10.1 Introduction

The EU’s Audiovisual Media Services Directive (AVMSD) has been the main piece of EU media law for decades.Footnote ¹ Since its beginnings as the Television without Frontiers Directive (TWFD),Footnote ² the Directive has eliminated barriers to free trade in audiovisual media services, mixing this market liberalisation with industrial policy and a dose of cultural protectionism.Footnote ³ When the AVMSD was revised in 2018,Footnote ⁴ its scope was changed to reflect the fact that audiovisual media services were no longer the only ones delivering audiovisual content. By the end of 2022, the body of EU media law had expanded considerably in response to the well-documented spread of services that disseminate content and compete in the same attention markets as broadcasters and publishers.Footnote ⁵ The Terrorist Content Online Regulation (TERREG) was adopted in 2021 and the wide-reaching Digital Services Act (DSA) followed in October 2022.Footnote ⁶ The European Media Freedom Act (EMFA) was adopted in April 2024.Footnote ⁷

The DSA is horizontal law that aims to ensure ‘a safe, predictable and trustworthy online environment’ for the exercise of fundamental rights.Footnote ⁸ All hosting services that disseminate content are within the scope of the DSA, including intermediary services and online platforms such as social media and those for disseminating user-generated content. It contains due diligence provisions for very large online platforms and search engines. Though the DSA does not institute a duty of care per se, it does take a risk management approach of the kind called for by Woods and Perrin and by Ullrich.Footnote ⁹ Very large online platforms and search engines are required to assess the systemic risk of the dissemination of illegal content and ‘negative effects’ in three broad areas. These areas include not only ones in which the negative effects, or harm, might be directly experienced by individual users, such as to their exercise of fundamental rights or personal well-being, but also ones in which there are risks of negative effects on collective or societal functions, such as electoral processes, media freedom and pluralism, or public health. Several of the expected mitigation measures mirror those in the AVMSD.

The EMFA’s purpose stems from the recognition that media freedom and pluralism are not only ‘two of the main pillars of democracy and of the rule of law’ but also essential to a well-functioning internal market.Footnote ¹⁰ It aims to correct three ‘market failures’, the first of which is a basket of negative consequences from the gatekeeping role of online platforms. The second is variation in the level of independence afforded to Member State media and regulatory authorities. The third market failure addressed by the EMFA is the disruption of the media services market by bad-actor media services engaged in disinformation and manipulation.Footnote ¹¹

Is this direction of travel merely keeping pace with the new affordances and functionality of different types of media or does it mark a shift in the foundations of media law? It was the public interest in media production, both cultural and economic, and the positive obligations on states inherent in the right to freedom of expression that underpinned the AVMSD,Footnote ¹² as well as the EU’s approach to public service media and its creative industry support programme, Creative Europe. Harm and risk may be more essential to the new modus operandi, but as this chapter demonstrates, the concept of harm (and protection from it) is not completely new in EU media law.

This chapter traces the evolution of understandings of harm and its prevention in EU media law since 1989 in order to inform future thinking on EU media law. It provides answers to two questions: what are the understandings and assumptions of harm behind existing EU media laws, and how do they construct responsibility for risk mitigation? It presents the findings from an analysis of the final adopted texts of the 1989 TWFD and the Directives amending it in 2007, 2010, and 2018, the 2021 TERREG, the 2022 DSA, and the 2024 EMFA,Footnote ¹³ as well as the explanatory memoranda that accompanied the initial proposals for each. A two-part computer-assisted qualitative analysis was conducted.Footnote ¹⁴ The first looked at the ways ‘harm’ and synonyms for it, as well as words associated with protection or prevention, were used. The second applied a three-part framework drawn from the policy literature on audiovisual media and online platforms. This included the push/pull distinction among types of media, individual and societal policy aims, and sources of harm.

This chapter is organised around these three themes, with a short note on EU competence in this area beforehand and a discussion of the implications of the findings following. This chapter shows that the distinction between push media and pull media has remained relevant and crucial for the distribution of responsibility for harm prevention, with understandings of what constitutes pushing expanded to include the nature of algorithmically controlled platform systems. It then identifies a gradual move from law aimed at preventing harm to individual consumers to law designed also to prevent harm to society as a collective and to its systems. This chapter provides evidence of an expansion of the understanding of sources of harm that has implications for the type and distribution of responsibility for prevention. In conclusion, it argues that due to the evident shifts in EU media law in the understandings of harm and the distribution of responsibility for preventing harm, the next priorities for EU law should be ensuring that the institutional architecture can effectively enable governance through cooperative responsibility and addressing informational asymmetries among those who should contribute.

