The Digital Services Act and Open Science

Teaser image person using laptop and smartphone

How the DSA creates new opportunities for researchers and public-interest organisations to study systemic risks online.

Online platforms shape how people access information, communicate, shop, learn, organise, participate in public debate and encounter public services. Yet many of the systems that influence these experiences remain difficult to study from the outside: researchers, journalists, civil society organisations and public authorities often see only the visible surface of platform activity, while key decisions about recommender systems, advertising, content moderation and risk mitigation happen inside privately controlled infrastructures.

As Part 1 of this series explained, the Digital Services Act (DSA) is the EU regulation that aims to create a safer digital space, protect fundamental rights and establish a level playing field for businesses, applying directly and uniformly across Member States. It creates layered obligations for different types of digital services — from basic intermediaries and hosting services to online platforms and, most strictly, Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs).

For Open Science, one part of the DSA is especially important: data access. Through Article 40, the DSA creates new routes for researchers and, in some cases, civil society organisations, to access platform data for the study of systemic risks in the EU. The European Commission's DSA data access portal is now the central entry point for researchers to create applications, find points of contact, consult data catalogues and follow guidance on the process.

This does not mean that all platform data suddenly becomes open. It means something more specific: under certain conditions, public-interest researchers can request access to data from VLOPs and VLOSEs in order to investigate risks that affect society — for example, whether certain groups are exposed to harmful content more often than others, how recommender systems affect civic discourse, or whether risk mitigation measures are actually effective. The DSA does not answer these questions by itself, but it can make it more possible for independent researchers to investigate them.

How does the DSA turn transparency into accountability?

Beyond the Transparency Database introduced in Part 1 — which independent research has found valuable, though inconsistent in places — the DSA sets up several further mechanisms: transparency reports, clearer terms and conditions, ad libraries, risk assessments, independent audits, data access, and a whistleblower tool. Together, these move platform transparency beyond voluntary disclosure into structured, monitorable obligations.

For Open Science communities, data access is the most consequential of these tools, because it can enable research into platform systems that are otherwise difficult to observe from the outside.

What is Article 40?

As set out in the Commission's October 2025 webinar on DSA data access (see Key resources), Article 40 of the DSA — the key provision on data access — distinguishes three types of access.

First, the European Commission and the Digital Services Coordinator of establishment can access data for monitoring and assessing compliance with DSA obligations.

Second, verifiedresearchers can apply for access to non-public data under Article 40(4) — but only if they meet a defined set of conditions, and only for research that helps explain systemic risks in the EU (the conditions are covered in detail below).

Third, qualified researchers, including those affiliated with civil society organisations, can draw on data that is already visible on a platform's own interface under Article 40(12) — for instance through APIs — with specific legal protection for researchers who use automated methods, such as scraping, to study systemic risks.

The European Centre for Algorithmic Transparency confirms that Article 40 allows researchers to request data from VLOPs and VLOSEs for research on systemic risks in the EU, and that the Commission's delegated act sets out detailed, harmonised procedures for the process.

What counts as a systemic risk?

The DSA does not create data access for any research question — the research must contribute to detecting, identifying or understanding systemic risks in the Union, including:

dissemination of illegal content;
negative effects on fundamental rights — human dignity, private and family life, personal data, freedom of expression, non-discrimination, and the rights of the child;
negative effects on civic discourse, electoral processes and public security;
gender-based violence;protection of public health and minors;
serious negative consequences for physical and mental wellbeing.

This gives researchers a framework for public-interest questions such as: How does a recommender system affect exposure to health misinformation? Are platform designs increasing risks for minors? Are certain groups affected differently by content ranking, advertising or enforcement decisions? These are not only technical questions — they are social, legal, ethical and democratic ones.

How does public data access work under Article 40(12)?

Article 40(12) DSA provides that VLOPs and VLOSEs "shall give access without undue delay to data... provided that the data is publicly accessible in their online interface," including real-time data where technically possible, to researchers — including those affiliated with not-for-profit bodies — who meet the relevant conditions and use the data exclusively for research contributing to the understanding of systemic risks in the EU.

