Section 1 - Introduction and Problem Statement
Against the backdrop of Article 34 and the wider Digital Services Act (DSA), I believe that algorithmic decisions, engineered by the systems that generate them, threaten democratic life. I show how that harm is caused, why it sits at the threshold where democracy's thin minimum conditions cease to hold and how that threshold can be measured to assess how close to collapse democracy is.
Digital media platforms, news aggregators and administrative systems have manoeuvred the democratic state into a position where it is almost blind: barely able to recognise whether citizens are exercising agency in the space of reasons. Platforms provide a semblance of interaction. The space of reasons within which political content is selected is reduced to the point where our capacity to contest it becomes restricted. Algorithmic curation, in exercising power, has not closed the space of reasons outright, yet. For digital platforms to survive and grow the traffic passing through their systems, they must provide a minimal illusion of choice. In 2026, platforms edge us towards closure of the space of reasons while a thin, phenomenal residue of participation remains, present in the feed and in the like, but absent from the reasoning that put us there.
There is a need to make a distinction between the harm courts address and the harm I expose. Platforms continue to be subjected to legal pressures. These address almost entirely the individual harms such as addiction and impact on mental health caused by the operation of the platforms. The argument runs ‘a particular law or statute was not complied with which has resulted in measurable harms’. Currently, Meta are facing civil charges focused on privacy violations under COPPA (Children’s Online Privacy Protection Act), design and deployment of harmful platforms and deceptive statements (essentially claiming that there was no harm when internal communications flagged this on numerous occasions) (In re Social Media Adolescent Addiction/Personal Injury Products Liability, 2026, pp. 3–5) [hereafter In re Social Media Litigation]. Such accountability works at the phenomenal level. There is a named harm, attached to an established law with identifiable claimants. In the Meta case thousands of individual claims are collapsed into one case. This form of accountability is not trivial. Financial penalties can reach hundreds of millions of euros: in 2024 the European Commission fined Meta €797.72 million for abusive practices benefitting Facebook Marketplace (European Commission, 2024b). Where such penalties are capped at a fraction of turnover, they can be viewed as a function of the cost of doing business rather than a constraint on it, what Pasquale terms treating “the resulting fines as a (trivial) cost of doing business” (Pasquale, 2015, p. 144). Alongside them, court documents expose internal methodology that would otherwise stay proprietary.
Litigation does not reach the harm I am concerned with. What it exposes, through discovery, is evidence of it. Meta's own internal documents describe its headline harm-reduction features, Quiet Mode and Take a Break, as tools that "served as proof points but were not effective at reducing behaviors" (In re Social Media Litigation, 2026, p. 17), while a separate internal document frames teenage sensitivity to dopamine not as a risk to be managed but as something that "presents opportunities for us" (In re Social Media Litigation, 2026, p. 18). The intention recorded in Meta's own documents is not ignorance of harm managed poorly. It is engagement pursued deliberately, including a documented decision to reduce advertising load specifically for teenage users on Instagram Reels in order to increase their engagement and "maximize long-term revenue growth" (In re Social Media Litigation, 2026, p. 21). The end point of that intention is a visible tool of reduction sitting alongside a design practice moving in the opposite direction: toward more engagement, not less. That gap between the phenomenal gesture of harm reduction and the substance behind it is not evidence of negligence, an act of omission. It is evidence of a choice, an act of commission, sustained without justification to those it affected. This is a defining feature of domination, not non-compliance. Democratic harm, in my focus, does not register as an injury to identifiable individuals. The harm operates on the space of reasons itself, settling what counts as participation before a post is written or a feed is scrolled.
My starting point is Diamond and Morlino's definition of vertical accountability. This provides the lens for where and how the harms occur. In their account it is "the obligation of elected political leaders to answer for their political decisions when asked by voters or constitutional bodies" (Diamond and Morlino, 2004, p. 25). Whilst the original framing runs in one direction, "from citizens to leaders" (Diamond and Morlino, 2004, p. 25), the communication is better considered as bidirectional, between citizen and state. The two directions of this channel correspond to what Pettit calls being authorised "as a voice worth hearing and an ear worth addressing" (Pettit, 2002, p. 350). We are heard when raising a demand and addressed when power is justified. Platforms can be interpreted as threatening both. This bidirectional channel is now compromised by algorithmic interference in two broad areas of life. First, the increasing application of algorithmic decisions within civic systems such as welfare, health and policing. Second, the redirection of answerability towards curated platform content, displacing the citizen as the party owed a response. Platforms thereby come to occupy part of the position Diamond and Morlino assign to those who govern, exercising power over citizens' political judgements while owing them no account of it. The first of these areas is one for future development, adapting the model I have created to platform behaviour in this paper.