10.2 The Boundaries of EU Competences

The shape of EU media law is significantly determined by the fact that the EU has limited competences in the area of media and culture. The media law that exists is linked to the management of the single market. The establishment of broadcasting as an economic activity, rather than a cultural institution, by the Court of Justice of the European Union (CJEU) in 1974 laid the foundation for EEC- and then EU-level policy in this space.Footnote ¹⁵ The role of EU law in this area has always been relegated to addressing what is needed for the healthy functioning of media markets. However, this has arguably been stretched to include cultural policy and industrial policy in the media and cultural sectors.Footnote ¹⁶ This is evidenced in the unique blend of industrial and cultural policy that is the AVMSD. It also comes to the fore in other interventions such as the Amsterdam Protocol and subsequent communications on state aid in public service broadcasting, as well as in the significant investment into the Creative Europe Programme and its predecessors.Footnote ¹⁷

The EU does have clear competences in consumer protection, a feature that has been explicitly in place since the Maastricht Treaty.Footnote ¹⁸ It has a treaty-level obligation to ‘promote the interests of consumers and to ensure a high level of consumer protection’Footnote ¹⁹ and to take consumer protection into account when developing policy in other areas. This is reflected in EU media law. In concert with the Unfair Commercial Practices Directive,Footnote ²⁰ for example, the AVMSD contains specific rules on commercial communication to protect individual consumers from the advertising of controlled substances, discriminatory commercial communication, and affronts to dignity. It also contains rules to protect minors, who are characterised as vulnerable consumers. The DSA was in large part a response to EU lawmakers’ call for digital services regulation that had consumer protection at its core.Footnote ²¹ The DSA’s Article 1 aim statement hinges the ‘proper functioning of the internal market’Footnote ²² on effective protection of fundamental rights, highlighting only consumer protection among all those contained in the Charter of Fundamental Rights of the European Union (the Charter).Footnote ²³ A foremost purpose of the EMFA is also ensuring the functioning of the EU’s media market. Its recitals present problems of platform gatekeeping, media capture, editorial interference, and misuse of state advertising primarily as posing risks to the fair functioning of the market and the rights of media services to do business, while acknowledging the public interest concerns arising from media’s role in democratic discourse, public participation, and culture.

In summary, the basis for EU media law is primarily in its competences for market regulation, which includes consumer protection and the obligations to respect and protect citizens’ ability to exercise their fundamental rights as set out in the Charter and the Treaty on the Functioning of the European Union. There also has been a history of stretching this to what could be considered cultural policy or at least industrial policy towards the media and cultural industries, and as will be elaborated in what follows, recognition of wider public interests such as media pluralism and linguistic and cultural diversity.

10.3 The Evolving Distinction between Push Media and Pull Media

As it broke down the barriers to cross-border television broadcasting and attempted to create a Europe-wide market for audiovisual production and distribution, the TWFD set out minimum standards aimed at protecting audiences, especially minors. These mirrored standards that were already in place in many jurisdictions and were intended to prevent harm: to minors from exposure to certain content, and to the general public from certain types of advertising. They were rooted in the understanding that television, or linear audiovisual media, was a ‘push’ form of media, one that once switched on offered audience members no control other than the changing of channels.Footnote ²⁴ This made the advertising difficult to avoid and arguably made the content more compelling or, in the case of advertising, more convincing.

Though the word ‘harm’ was not used in the 1989 Directive, it required that television advertising should not cause ‘moral or physical detriment to minors’. The assumption that minors were particularly vulnerable to manipulation from advertising is clear in the text, which refers to their ‘inexperience and credulity’ and the potential for abusing the trust they place in adults around them.Footnote ²⁵ Member States were also required to ensure that all broadcasts do not include ‘programmes which might seriously impair the physical, mental or moral development of minors, in particular those that involve pornography or gratuitous violence’ or incitement to hatred.Footnote ²⁶ Adult viewers/consumers were also protected by bans on advertising that might ‘prejudice respect for human dignity’ or encourage behaviour ‘prejudicial’ to health and safety and to the environment.Footnote ²⁷ Compliance with these outright bans fell under the editorial responsibility of the broadcaster and was to be enforced by the national regulatory authority.

When video-on-demand services were added to the scope of the Directive in 2007, it was acknowledged that such technologies, which were new at the time, ‘give users increased choice and responsibility in their use of audiovisual media services’.Footnote ²⁸ In the later consolidated version an understanding that the push medium of television had a greater impact on society was also explicitly mentioned.Footnote ²⁹ The recital linked this assumption to the CJEU’s decision in the case of Mediakabel BV v Commissariaat voor de Media,Footnote ³⁰ which highlighted the simultaneous transmission to a mass audience inherent in linear television.

The two-tiered approach required stricter rules and regulation of linear services and a light-touch regime for on-demand or ‘pull’ services, reflecting assumptions about control and risk.Footnote ³¹ Herold explained the logic of the Commission at the time, writing, ‘the rules imposed on broadcasting (push) service remain tougher than those we proposed for non-linear (pull) services. The differing degrees of regulation of content “pushed” by suppliers or “pulled” by users reflects differences in user choice and control and in the likely impact of media services on society.’Footnote ³² Already the two-tiered approach based on the push/pull distinction had changed the distribution of responsibility for preventing harm from content.

Though on-demand services were assumed to bear editorial responsibility for preventing harm, some of the responsibility for preventing exposure to harmful content was shared with the viewer. Since 2007, Member States have been required to ensure that on-demand services that might impair or harm minors are normally not able to be accessed by minors and to comply with the qualitative consumer protection standards for commercial communication and hate speech.Footnote ³³ Measures expected to be taken by service providers include encoding, filtering, and labelling. The collection of potential measures includes ones that inhibit access at a technical level and ones that give viewers the information and tools needed to exercise control over the content to which they may be exposed.Footnote ³⁴

As Napoli has argued,Footnote ³⁵ the push/pull distinction has been blurred with the development of online social media because the algorithmic feed functionality of many such platforms means they are as much ‘lean back and consume’ media as television used to be. The 2018 revision of the AVMSD that brought video-sharing platforms (VSPs) into scope appears not to have quite recognised this. It added a third tier to the Directive, one that requires Member States to hold VSPs responsible for taking ‘appropriate measures’ to protect minors from harmful content and the general public from content that is illegal or contains incitement to hatred or violence. It suggests a list of measures that rely heavily on the role of the user in preventing harm,Footnote ³⁶ and that is closer to the expectations for on-demand services than to those for linear television.

In the 2018 revision there does seem to have been recognition of the push nature of the placing of advertising around and in VSP content. Member States must ensure that VSP providers guarantee that all commercial communication they carry complies with the same qualitative rules applicable to commercial communication on audiovisual media services.Footnote ³⁷ There is also apparent acknowledgement of the uniquely invasive nature of targeted advertising that is possible on VSPs. It essentially prohibits VSPs from delivering such advertising to minors by prohibiting the use of their data for such purpose.Footnote ³⁸

The classic push/pull distinction is not evident in the TERREG or the DSA; however, in neither law are the online services in scope treated solely as on-demand services. Drafted after high-profile attacks in which terrorists essentially broadcast using livestream, the TERREG clearly addresses the time sensitivity of removing terrorist content online because of the real-time harm that can be caused by its creation and consumption, in addition to the slower process of radicalisation.Footnote ³⁹ The DSA seems to acknowledge a new kind of pushiness in the way it addresses recommender systems and targeted advertising.

The DSA raises particular concerns with the recommender systems of very large online platforms that have very wide reach, stating: ‘Such recommender systems can have a significant impact on the ability of recipients to retrieve and interact with information online … They also play an important role in the amplification of certain messages, the viral dissemination of information and the stimulation of online behaviour.’Footnote ⁴⁰

Consequently, the DSA requires transparency, in a form accessible to the consumer, about the parameters given to the algorithms determining their recommendations. This means that consumers should be able to get clear explanations for what they are seeing in feeds, results, or suggestions from the platforms. Arguably the most radical step in the DSA is that very large services are required to conduct assessments of the systemic risk of negative effects from their services in four areas of societal harm that take into account the way their algorithmic systems may contribute to those risks.Footnote ⁴¹ The DSA also recognises the ‘serious negative effects’ and amplification of ‘societal harms’ that can arise from targeted advertising that is ‘optimised to match [users’] interests and potentially appeal to their vulnerabilities’.Footnote ⁴² It reinforces and takes further the steps taken in the AVMSD’s VSP provisions to protect minors from targeted advertising and introduces protections for all consumers by banning profiling and targeting based on the special categories of data set out in Article 9 of the General Data Protection Regulation (GDPR) such as race, religion, sexual orientation, and health.Footnote ⁴³

The push/pull distinction remains evident in EU media law. Push media are still considered to pose the greater risk of harm and, therefore, to be where service providers carry the most responsibility for preventing that harm. At the heart of this distinction remain the differences in the amount of control a consumer has over the content to which they are exposed, and the level of vulnerability of the consumer. When VSPs were brought into the scope of EU media law, the active user was given an even greater role due to the fact that VSPs disseminate user-generated content over which platforms have no editorial responsibility,Footnote ⁴⁴ but at the same time there was some acknowledgement that VSPs were not entirely pull media and therefore also bore responsibility. With the DSA, we can see a notable expansion of the understanding of what it means to be a push medium. Policymakers seem to have grasped that, as Helberger and colleagues have argued, ‘these contemporary digital choice architectures essentially offer an infrastructure to automate the continuous search for exploitable consumer vulnerabilities’.Footnote ⁴⁵ The DSA treats the algorithmically curated feeds, search results, and recommendations, as well as the advertising around them, as pushed and the responsibility for preventing harm from them as commensurate.

10.4 From Protecting Individuals to Preventing Harm to Society and Societal Systems

Examination of the EU media laws and their explanatory notes has also revealed a gradual move from addressing potential harm to individual consumers to covering both individual and collective, or societal, harm. This seems to go hand in hand with an apparent shift from an approach based on public interest objectives, which was underpinned by the positive obligations on states stemming from fundamental rights, to a risk management approach underpinned by procedural accountability for preventing harm both to individuals and society.

The TWFD contained some minimum standards aimed at protecting individual consumers, particularly in relation to advertising.Footnote ⁴⁶ These consumers were minors who might be exposed to content, those who needed to use the right of reply it guaranteed, or each viewer who might encounter incitement content or affronts to their dignity. The only evidence of provisions that seemed aimed at preventing harm on a societal level were those banning advertising that is prejudicial to health, to safety, or to the protection of the environment, which were carried through to the 2018 rules on commercial communication.Footnote ⁴⁷ However, these provisions do not mention ‘public health’ or ‘public safety’ in a collective sense.

In the 2007 revision of the TWFD into the AVMSD, protection of minors and consumer protection were listed among other public interests that were collective, namely cultural diversity, right to information (which was linked to democracy), media pluralism, and general public awareness and literacy.Footnote ⁴⁸ These public interest aims were reflected in positive obligations such as European works quotas, the rules on the use of short extracts, and attention to media literacy. These represent a positive rights perspective on freedom of expressionFootnote ⁴⁹ and on cultural and linguistic diversity.Footnote ⁵⁰ Collective concerns such as threats to public safety, public health, and national security were matters for Member States and listed as potential reasons for derogations.Footnote ⁵¹ There are frequent mentions of the ‘public’ or the ‘general public’ in the texts related to the 2007 revision and the 2010 consolidation. These terms were used to refer to the group of individual viewers and citizens, who needed protection from certain content and the ability to see important events, and who were targeted by audiovisual media services.

It is in the texts surrounding the 2018 AVMSD revision where there is evidence of a slight move in the direction of considering harm at a more societal level and establishing measures to prevent that harm. In the revising Directive, transparency of media ownership is presented as a means of ‘protecting’ freedom of expression, which it refers to as the ‘cornerstone of democratic systems’.Footnote ⁵² Also, for the first time, the rules on commercial communication are framed as protecting ‘consumers or public health’, which implies the aim of preventing harm to the health of individuals as well as protection for the wider societal system that deals with their health.Footnote ⁵³ This was in reference to the expanded provisions related to the advertising of unhealthy food and beverages and of alcohol.