This matters because public platform data is often technically difficult to access at scale. Platforms can provide access through data transfers, APIs or libraries, and independent access techniques such as scraping cannot be prohibited for eligible researchers — provided they protect personal data, meet security and confidentiality requirements, and keep their request necessary and proportionate. However, none of this relieves researchers of their fundamental ethical and legal obligations.

How does verified researcher access work under Article 40(4)?

Article 40(4) provides access to non-public platform data, under stricter requirements. To qualify, a researcher needs a genuine institutional home — affiliation with a research organisation — and a clean bill of health on independence: no ties to commercial interests that could bias the work, and full disclosure of who is funding the project. They also need the practical capacity to keep data secure and confidential, a request that is proportionate to what the research actually needs, and a commitment to publish their results once the work is done.

That last commitment matters most for Open Science: the process is designed to produce evidence that becomes public, linking platform data access to the broader principles of transparency, accountability and public value. As of 29 October 2025, the Commission has confirmed that these new rules allow researchers to gain access to VLOP and VLOSE data to study the societal impacts of platform systems.

How does the application process work?

A researcher applies under Article 40(8); the Digital Services Coordinator (DSC) decides on vetted researcher status; the DSC submits the request to the relevant VLOP or VLOSE, which may ask for amendments; if the process continues, the platform provides access; and once the research is complete, the results are published. The DSC can also determine whether access should be terminated if conditions are no longer met.

The DSA data access portal is the one-stop shop for this process — the entry point for applications and for exchanges with DSCs and data providers. One application is needed per project and per VLOP/VLOSE; researchers can apply as a group with one main applicant, but every team member must meet the conditions. VLOPs and VLOSEs are expected to publish data catalogues describing what data is available, including attributes, metadata and suggested access modalities.

How are access conditions decided?

Data access under the DSA is not the same as open data publication — it involves real trade-offs between openness, privacy and security. Researchers and DSCs need to weigh three competing interests: keeping personal data safe, protecting confidential business information such as trade secrets, and not compromising the security of the platform itself.

The webinar groups the available safeguards into three categories: technical measures (for example clean rooms, data vaults, differential privacy or activity logging), organisational measures (limiting who on a research team can access the data, requiring oversight from a data protection officer or ethics board, and preventing new people being added to a project later), and legal measures (individually negotiated non-disclosure agreements between the provider and the researcher). The challenge is designing conditions that are protective without making meaningful independent research impossible.

Why does this matter for Open Science?

Open Science is not only about open access articles or open datasets — it is also about enabling independent examination of systems that shape public knowledge, democratic debate and everyday digital life. Article 40 could help researchers move from speculation to evidence on misinformation, public health risks, election integrity, risks to minors, discrimination, advertising transparency and platform accountability, while encouraging collaboration between researchers, regulators, civil society and technical experts.

Expectations should still stay realistic. Academic analysis has described the Article 40 process as a genuine "standoff": researchers must request specific data without always knowing what platforms hold internally, and other research has documented legal, technical and organisational barriers that can limit effective research on systemic risks. For the DSA to fulfil its promise, data access needs to become practical, timely and usable by a broad range of qualified researchers — not only the largest institutions.

Conclusion

The Digital Services Act is more than a compliance framework for platforms — it is a new opening for public-interest research on digital systems that influence society. For Open Science, the most important promise lies in data access: Article 40 can help researchers investigate systemic risks, evaluate platform mitigation measures, and produce evidence that supports democratic oversight of digital infrastructures.

Researchers getting started can:

define a research question clearly linked to systemic risks in the EU;
identify the relevant platform or search engine and check its published data catalogue;
assess whether publicly available data (40.12) is sufficient, or whether a verified researcher application (40.4) is needed;
prepare documentation on necessity, proportionality, funding, independence, data protection and security;
build an interdisciplinary team — legal, technical, ethical and domain expertise — and consider involving civil society organisations where relevant.

The DSA will not automatically make platforms transparent. Its value will depend on implementation: whether data catalogues are useful, whether requests are handled fairly, whether safeguards are proportionate, or whether smaller research teams can participate alongside the largest institutions. But implemented well, DSA data access could become one of the most important tools for studying platform power in Europe.

References: