Article 40

In 2022, the European Union passed a law setting rules for large internet services. It is called the Digital Services Act, abbreviated DSA. Every law is divided into numbered sections called articles. Article 40 is the section dealing with access to data. It obliges very large platforms such as Instagram, TikTok, or YouTube to give researchers insight into their internal data. This includes, for example, information on how often a post was displayed or how it was spread.

Why researchers were left in the dark without Article 40

For years, there was a fundamental conflict. Politicians and the public accused platforms of favoring hate speech, disinformation, or content promoting eating disorders. This was hard to prove, since the necessary figures were held exclusively by the companies themselves. Anyone wanting to check whether an accusation was true depended on voluntary disclosures.

This voluntary approach proved unreliable. Twitter shut down its free data access in 2023, causing numerous research projects to end. Facebook discontinued its own analytics tool for researchers. In other cases, companies provided data that later turned out to be incomplete. Article 40 reverses this relationship: access is no longer a favor, but an obligation.

This is also practically important for regulators. The EU Commission can impose fines on platforms if they fail to sufficiently mitigate societal risks. Such proceedings require evidence. Independent studies provide exactly the basis on which an accusation can be upheld or refuted.

The path from application to dataset

Data is not given to just anyone who asks. One must apply for the status of a vetted researcher, as the legal text calls it. A national authority is responsible—in Germany, the Bundesnetzagentur (Federal Network Agency). It checks whether the applicant works at a research institution, is independent of commercial interests, and can securely store the data.

The application must specify a concrete research objective. Only investigations into so-called systemic risks are permitted. These include, for example, dangers to the mental health of young people, the spread of illegal content, or attempts to manipulate elections. Market research for a company is explicitly excluded.

If the application is approved, the platform must provide the data within a reasonable period. It may only refuse in narrow circumstances, such as when the security of its service would be threatened or trade secrets would be exposed. Users' personal data is anonymized beforehand or transmitted only in aggregated form. A second, simpler route is open to everyone: platforms must make publicly visible data, such as the reach of a post, accessible without any vetting procedure.

What makes it into the news

Article 40 usually appears in news reports when there is a dispute. The EU Commission has opened proceedings against X, formerly Twitter, and against TikTok, which among other things concern insufficient data access for researchers. The potential fines amount to up to six percent of global annual revenue. For a company like Meta, that would mean billions of euros.

The article also forms the basis for studies that get reported on. When a study shows how often certain content is recommended to young people, the figures increasingly come from such data access provisions. Before the DSA, this could at best have been estimated.

A common misconception is that Article 40 gives every citizen access to platform data. That is not true. Vetted access is limited to research institutions and tied to an approved project. Nor does the rule apply to every website. The strict obligations apply to very large platforms with more than 45 million users in the EU, not to a small online shop.