The TERREG was proposed because of the ‘grave security risks this content entails for society at large’.Footnote ⁵⁴ Examination of the proposing documents and the final text show that a direct link is clearly made between the exposure of individuals to content and negative effects on the rest of society, such as ‘fear in the general public’, trust in services, and even the actual execution of atrocities. Because the mechanism of incitement can lead to physical violence, TERREG also aims to prevent immanent threat or harm ‘to the life or the physical integrity of a person’.Footnote ⁵⁵

From the start, the DSA was about both individual consumers and societal or collective concerns, and a link between harm to individuals and consequences to wider society is evident in the DSA. As the explanatory memorandum sets out in the rationales, ‘the use of those services has also become the source of new risks and challenges, both for society as a whole and individuals using such services’.Footnote ⁵⁶ Where the DSA most clearly addresses harm at a societal level is in its requirements that very large online platforms and search engines undertake systemic risk assessments. These very large services are singled out for additional obligations because of their role in ‘shaping public opinion and discourse, as well as online trade’ and because their advertising-driven design ‘can cause societal concern’.Footnote ⁵⁷

The DSA requires these large services to assesses and mitigate the risk they pose in four risk areas. These include risk from the dissemination of illegal content; risk from ‘actual or foreseeable negative effects’ on fundamental rights; risk from negative impacts on civic discourse, electoral processes, and public security; and risk in relation to gender-based violence, to minors, or to public and individual health.Footnote ⁵⁸ The elaboration of fundamental rights highlights individuals’ rights to dignity, privacy, freedom of expression, and consumer protection; the rights of the child; and collective manifestations of the positive obligations stemming from those rights, namely media freedom and pluralism and non-discrimination. The risk that the DSA requires very large platforms to manage is conceived as systemic due to both the number of individuals users that could be harmed and the potential for negative effects on societal systems well beyond the individual users of the services.Footnote ⁵⁹

The EMFA is the first EU law to directly address the issue of media pluralism and independence. It is intended to mitigate risks to the proper functioning of the internal media market from interferences in the work of journalists, barriers to media services’ ability to do business, and unlevel playing fields. Nevertheless, it also makes an explicit link between the functioning of the media market and the societal role of the media in enabling democratic discourse and public participation, as well as cultural expression.Footnote ⁶⁰ The positive obligation on states to guarantee effective pluralism and the specific role of news in shaping public opinion with ‘direct impact on democratic participation and societal well-being’Footnote ⁶¹ are both invoked as rationales for the Act.

Though earlier EU media law did not ignore societal concerns, these were noted as broad issues of public interest that were primarily the business of Member States. Protections from harm were afforded to individual consumers, especially vulnerable minors. Societal concerns such as media pluralism and cultural and linguistic diversity were addressed through positive or enabling interventions in the market, such as European and independent production quotas. This is notably different from the more recent laws. The DSA explicitly aims to prevent harm to societal systems, including media pluralism, electoral processes, and public security, and the EMFA aims to prevent harm to media industries because of the societal role of media. There is evidence in the 2018 revision of the AVMSD and in TERREG that the turn towards consideration of societal-level harm has not been abrupt. Both link individuals’ exposure to content to potential negative effects on wider society, the former in relation to public health and the later in relation to both public attitudes and public security.

10.5 Sources of Harm: Content, Behaviour, and Design

Fundamental to understandings of harm are assumptions about where it is likely to come from. Common across all the laws examined here is the assumption that harm to consumers can come from exposure to content due to the nature of that content (e.g. pornographic, containing incitement to violence or hatred, terrorist provocation, or marketing of alcohol products). In the more recent laws, additional sources of harm are also addressed, namely user behaviour and service design, and a kind of pollution effect from harmful content beyond those directly exposed seems to be acknowledged.

From the start, the TWFD established rules banning ‘programmes which might seriously impair the physical, mental or moral development of minors’ and required Member States to place restrictions on programmes that are ‘likely to impair’.Footnote ⁶² These rules remain in place for audiovisual media services as of the time of writing, having been expanded to on-demand services in 2007 and maintained in the 2018 AVMSD.Footnote ⁶³ Bans on content that contains incitement to hatred appear in the TWFD and the AVMSD, with the provision expanded in 2018 to incitement to violence and provocation to commit terrorism.Footnote ⁶⁴ Even the provisions on VSPs introduced in 2018 focused on content, requiring protection from harmful programmes, user-generated video, and commercial communication.Footnote ⁶⁵ The TERREG explicitly addresses terrorist content, defining it as content that incites the commission of terrorist offences, solicits a person or group to commit or contribute to terrorism, provides instructions for terrorist acts, or amounts to threat.Footnote ⁶⁶