In this I build on Klonick's account of platforms as the "New Governors" of online speech, private systems of governance that write and enforce their own rules and lack direct accountability to their users (2018, pp. 1599, 1603). I depart from her account on two points. First, Klonick finds platforms motivated to reflect their users' expectations because their "economic viability depends on meeting users' speech and community norms" (pp. 1603, 1625). Responsiveness of that kind is not answerability. Where platforms curate content and order feeds, they do not only reflect users' expectations; they help create them and then respond to what they have created. That circularity goes to the heart of domination in the space of reasons and it is the managed performance of responsiveness I describe below. Second, her remedy lies in changes to the platforms' own architecture and governance (p. 1603). The DSA audit record examined in Sections 3 to 5 shows what follows when the governed party also authors the benchmarks it is measured against. The Harm Index therefore tests for what internal reform cannot supply: an addressee outside the platform and standing to contest its rules.
To be a democracy, even at its thinnest point, we must establish that there is an identifiable space and route providing the phenomenal measure point, capable of establishing that there is communication. In keeping with my thin concept, this provides a simple but powerful test: either there is communication or there is not. Where there is no communication, we cease to be acting within a democracy and leave the assessment of how weak democracy is behind. Being a phenomenal measure, Diamond and Morlino's framework does not examine whether the conditions that make this capacity possible in the first place are themselves intact. That gap can appear even where communication looks intact, the online reaction to a newsfeed, for example, regardless of the substance or agency behind that reaction. This is the almost blind, the space between what appears to be a democratic exchange and the reasoning process that produced it. In 2004, that gap was latent rather than active. No agent had the capacity to exploit it at a national or transnational democratic scale.
Applying Forst's concept of noumenal power allows this gap to be treated as more than a technical defect in communication caused by algorithmic process. If it were just a technical issue, a solution could be engineered, closing the gap and solving the problem. The 2026 Meta proceedings, referenced above, show that an engineering solution exists for the phenomenal harms the case targets. What we encounter alongside, however, is a problem within the space of reasons itself, one no equivalent technical fix reaches. Noumenal power operates through justifications that move agents to think or act in ways they otherwise would not (Forst, 2017, pp. 39, 49). Platforms structure what is experienced, when it is experienced and how frequently the experience arrives. Forst is explicit that this power is not itself a normative verdict: it "can be the power of a good or a bad teacher... of a liberating revolutionary or a dictator" and "the concept of power itself determines neither the evaluation nor the means used to move someone to think or to do something" (Forst, 2017, p. 49). Platform engagement sits closer to the dictator end of that spectrum than the good teacher end. ‘Teacher’ in that we are provided with content that informs. ‘Dictator’ in that the logic determining what we receive is set by weightings we cannot see, did not consent to and have no standing to contest, regardless of whether that logic happens to serve our interests. Power can also be exercised through physical force, a limiting case that in its extreme form lies outside the realm of power altogether and reflects instead the lack of it (Forst, 2017, p. 50). Physical domination and noumenal domination are not the same operation. Physical domination bypasses the space of reasons. It requires no belief or consent, nothing but bodily compliance, which is why Forst locates it outside the realm of power altogether. Noumenal domination works the opposite way. It does not need to compel the body. It captures the space of reasons itself, producing belief or acceptance without ever needing to force it, so that what looks like reasoning from the inside was never open to genuine contest. What distinguishes legitimate exercises of noumenal power from illegitimate ones is not its presence, no society is free of it, but whether the justifications it rests on remain open to contest and revision. Power that persists through comprehensive, structuring justifications Forst calls rule, and rule "can be well justified or it can rest on bad justifications". Where those justifications close off contestation entirely, presenting an asymmetrical relation as natural, unalterable or simply given, and leave those subjected no real alternative, the result is domination (Forst, 2017, p. 49). What I expose in applying my Harm Index, in Sections 3 and 4, is how platforms move towards dominating the space of reasons.
This positions the democratic danger along a continuum rather than at a single, absolute break, even though at the very end of that continuum a break does exist, the move from noumenal to dominating. At the reciprocal end, communication is genuinely two-way: citizens can contest reasons, question justifications and have what Forst calls "standing as equal normative authorities", the co-authors of the order that governs them (2017, p. 43). As democracy slips, communication remains formally intact but becomes increasingly managed and asymmetrical, moving toward other-defined rather than co-determined rules of justification. ‘Other-defined’ refers to the weightings and rules which determine what I see and do. At the thin end of the continuum, democracy is not simply weak and asymmetrical. It is threatened. As the asymmetrical nature of the space increases, this threat moves closer to the point of domination. The communicative appearance of accountability persists while the reciprocal conditions that make accountability democratic have been hollowed out.
This is the lens through which the gap I have identified should be read. The issue is not whether communication occurs, in its broadest sense it does, but whether it remains reciprocal, preserving citizens as equal normative authorities. A citizen may subscribe, like or post content but if the algorithmic structure has already determined what will count as meaningful input, the exchange is communicative in form while structurally non-reciprocal in substance. In Forst's terms, that is the beginning of domination: a justificatory order in which the subject is still addressed, but not as an equal participant in the practice of justification (Forst, 2017, pp. 43, 49). The democratic form remains visible but its noumenal basis has been thinned to the point where communication becomes less a relation of co-authorship than a managed performance of responsiveness. Structures, as well as people, sustain this thinning without needing to argue for it afresh each time. They reproduce themselves by “suggesting that how they function is ‘natural’”, so that "a 'second nature' can develop" and "the normative power of the factual is reproduced" (Forst, 2017, p. 46). Seen this way, the problem is not that democracy disappears all at once, as in a more noticeable event such as a coup, but that it is gradually hollowed out as communicative channels persist while the justificatory space becomes increasingly asymmetrical, closing off the possibility of reciprocal critique and meaningful contestation.
Algorithmically driven systems now exercise exactly this kind of noumenal power in two directions: an upward harm, in which commercial recommender architectures pre-structure the preferences and beliefs citizens bring to political life before any institutional accountability process engages them, and a downward harm, in which the state's exercise of power is driven by shielded proprietary architecture, disclosure exemptions and outright obfuscation. All are corruptions of vertical accountability and are not currently held to account. Existing measurement work maps algorithmic threats to democracy across three democratic domains at once (Sandri and Novelli, 2026, p. 7). To my knowledge, no framework yet tests, against live records, whether the minimum conditions for contesting algorithmic power hold. What is required is a Harm Index. My paper builds one, deliberately constrained to three indices rather than many more. A model with too many indices invites disagreement over definitional detail rather than over the substance of the harm itself. A thicker model, built for the full range of democratic typologies, can follow, but only once a thin model has proven it can measure that edge before it erodes further. My three indices are Purpose, Petition and Peer: whether a system's governing logic can be identified, whether there is a working route to challenge it and whether those subject to it have any standing in writing its rules. Using the European Union's Digital Services Act (DSA) as a live case, I show that current verification is not yet the foil to platform self-assessment it claims to be.
The European Union's DSA (Regulation (EU) 2022/2065) is a highly developed, real-world attempt to operationalise an approach resembling the Purpose index my framework specifies. Very large online platforms (VLOPs) and very large online search engines (VLOSEs) must conduct annual systemic risk assessments under Article 34, adopt mitigation measures under Article 35 and submit to independent audits under Article 37, with the resulting risk assessment reports, audit reports and audit implementation reports made public under Article 42. Since the first publications in 2024, this has produced two full rounds of published reporting across nineteen platforms (Albert, 2025), a body of dated material against which any proposed measurement instrument can be tested.
Using the model, my paper answers two questions. First, can a Harm Index built to operationalise Purpose be applied to real reporting, rather than remaining a set of illustrative indicators? Second, does the DSA's current audit architecture, in which each platform selects and pays its own auditor, achieve anything resembling the cross-platform concurrence an external verifier is supposed to provide, or does it only look like it does, providing phenomenal outputs that lack substance? My first question is a methods check. The second is my contribution to the problem of measuring democratic harm at the edge. My answer is that a Harm Index can be applied. In answering the second question, it does not achieve concurrence. Verification under the DSA is inconsistent from platform to platform, but the deeper problem is what I call coordinated restraint rather than the absence of common standards: one auditor who broke from that coordinated approach was replaced in the following reporting round (Albert, 2025). Sections 3 and 4 examine how aspects of the DSA's architecture function as work-arounds that auditors and platforms have used to their advantage.
