur. This Digital Services Coordinator also plays an important role in research access to platform data (see below).
C. Researchers Access to Platform Data pursuant to the DSA
Vetted researchers
In order for researchers to gain access to data from VLOPs, they must submit an request to the Digital Services Coordinator to obtain the status of "vetted researcher". Responsible is the coordinator of the EU member state in which the platform is based. The request must be related to the specific research project and will be approved by the coordinator only for this project.
Research interest
The purpose of the research must contribute to the detection, identification and understanding of systemic risks. Systemic risks are defined in Art. 34 DSA. These include, for example, the dissemination of illegal content, negative effects for the exercise of fundamental rights such as human dignity, freedom of expression and information or consumer protection, as well as negative effects on electoral processes and public security.
Submitting a request
The request for access to research data can either be submitted to the DSC of the EU Member State in which the research institution is located or to the DSC of the EU Member State in which the to be researched VLOP is established (Digital Services Coordinators of the VLOPs). The DSC of establishment makes the final decision on the status as an vetted researcher.
The researchers themselves must belong to a research institution such as a university, research institute or similar. However, researchers from civil society organizations can also be admitted if it conducts research in the public interest. In general, the research must be independent of commercial interest.
Other requirements for the research purpose, the researchers themselves and the DSA request can be found here (link to FAQ).
An example:
The German civil society organization X wants to submit a request to research the algorithms of the platform Y from Ireland in order to investigate how it presents its users with targeted election-influencing content from influencers. The organization submits the request for data access to the DSC in Germany (Bundesnetzagentur). After checking that the request is complete, the Bundesnetzagentur forwards it to the Irish Digital Services Coordinator. The latter then decides whether the organization receives the status of vetted researcher for this request (see also our flowchart).