The expansion of scope to include VSPs in 2018 introduced a new kind of responsibility for content, and therefore for prevention of harm from that content. VSPs are defined as not having editorial responsibility but deriving an organisational responsibility from their management of the programmes, user-generated videos, and audiovisual commercial communications that are disseminated through their services.Footnote ⁶⁷ The distinction between content providers with editorial responsibility and hosting services, such as VSPs, is evident also in the TERREG.Footnote ⁶⁸

As EU media law has been expanded to cover not only services with editorial control and responsibility but also hosting services, such as online platforms, the expectations on services have come to include measures that draw the user into sharing responsibility for mitigating the risk of exposure to such content.Footnote ⁶⁹ Measures such as tools for classifying the content they upload or reporting the content they see involve users in protecting each other from harm. There is evidence of a new source of harm being acknowledged for which users bear responsibility. As Nash has pointed out, when it comes to online content platforms, it is often the users who create the harm.Footnote ⁷⁰ Users may create harmful content, attempt to manipulate others through the dissemination of content, or harm others through their behaviour. Harmful user behaviour can range from the undisclosed promotion of products to the harassment and bullying of individuals, or the grooming of young people for terrorism or sexual exploitation. The TERREG and the DSA establish a kind of supervisory responsibility for policing user behaviour and preventing ‘misuse’ of their services.

The explanatory note to the TERREG proposal refers several times to the ‘misuse of the internet’ or the ‘misuse of hosting services’, highlighting an assumption of deliberate user behaviour as a source of harm,Footnote ⁷¹ even though its provisions largely target limiting the circulation of and exposure to content as the means of mitigating that harm. The TERREG explicitly covers a narrow category of misuse: the use of services for terrorist purposes.

User behaviour is most clearly and broadly addressed in the DSA, which refers extensively to both ‘misuse’ and intentional manipulation. Its recitals note several types of misuse, such as ‘frequently providing illegal content’Footnote ⁷² or use for the ‘conduct of illegal activities’.Footnote ⁷³ For very large services it refers to misuse for the rapid spread of disinformationFootnote ⁷⁴ and intentional or coordinated manipulation ‘including by inauthentic use or automated exploitation’.Footnote ⁷⁵ The DSA also defines and addresses misuse that can take the form of abuse of mitigation measures intended to prevent harm, such as malicious flagging, abusive notice-issuing, or inauthentic complaints.

The EMFA recognises harm from the misuse or manipulation of media by a particular category of users: political and state actors, such as public authorities or politicians who may act to gain political advantage,Footnote ⁷⁶ and third-country actors that may engage in campaigns of information manipulation.Footnote ⁷⁷ Its provisions aim to prevent ‘media capture’, especially of public service media, because of the distorting effect it can have in media markets.Footnote ⁷⁸ With reference to the DSA, the EMFA also establishes a framework through which national regulatory authorities can engage with the Commission on mitigating the risks of terrorist and foreign interference, especially on very large online platforms.Footnote ⁷⁹ The need to address user (mis)behaviour seems a natural result of the dissemination of user-generated content on newer services. Issues of media capture and interference have existed for a long time, yet the EMFA is the first element of EU media policy to directly address this.

The DSA also aims to prevent manipulative behaviour by platform providers, particularly what it refers to as ‘dark patterns’ and ‘nudging’ that can impair ‘autonomy, decision-making and choice’.Footnote ⁸⁰ Its Article 25 prohibits all services in scope from designing, organising, or operating their interfaces ‘in a way that deceives or manipulates the recipients of their service or in a way that otherwise materially distorts or impairs the ability of the recipients of their service to make free and informed decisions’.Footnote ⁸¹ The design and functioning of their services and their related systems are the first potential sources of risk named in the DSA’s provisions requiring providers of very large services to undertake systemic risk assessment.Footnote ⁸²

Examining the sample of texts for indications of what constituted sources of harm revealed that the DSA was not entirely novel in addressing this kind of behaviour. A ban on subliminal and surreptitious commercial communication and conditions on sponsorship to prevent it from being manipulative date back to the 1989 TWFD. Rules on product placement, which were added later, initially banned and then allowed in some programmes while setting conditions to prevent media services (in collaboration with advertisers) from placement that would influence editorial independence or be deceitful or manipulative.Footnote ⁸³ Though these rules have focused on commercial incentives related to advertising, there is still evidence that EU media law has long understood one of the potential sources of harm to be the design decisions or behaviour of the service providers.

