Back-to-school

Activities relevant to online safety, competition, AI, consumer protection and media highlight the continuing need to stay ahead of a constantly evolving regulatory curve.

As the holiday season comes to an end for many, we set out below our summary of some key digital markets regulatory developments that have taken place in the UK and EU between mid-July to end-August. We focus on online safety, competition, AI, consumer protection and media topics. As can be seen, it has been a busy period.

Online Safety
 

In the UK, clearly a dominant theme has been around the Online Safety Act (OSA) in the context of civil unrest that took place during this time. Ofcom’s implementation of the OSA continues in accordance with existing timescales for what it has previously referred to as the ‘biggest change to our duties in Ofcom’s history’. During the summer this included the launch of OSA consultations on transparency reporting and information gathering. The transparency consultation focuses more on the processes that Ofcom will adopt with regulated firms when requiring transparency (e.g., sending notices in draft). That said, these measures will ultimately have significant operational implications in terms of the information that Ofcom may require categorised service providers to include as part of their transparency reporting obligations. Information gathering will be relevant to the broader range of stakeholders now potentially affected by Ofcom’s information powers under the OSA. Both are integral elements of the new online safety regime.

While at the time of writing the OSA itself is not under formal review, Labour’s election manifesto pledge that it will ‘explore further measures to keep everyone safe online, particularly when using social media’ now has added significance. Indeed, the King’s Speech as delivered on 17 July had already signalled some of the measures that the new UK Government is bringing forward in this area, albeit included as part of other, more wide-ranging legislative initiatives. Provisions of the Product Safety and Metrology Bill are expected to ‘ensure a level playing field’ between the high street and online marketplaces, by clarifying responsibilities of online marketplaces in relation to the safety of goods placed on the UK market. The Crime and Policing Bill will include provisions relevant to online safety, such as sanctions on senior executives of online companies in order to tackle knife crime. Both of these developments demonstrate the evolving nature of potential regulatory requirements in this space, and the need for affected companies to ensure they have any required monitoring and control frameworks in place.

In the EU, the European Board for Digital Services published a post-election report on the European elections of June 2024, and in so doing called for ‘the swift conversion of the Code of Practice on Disinformation into a Digital Services Act (DSA) Code of Conduct’. A key consideration here is whether any such Code will be included as part of the year two DSA Audits, something that affected companies will need clarity on sooner rather than later. The Commission also initiated other DSA activity during the period, including a call for evidence on the protection of minors (to inform future guidelines) and an information notice to a Very Large Online Platform on third party researcher access and election & civic discourse monitoring capabilities. This activity illustrates the Commission’s ongoing implementation and enforcement of the new regime and where the future focus areas will be. The Commission also announced it had initiated formal proceedings against six Member States for not designating and/or empowering national Digital Service Coordinators as required by the DSA. This also shows that some parts of the EU regime are still being put together and that affected companies should remain agile in this context (something we have previously written about here).

Europe’s Digital Commissioner also took the opportunity to highlight the obligations that a designated Very Large Online Platform has under the DSA when it comes to EU users, also including ‘debates and interviews in the context of elections’ (including those taking place around the world such as in the US). Aside of again illustrating the vigilance of the Commission when it comes to flexing its new powers under the DSA, this also highlights the increasingly geopolitical nature of regulation in this area.

Competition
 

In the UK, the CMA will have been carefully considering responses to its consultation on how it proposes to implement the new competition provisions of the Digital Markets Competition and Consumers Act (DMCCA), with its final statement expected in the Autumn. The UK government also launched a consultation on how turnover should be estimated or calculated under the DMCCA. This is necessary to assess whether a business should be designated as having strategic market status or determine the statutory maximum for penalties in the event of non-compliance. This topic demonstrates the need for the companies who will be subject to this regime to have a joined-up approach across internal teams, including accounting.

