The EU Digital Services Act promised vetted researchers data access to study systemic risks, but platforms are obstructing these efforts. Delays, NDAs, and complex processes hinder independent research on algorithmic harm, leaving policymakers in the dark.
The European Union’s Digital Services Act (DSA) was designed to bring transparency and accountability to the largest social media platforms. A key pillar of this regulation is the provision for vetted researchers to access platform data, aiming to shed light on systemic risks such as disinformation, hate speech, and algorithmic manipulation. However, more than half a year after these rules became enforceable, researchers are facing a sobering reality. Instead of open data, they encounter protracted delays, restrictive nondisclosure agreements, and outright refusals. The promise of independent oversight is slipping away.
Under the DSA, very large online platforms (VLOPs)—those with over 45 million monthly active users in the EU—are required to provide data to researchers who are vetted by national authorities. The European Commission designated 19 VLOPs in 2023, including Facebook, TikTok, X, YouTube, and Instagram. This mandate was supposed to enable research on everything from how algorithms promote harmful content to the effectiveness of content moderation. It was a bold step toward evidence-based regulation.
But the implementation has fallen short. Instead of a streamlined process, researchers face a bureaucratic maze that bleeds time and resources.
Researchers across Europe describe a Kafkaesque experience. Applying for data access involves navigating complex portals, signing restrictive NDAs, and waiting months for a response. A survey by Wired and academic networks found an average delay of six months between submitting a request and receiving a response. Some projects have been abandoned entirely.
“The DSA was supposed to open the black box. Instead, platforms are creating new walls,” says Katherine Schroeder of European Digital Rights (EDRi). Platforms argue that they need to protect user privacy and trade secrets. But critics counter that these reasons are often pretextual.
“We are essentially being asked to trust the platforms to police themselves, while the evidence we need to verify that is locked away,” notes Paddy Leerssen from the Institute for Information Law, University of Amsterdam.
The trend of platform resistance is rising—up 30% since the DSA’s data access provisions came into force in February 2024. This suggests the situation is not improving.
Data obstruction has tangible effects. Research projects that could inform public debate and policy are being delayed or scrapped. Without independent data, we rely on platform-commissioned studies, which may not tell the full story. This undermines the DSA’s goal of systemic risk assessment.
For example, studies on the spread of disinformation during elections or the impact of algorithmic amplification on mental health require timely data. With six-month delays, these windows are missed. The result is a stalemate where evidence-based policy becomes impossible.
As a technology professional, you might view this as a purely legal or policy issue. But it has deep technical implications. Platforms must design systems that provide safe, privacy-preserving data access. The debate over APIs, data anonymization, and auditability touches on core engineering challenges.
Moreover, the outcome of this struggle will shape the regulatory landscape. If the DSA fails to deliver data access, future regulations may impose even stricter requirements. Conversely, successful models of data sharing could become blueprints for transparency worldwide. Professionals in platform companies, startups, and research labs should pay close attention.
The European Commission has enforcement powers and can fine platforms up to 6% of global turnover for non-compliance. So far, it has not used these powers aggressively on data access issues. But pressure from researchers and civil society is mounting.
Potential solutions include:
The coming year will be critical. The DSA is still young, and early precedents will set the tone for platform accountability.
The DSA’s promise of data access is at risk. Independent research is essential for democratic accountability. Technology professionals can advocate for transparency, both within their organizations and in the broader policy debate. The future of social media accountability depends on breaking down the data walls.
The Digital Services Act (DSA) requires very large online platforms (VLOPs) to provide vetted researchers with access to internal data. This mandate aims to enable independent study of systemic risks such as disinformation, hate speech, and algorithmic manipulation. Researchers must be approved by national authorities to receive this data.
Researchers apply through dedicated portals maintained by each VLOP, such as Meta's research portal. They must submit a detailed research proposal and undergo vetting by a national digital regulator. However, the process is often fraught with delays, NDAs, and bureaucratic hurdles, taking up to six months for a response.
Platforms claim they must protect user privacy and safeguard trade secrets, which are legitimate concerns under the DSA. However, critics argue that these reasons are often used as a pretext to delay or deny access, effectively preventing independent oversight. The tension between transparency and commercial confidentiality remains a key point of contention.
Platforms must share data related to systemic risks, including data on algorithmic content promotion, ad targeting, and content moderation actions. The DSA's implementing acts specify categories like recommender system parameters and advertising transparency data. However, platforms can redact commercially sensitive information, which researchers say hampers their work.
Without reliable access to platform data, independent researchers cannot verify whether platforms are effectively managing risks. This leaves the European Commission and national authorities without key evidence to enforce the DSA's requirements. As a result, the regulation's goal of evidence-based oversight is being undermined by the very platforms it seeks to regulate.
