The Great Data Standoff: Researchers vs. Platforms Under the Digital Services Act

TL;DR

The paper tackles the gap between the DSA's promise of data access for vetted researchers (via Article $40(4)$) and the practical hurdles created by vague systemic-risk definitions and opaque platform data practices. It uses the 2024 Romanian presidential election interference as a case study to map concrete data needs for analyzing two systemic risks—platform manipulation and hidden advertising—against TikTok data sources (platform documentation, data donations, and the TikTok Research API). The authors synthesize insights from law, computer science, and platform governance to propose a taxonomy of data types and to critique current access mechanisms, highlighting gaps that hinder cross-platform, evidence-based assessments of systemic risks. They argue for clearer definitions of systemic risks, better data inventories across platforms, and stronger cross-stakeholder collaboration to reduce the data-access standoff and improve governance transparency.

Abstract

To facilitate accountability and transparency, the Digital Services Act (DSA) sets up a process through which Very Large Online Platforms (VLOPs) need to grant vetted researchers access to their internal data (Article 40(4)). Operationalising such access is challenging for at least two reasons. First, data access is only available for research on systemic risks affecting European citizens, a concept with high levels of legal uncertainty. Second, data access suffers from an inherent standoff problem. Researchers need to request specific data but are not in a position to know all internal data processed by VLOPs, who, in turn, expect data specificity for potential access. In light of these limitations, data access under the DSA remains a mystery. To contribute to the discussion of how Article 40 can be interpreted and applied, we provide a concrete illustration of what data access can look like in a real-world systemic risk case study. We focus on the 2024 Romanian presidential election interference incident, the first event of its kind to trigger systemic risk investigations by the European Commission. During the elections, one candidate is said to have benefited from TikTok algorithmic amplification through a complex dis- and misinformation campaign. By analysing this incident, we can comprehend election-related systemic risk to explore practical research tasks and compare necessary data with available TikTok data. In particular, we make two contributions: (i) we combine insights from law, computer science and platform governance to shed light on the complexities of studying systemic risks in the context of election interference, focusing on two relevant factors: platform manipulation and hidden advertising; and (ii) we provide practical insights into various categories of available data for the study of TikTok, based on platform documentation, data donations and the Research API.

Figures (1)

• Figure 1: Availability of TikTok data for studying systemic risks in Romanian election interference incidents under existing access mechanisms, classified by data type and access method. Nested circles represent data categories with individual data points inside. Colours indicate accessibility, ranging from green (fully available via the Research API or data donations) to purple (entirely inaccessible to researchers), with intermediate shades representing partial access. The analysis highlights critical gaps in access, particularly in user attributes, algorithmic recommendations, and content moderation decisions, which limit researchers’ ability to investigate the systemic risks described in our scenarios.