Additionally, there were two notable updates from the CMA in respect of its ongoing digital markets work. First, the CMA set out its current thinking in relation to potential remedies in its mobile browsers market investigation (such as making adaptations to the user journey for changing a default browser). In so doing, the CMA referred to its new powers under the DMCCA, as well as changes announced by the relevant designated gatekeepers in the context of the Digital Markets Act (DMA) in the EU. This latter comparison is an exercise that might be expected to continue once DMCCA implementation starts in earnest. The CMA also noted that potential remedy options would be highly technical and may require ongoing monitoring and possible iteration across different parts of the two mobile ecosystems under investigation. Second, the CMA closed two ongoing competition investigations into two prominent App Stores, which focused on the rules that require app developers offering digital content to use App Store providers’ billing systems for in-app purchases. As part of this, the CMA provided the clearest statement yet that it instead expects to consider these concerns under the new digital markets competition regime. Both of these examples clearly demonstrate how the new ex-ante regime will differ from the existing approach and how companies can prepare (something we have also recently written about here).

In the EU, the initial market effects of the DMA continue to be felt, also in the context of the ongoing European Commission investigations. Further iterations were made in relation to certain gatekeeper business practices (e.g., App Store rules such as fee structures for app developers). We also saw the emergence of new third party App Stores during the period, another key objective of the DMA. We expect the DMA compliance dialogue with the Commission to continue, consistent with the key themes that have emerged thus far (e.g., steering, “pay or consent”, choice screens, self-preferencing).

AI
 

Making the link between competition and AI, in late July the European Commission, the CMA, the US Department of Justice and the US Federal Trade Commission published a joint statement on competition in generative AI foundation models and AI products, setting out key principles to support competition, protect consumers and help businesses to innovate and thrive. While the statement prominently highlights the sovereign decision making of the authorities in question, many companies will hope that the accompanying commitment by these authorities to share an understanding of the issues will lead to an increasingly harmonised approach across these jurisdictions. Other notable UK developments included the launch of formal merger inquiries by the CMA in relation to arrangements between three large technology companies and AI start-ups. This again signals just how closely agencies are scrutinising potential competition risks association with AI.

In the UK, there has been a flurry of activity as part of the new Government’s AI opportunities Action Plan activity that was announced at the end of July, with contributions being sought from key stakeholder groups and recommendations to the Science Secretary due in September. This activity may also feed into a new consultation on a potential new AI legislation, most likely focused on the most powerful AI models and giving a legal basis to the AI Safety Institute. Government officials have also stated that the contentious and complex topic of AI and copyright will be considered as part of this consultation. It remains to be seen whether this gordian knot can be untied via regulation.

In the EU, it will not have gone unnoticed to many that the AI Act formally entered into force on 1 August, signalling the start of the implementation period (something we have previously written about here). The new EU AI Office also shifted into gear, launching two key initiatives. First, a call for interested stakeholders to participate in the development of the first General-Purpose AI Code of Practice under the EU AI Act. Second, a consultation on trustworthy General-Purpose AI models under the AI Act. More outputs from the EU Office are expected as implementation continues.

Consumer Protection
 

Another important UK development to highlight is the consultation that the CMA launched during the summer on how it proposes to exercise its new direct enforcement powers in relation to consumer protection law under the DMCCA. Although these new powers are probably less well known than the CMA’s new digital markets competition responsibilities, they signal a step change in how the CMA can enforce a range of consumer protection law (previously only a court could determine such breaches and take action to stop or rectify them). The CMA also has new powers to fine in this area. This important development should be on the radar of firms across all sectors of the economy, including companies with significant online operations.

Media
 

Remaining in the UK, Ofcom published further information on its implementation of the Media Act (which along with the DMCCA received Royal Assent in May 2024), including the impending launch of a new ‘Media Act Implementation Hub’. This followed its consultation on the listed events regime, which (amongst other things) requested feedback on how broadcast coverage of specific events of national interest (e.g., the Olympic Games) has been affected by changes in technology and the media landscape, such as the emergence of streaming platforms. Ofcom has described this legislation as ‘the biggest change to the public service media framework in two decades’, and also includes measures to secure the prominence for Public Service Broadcaster content on streaming services and the accessibility of UK radio through voice assistants. During this time the government also laid secondary legislation which implements other parts of the Media Act. Concluding our whistle stop tour through the summer’s digital regulatory developments, the Media Act is another illustration of the profound impact that digital is having on different facets of the regulatory landscape.

It is gearing up to be a very busy Autumn indeed.