I proceed as follows. In Section 2 I create and explain the Harm Index applying three indices, Purpose, Petition and Peer. Section 3 sets out the DSA's own audit architecture: how a finding is reached, what a disclaimer means and why my model scores it as it does. Each of the twelve indicators is mapped onto specific Articles that generate evidence for it, providing the evidentiary foundation the test cases in Section 4 applies. In Section 4 I apply the Harm Index to published risk assessment and audit reports from three VLOPs across both DSA reporting rounds. Section 5 analyses what the test case shows about the audit architecture as a whole, beyond the three sampled platforms. Section 6 states the limits of the exercise. Section 7 concludes.
Section 2 - The Harm Index and Digital Services Act
Following Goertz's (2006, pp. 35 - 39) account of concept structure, the Harm Index adopts a necessary-and-sufficient design. The concept is democratic standing, in Forst's sense of standing, as equal normative authorities within an order (2017, p. 43), with the indicators designed to capture the status of that standing. I ask whether a system meets the minimum conditions of a contestable space of reasons for those subject to it. The Harm Index measures that standing, with harm being the concept’s failure. It has three parts, each measured by an index: Purpose (architectural transparency), Petition (justificatory addressability) and Peer (minimal co-authorship). Each is necessary and none can substitute or add weight for another. Together, for the minimal concept the Index measures, they are sufficient. In Goertz's terms, the indices are joined by logical AND rather than OR, with AND taking the minimum (p. 40). The Index does not follow what Goertz calls an ‘m-of-n’ rule, under which a case qualifies by meeting enough conditions, any of which may be missing (p. 36). All three indices must be met for standing to hold.
The score is read through two tests, each dichotomous; together they yield a three-valued score. At the threshold, the question is whether standing exists at all: if any index fails, the system scores 0. Above the threshold, the question is how securely standing holds: precariously, at the edge of domination (1) or securely (2). The same rule governs both. Each indicator is coded 0, 1 or 2. Each index score is the minimum of its indicators, with the headline score being the minimum across the three indices, not their sum or average. Figure 1 sets out this structure, adapting Goertz's notation (2006, p. 61). Figure 2 shows how the score is read, as two successive tests, each an AND across the three indices. The first is the threshold: standing holds only if all three indices score at least 1; a system failing it scores 0 (Figure 2a). The second applies only where standing holds and asks whether it is secure: if all three indices score 2, the system scores 2; otherwise, 1 (Figure 2b). The two tests together are equivalent to taking the minimum. No step involves substitution, so no indicator can compensate for another (p. 46): at every level, a part either meets the condition or the whole fails it. In operational terms, the trigger for further attention is always the lowest score. A strong score elsewhere does not offset a weak one; it is the weakest indicator that sets the system's overall result. Table 2.1 shows the threshold test and Table 2.2 the combined outcomes across the graded scale.
Figure 2a. Does standing hold? Figure 2b. How secure is standing?
Table 2.1. Threshold test: does standing hold?
| Purpose Holds | Petition Holds | Peer Holds | Standing Holds |
|---|---|---|---|
| F | F | F | F |
| T | F | F | F |
| F | T | F | F |
| F | F | T | F |
| T | T | F | F |
| T | F | T | F |
| F | T | T | F |
| T | T | T | T |
Note: T = the index holds (scores 1 or 2); F = it fails (scores 0). Standing holds only when all three indices hold (logical AND); otherwise D = 0. All eight combinations are shown.
Table 2.2. Combined outcomes across the graded scale
| Purpose | Petition | Peer | D |
|---|---|---|---|
| 0 | 0 | 0 | 0 |
| 0 | 2 | 2 | 0 |
| 2 | 0 | 2 | 0 |
| 2 | 2 | 0 | 0 |
| 1 | 1 | 1 | 1 |
| 2 | 1 | 2 | 1 |
| 2 | 2 | 1 | 1 |
| 2 | 2 | 2 | 2 |
Note: D is the minimum of the three index scores: 0 = domination, 1 = precarious, 2 = secure. Rows are selected to show the rule: a single failing index sets D to 0 and below the top band the weakest index sets the result.