The evidence indicates that as EU media law has expanded to cover hosting services that disseminate content, the sources of harm addressed by EU law have also been expanded. Exposure to harmful content remains a core concern, with audiovisual services bearing editorial responsibility to prevent exposure, and hosting services, such as VSPs or social media, having a kind of organisational responsibility and sharing responsibility with users. It may be that the recognition of the design and functionality of digital services as a source of harm engenders a responsibility closer to the editorial responsibility of audiovisual media, which have long been banned from surreptitious or manipulative practices. The novel source of harm explicitly noted in the TERREG and the DSA is user behaviour, which comes with supervisory responsibility to mitigate harm from it.

10.6 Conclusion: New Understandings of Harm Require a Path to Effective Cooperative Responsibility

Understandings of harm and the allocation of responsibility for preventing it have evolved considerably since the EU began legislating in the area of media. This chapter has identified two significant shifts. It has demonstrated that EU media law has moved on from coupling a narrow focus on preventing specific harm to individual consumers with positive interventions based on public interest grounds. We now see media law directly addressing harm to individuals as well as harm to wider society and the market. The second shift identified was in the assumptions about where harm was potentially coming from. In the earlier versions of the TWFD and AVMSD, exposure to content was the main source of harm recognised, albeit with a narrow concern for the design of commercial communication. The more recent laws understand the sources of harm to include the design and functionalities of services themselves and the malign intent of users: both individuals and institutions, including states and political actors.

These shifts in the scope of harm addressed by EU media laws were accompanied by changes in how responsibility for preventing or mitigating harm is attributed. As evidenced here, responsibility for preventing harm has become increasingly distributed. The TWFD and early versions of the AVMSD located the duty to prevent harm to consumers within the editorial responsibility of the audiovisual media services. Underpinning this was the understanding that where the prevention of harm is under the control of services, a clear line can be drawn between the responsibility of the service providers and enforcement by regulators that should lead to the prevention of that harm. With the 2018 AVMSD a new kind responsibility was established that reflected the different level of control that VSPs had over the content disseminated on their services. Instead of relying on editorial responsibility, the rules set out an expectation that VSPs have an organisational responsibility to take mitigation measures and provide tools to users as part of cooperative responsibility for managing the risk of harm.Footnote ⁸⁴ The DSA involves users not only in their own personal protection but also in the prevention of wider societal harms from very large services, and it introduces external auditors, trusted flaggers, civil society stakeholders, and ‘vetted researchers’ into the mix. The EMFA explicitly gives responsibility to researchers and civil society watchdogs to contribute to enforcement.

It seems appropriate to the scale and nature of media and services that responsibility for the prevention of harm is shared or distributed among multiple actors. With this comes the recognition that complete prevention is not likely to be achievable, and hence the approach of EU policy has shifted to risk mitigation. For it to be effective, however, the responsibility needs to be truly cooperative and not only distributed. How to achieve this should be the next priority in thinking about EU media law. Two issues need attention: the institutional architecture operationalising cooperative responsibility and the information asymmetry that persist among actors with responsibility.

The institutional architecture includes the bodies involved and the allocation of responsibility and roles among them. Of course, some of this is already in place. The AVMSD set up a body and mechanism for cooperation among national regulators that was upgraded by the EMFA. The DSA establishes a similar body of Digital Service Coordinators that has meaningful powers, a requirement for external audits, roles for civil society, and a mechanism for vetted researchers to get access to data for the purpose of monitoring and understanding systemic risks. The EMFA also outlines expectations for civil society actors and expert researchers in implementation as monitors and watchdogs. Individual and institutional users are attributed responsibility as well. There are significant imbalances in power and capacity among the various actors, and, very importantly for the prevention of harm, they have differing degrees of control over the sources of risk.

In thinking about EU media law there is a need to consider how to redress the imbalances of power proportionate to the expectations of responsibility and how to design mechanisms to enable cooperation. For example, codes of conduct designed by services and civil society stakeholders can be mechanisms for cooperation and are foreseen as playing a role in risk mitigation under the AVMSD and the DSA. What institutional arrangements are needed to ensure that civil society organisations are involved at an equal level with the services and can engage effectively in monitoring? Another example of a potential cooperation mechanism is in the use of external auditing as prescribed by the DSA. As it is currently set up, the conduct of audits is largely confined to the big auditing companies in a highly concentrated audit market.Footnote ⁸⁵ How can this process of auditing be made more inclusive? How can users and civil society organisations be brought into the processes?

