DSA recommender transparency FAQ

Article 27 applies to providers of online platforms that use recommender systems. The DSA defines a recommender system as a fully or partly automated system that suggests information, prioritises it, or determines the relative order or prominence of information in the platform interface.

The platform must set out, in its terms and conditions and in plain, intelligible language, the main parameters used by the recommender system and any options recipients have to modify or influence those parameters. Article 19 can exclude qualifying micro and small online-platform providers from Article 27, subject to the post-loss transition and the rule that designated VLOPs remain covered.

Operational example: for a feed that ranks by recency and followed accounts, the record could identify those two criteria, explain that followed accounts receive more weight because the feed is intended to show updates from people the recipient chose to follow, and list the controls that change that preference. Product and data-science owners should confirm that this explanation matches the live system before legal approval. Replace the example criteria and rationale with the service's actual behaviour.

Article 27 distinguishes between disclosure of options and in-product functionality. If several options are available for a recommender system that determines the relative order of information, the platform must let the recipient select and modify the preferred option at any time.

That control must be directly and easily accessible from the specific part of the online interface where information is being prioritised. A buried account setting is weak evidence if the ranking choice is presented somewhere else.

Article 38 adds a separate requirement for providers of very large online platforms and very large online search engines that use recommender systems. In addition to Article 27, they must provide at least one option for each recommender system that is not based on profiling under the GDPR definition referenced by the DSA.

Profiling here means automated processing of personal data to evaluate personal aspects of a natural person, including analysis or prediction of interests, behaviour, location, or other listed characteristics. A provider should test the actual data and logic behind the option; a label such as 'chronological' or 'non-personalised' does not by itself establish that the option is not based on profiling.

The 45 million average-monthly-active-recipient threshold informs designation, but Article 38 applies after the Commission designates the service as a VLOP or VLOSE. For those designated services, the recommender inventory should show each recommender system and its matching non-profiling option.

Keep evidence showing that the public disclosure, live user interface, and recommender implementation describe the same system. For VLOPs and VLOSEs, DSA risk assessment, mitigation, audit, and data-access provisions can require explanations of algorithmic-system design, logic, functioning, and testing.

Use the product's actual criteria and records rather than an assumed scoring formula: the criteria that matter most, why they have their relative importance, the UI choices available to recipients, and the releases that changed the disclosure.