The European Union has long recognised the role of online platforms as gatekeepers of information, and has worked to tackle disinformation by creating a regulatory framework that holds platforms accountable for the way they promote harmful content.

The EU’s passing of the Digital Services Act in 2022 is its most comprehensive and ambitious effort to create a legislative framework designed to curb illegal and harmful content online, including hate speech and disinformation. It is supported by the Code of Practice on Disinformation, first created in 2018 and updated in 2022, which proposes a set of practical measures that online platforms can adopt to demonstrate compliance with the Digital Services Act.

This policy brief highlights areas where the Digital Services Act and Code of Practice on Disinformation open space for tools that help identify and analyse disinformation and malign actors, and that assist in automating the workflow of content moderators. There are significant opportunities for AI and automation tools to aid oversight bodies, platforms, advertisers, and fact-checkers in implementing the Digital Services Act. Potential use cases include:

• Analysing ad repositories to identify disinformation advertisers
• Verifying ad placements and building exclusion lists
• Assessing site trustworthiness
• Interfacing with fact-check databases
• Streamlining content flagging

Effective solutions will require iterative testing, input from human moderators, and collaboration between stakeholders. If developed responsibly, new tools can increase the efficiency and efficacy of efforts to limit the impact of online disinformation in Europe and beyond.

The Digital Services Act (DSA) aims to increase transparency on how big tech companies like Google and Meta operate and hold them accountable for their role in disseminating disinformation and other harmful content. The overall goal is to foster a secure digital environment where users’ fundamental rights are safeguarded and balance it with fair competition for businesses.

The DSA is a landmark piece of legislation. Past efforts to make platforms pay for their business models’ negative social externalities have generally failed because they were caught up in the cul-de-sac debate on liability for third party content. Now regulators and researchers will be empowered to look under the algorithmic hood at how platforms promote and moderate content.

Under the DSA, the biggest online platforms and search engines, defined as those with more than 45 million monthly users in the EU, will be categorised as either “very large online platforms” (VLOP) or “very large online search engines” (VLOSE). So far, the EU Commission has categorised 19 sites as falling over this threshold. They must comply with a set of obligations in terms of combatting risks associated with the handling of different kinds of content such as hate speech, violence against women, the sale of counterfeit and illegal goods, and disinformation.

Article 34 of the DSA obliges these sites to conduct in-depth annual risk analyses of the severity and probability of their services:

• Enabling the dissemination of illegal content
• Causing negative effects on human dignity, privacy, freedom of expression and information, freedom and pluralism of the media, non-discrimination, rights of the child, and consumer protection
• Causing negative effects on civic discourse, electoral processes, or public security
• Enabling gender-based violence and causing negative effects on public health and on minors, and serious negative consequences to a person’s physical and mental well-being.

They must implement and place robust mitigation measures tailored to the specific risks identified. To curb them, the DSA suggests that platforms adapt their content moderation and recommender systems, cooperate with “trusted flaggers,” sign up to codes of conduct like the Code of Practice on Disinformation, and label false information and “deepfakes,” among other measures.

Designated sites must also share data with researchers and oversight bodies to monitor and assess compliance[1]. This is designed to help the public better understand the systemic risks posed by online platforms, how they can be confronted, and how effective platforms’ risk mitigation measures are. The result could be a stronger grasp on the sources, tactics and techniques used in disinformation, and a better understanding of the algorithms that recommend disinformation to users and their impact.

The designated platforms must comply with the new rules that were initiated 25 August 2023. They can expect to be penalised if their content moderation systems fail to suppress, or indeed amplify harmful content. Fines for non–compliance can reach 6% of companies’ annual turnover. Repeated non-cooperation and non-compliance can lead to a ban on operating within the bloc.

The Digital Services Act itself is somewhat vague on how platforms should tackle disinformation. For the largest sites to demonstrate that they are mitigating risks, DSA Article 45 recommends that they sign up to the bloc’s voluntary codes of conduct, which go into detail on how different types of illegal content and systemic risks can be discouraged.

The Code of Practice on Disinformation, which was introduced in 2018 and further strengthened in 2022, is one of those codes and thus provides more concrete detail on how platforms should tackle disinformation. It contains 44 commitments and 128 specific measures to guide action. Forty-four companies have signed up, including players from the advertising ecosystem, fact-checkers, and organisations with specific expertise on disinformation.[2]

Twitter notably withdrew from the code in June 2023, prompting a strong reaction from the EU. “You can run but you can’t hide. Beyond voluntary commitments, fighting disinformation will be a legal obligation under #DSA as of 25 August 2023,” EU Internal Market Commissioner Thierry Breton tweeted. “Our teams will be ready for enforcement.”

Although the code is voluntary, companies can therefore expect legal consequences if they are not seen to be doing enough to tackle disinformation. This will likely be determined based on the degree to which they have achieved the performance indicators tied to the commitments and measures they pledged to uphold while signing onto the Code.

The oversight of VLOPs is mainly the European Commission’s responsibility. National-level Digital Service Coordinators (DSCs) also play a role. These essential national bodies are scheduled to be created by February 2024.

Given the volume of data generated by the DSA in the form of “mandatory or voluntary transparency and evaluation reports, databases, activity reports, guidelines, codes of conducts and standards,” both the Commission and DSCs will need strong data science expertise to carry out their oversight roles.[8]

While the Commission will be supported by the European Centre for Algorithmic Transparency to ensure that algorithmic systems comply with the risk management, mitigation and transparency requirements in the DSA, it is less clear if member states’ DSCs will immediately have the in-house capacities required of them. Their roles include checking the compliance of VLOPs established in their countries, approving/revoking trusted flagger status, vetting researchers requesting access to platform data, approving out-of-court dispute settlement bodies, and receiving and analysing complaints about possible infringements. As such they will require broad expertise, covering data science, content moderation, platform risks assessment software engineering, behavioral psychology and law.[9] There may therefore be a need to outsource to third-parties. For example, given that Alphabet, Amazon, Apple, Booking, ByteDance, Meta, Microsoft, Pinterest and Twitter are already established in Ireland, third parties looking to take advantage of potential outsourcing opportunities from the Ireland DSC would do well having a presence there.[10]

The DSA also requires civil society to play an oversight role. Users will be able to flag content via the “notice and action” tools that platforms must create (Article 14). Trusted Flaggers (Article 22) will also detect, identify and notify platforms of illegal content and have their notices prioritised. While platforms will create their own notice and action tools, Trusted Flaggers will need to standardise how they exchange notices with platforms to highlight illegal content, which may include disinformation.

Disputes are likely to occur over platforms’ decisions in relation to removing or disabling access to information; suspending or terminating service provision to users; suspending or terminating user accounts; suspending, terminating or restricting users’ ability to monetise content.[11] When users have a dispute that cannot be settled via platforms’ internal complaints handling mechanisms, they may go to an out of court settlement body (Article 18) and represent themselves directly or via a third party like a Trusted Flagger. They will likely need dossiers of evidence to make their case to such a body. Trusted Flaggers will also likely need to keep evidence logs that can stand up to independent audits if doubts about their precision, accuracy or independence trigger an investigation.

There may therefore be use-case for digital tools that support the work of Trusted Flaggers. Such tools can support trusted flaggers by: encouraging users to submit violation claims for further investigation; allowing trusted flaggers to assess those claims, supported by AI; enabling them to check if content is present in an existing database of fact-checks or other content; creating a detailed log of the content, claim, assessment, supporting evidence, action required; and standardising their submission of notices to VLOPS (see Tremau for an example).