Another challenge is in precisely defining the roles of the various actors in relation to risk mitigation, and this will need to consider the differing levels of control these actors have and the severity and nature of the harm. For some types of harm, a precautionary approach is merited and the responsibility for mitigating it must necessarily be more concentrated in the hands of those with the power to prevent harm quickly. As this chapter has demonstrated, the distinction between push media and pull media remains as relevant in current EU media law as it was over thirty years ago. It is fundamentally about the extent to which those who might be harmed can prevent that harm, and in EU media law the link between control over the risk of harm and responsibility remains consistent.

In 1989, there was not conclusive evidence that exposure to violent content or surreptitious advertising had negative effects; but because consumers had little control over their exposure to it, the TWFD required those with editorial control to prevent their exposure to it. Where there was an assumed greater risk of harm, such as from illegal hate speech or pornography, outright bans were put in place and services held responsible for compliance. As consumers had more control in relation to pull or on-demand services they also gained more responsibility for preventing harm to themselves (or to minors for whom they are responsible), leading to a lesser need for precaution, except perhaps in relation to vulnerable consumers.

It has been argued that when it comes to protecting the rights of the child,Footnote ⁸⁶ or preventing negative effects on public health,Footnote ⁸⁷ there are limits to the reliance on individual choices; in such cases, actions and a precautionary approach are needed. Individual user may be able to protect themselves from exposure to content available on video-on-demand services if given a clear content warning or rating system, but given the new vulnerability of all consumers in the face of platform architecture constructed to exploit their vulnerabilities and the relational asymmetries,Footnote ⁸⁸ there are limits to the effectiveness of user responsibility across the variety of harms now covered in EU media law.

The DSA addresses this to some extent by requiring very large services to mitigate risks in things they control such as their interface design, organisation, recommender algorithms, and targeting tactics, and through outright bans on targeting based on sensitive personal data. The TERREG and the DSA also seem to represent a precautionary approach to harm to individuals and society from illegal content. They require proactive identification and removal and, bringing in a role for state bodies, they set out rules for responding to illegal content orders. However, among the sources of harm now addressed by EU media law are sources that are external to platform and media services themselves. Mitigating risks of societal harm, such as to democracy, to public health, or to the independence of public media, will require other actors to be heavily involved. What tools will those actors need in order to contribute, and what mechanisms of cooperation are needed to enable that?

Information asymmetry is a contributing factor in the power imbalances that are plaguing the institutional architecture of distributed responsibility for harm prevention. Access to information is very important to all actors that have responsibility for preventing harm, especially wider societal harm. Despite some moves to address information asymmetry, this remains a critical issue for EU media law.

As it distributed some responsibility to users, the AVMSD had some provisions intended to give access to certain information, for example about the content that users were expected to engage in protecting themselves from and about the terms and flagging mechanisms of VSPs. The AVMSD’s approach to VSPs defined the relationship with national regulators as one of procedural accountability, which differed from the responsibility they had over audiovisual media services, but it did not address information asymmetry between the VSPs and the regulators. The DSA in some ways filled that gap but still leaves holes.

A lot is riding on the DSA’s requirements for transparency in certain key areas, its provisions on data access for vetted researchers, and the investigatory powers granted to the national Digital Service Coordinators and to the European Commission.Footnote ⁸⁹ The EMFA also institutes a media ownership register and some transparency in advertising and audience measurement. In both cases, civil society stakeholders are expected to play significant roles in ensuring effective implementation of the law. While the DSA and the EMFA have created some unprecedented transparency, there are insufficient guarantees of access for civil society to information or other service-produced data and regular public disclosure requirements in EU and Member State law (such as reporting requirements for public service media or regulators). At the same time, the capacity of the vast array of civil society actors and academics who have interest and expertise in all of what is now covered by EU media law is extremely varied. Work needs to be done on what information access and resources are needed by all those with some responsibility for preventing harm and how EU media law can enable it. The foundations are there, but the extent to which cooperative responsibility can mobilise to effectively prevent harm to individuals and to wider society remains to be seen.