Because this Index is calibrated to work at the edge of democracy, that one weak indicator is not simply a minor technical shortfall. It is exactly the kind of gap through which democracy's thin minimum conditions begin to erode. A supplementary breakdown, showing every indicator within each index, may be reported alongside the headline score, but only as a diagnostic map showing where that trigger sits, not as a substitute for the headline figure itself: a system scoring well across Purpose and Petition while scoring 0 throughout Peer has not achieved the reasonable overall position a summed or averaged score would suggest, it has failed categorically on one index and the headline score must show that failure rather than dilute it. This distinction matters practically as well as conceptually. Locating exactly where the trigger sits, whether Purpose is low while Petition and Peer are high, or the reverse, allows repair to be targeted at the specific indicator, the index, or the system as a whole, rather than treated as a single undifferentiated deficiency. As I show in Sections 3 and 4, this matters directly to how exclusions within an audit are scored. Where an area is audited but a decision is made to exclude it from the scope of what the audit examines, for instance, an area under active EU investigation that auditors have been advised to leave untested, that exclusion is not an absence of information. It is a choice made within a process that otherwise occurred. Recording it as null would treat it as data that does not exist, letting it fall outside the minimum-aggregation logic I apply and disappear from the headline score exactly where the trigger is most needed. Recording it as 0 keeps it inside the calculation, consistent with the criteria already set out: no independent verification occurred for that area, which is the condition a 0 is defined to mark, regardless of whether the absence resulted from the area never being scoped in or from a decision to scope it out mid-process.
My Harm Index is applied at the level of the individual system. In the DSA context, the individual platform's audited service is the unit of analysis, rather than the company that may control several platforms. A single company can operate one well-governed system and one badly governed system in parallel, in the same way a state can hold free elections while operating a captured judiciary. Collapsing multiple platforms or apps into a single company-level or country-level score would lose the information my Index is designed to expose. System-level scores can be aggregated, by company or by jurisdiction, but the base unit of measurement remains the system, scored on three indices.
Each index asks one question. Purpose (architectural transparency) asks whether a system's governing logic can be identified with sufficient clarity, by those affected by it, to be challenged. Petition (justificatory addressability) asks whether there exists an external party, beyond the system's own operator, powerful enough to receive and act on an individual's demand for justification. Peer (minimal co-authorship) asks whether those subject to a system have any structural standing to contest the rules that govern it, as distinct from contesting individual outputs the rules produce. Each formal term and its shorthand are used interchangeably throughout what follows.
Keeping with the thin end operationalisation, three tests govern selection for the indicators. First, an indicator must correspond to a failure mode already documented in practice rather than just being conceivable. This keeps the Index focused on what issues exist, rather than what might happen. As a developmental model, failure modes not yet documented can be folded into future iterations of the Index as they emerge and as the DSA or other system applies. Second, an indicator must be scoreable by a party outside the system under scrutiny, using evidence that party can realistically obtain. My Harm Index uses published, dated, citable material, transparency reports, audit reports and regulatory submissions, rather than internal documentation. Third, a score of 0 must mark a state meaningfully closer to the unaccountable exercise of power, not merely to suboptimal or unpolished practice, so that the Index registers categorical gaps rather than differences of degree. A system that discloses its logic in slightly less detail than a competitor is not, on that basis alone, closer to democratic harm, but a system with no independent verification of its declared logic at all is. For the same reason, each indicator is scored on a three-point scale rather than a finer one: the three points mark three qualitatively distinct institutional states, absent, reactive and proactive, rather than gradations of quality an external verifier cannot reliably distinguish. The evidence for each indicator, and why it earned its place against these three tests, is given where that indicator is introduced below.
My indicator-based approach adapts the method proposed by Sandri and Novelli (2026), who frame AI's threat to democracy as a principal–agent delegation problem and propose institutional assessability as the central condition for democratic control: ex-ante documentation of how a system works, ex-post reconstruction and verification by independent experts, and contestability (p. 10), operationalised through observable, largely publicly available indicators (pp. 7, 13). As I show, self-reporting in respect of the DSA creates opportunities for reinterpretation of what evidence counts. The Harm Index shares a commitment to externally verifiable, dated evidence. It differs from Sandri and Novelli in two respects that matter for what follows: it specifies an aggregation rule, taking the minimum (see Figures 1 and 2), where Sandri and Novelli leave aggregation unspecified, so that strength on one dimension cannot compensate for failure on another. This is deliberately narrower in scope, three indices rather than a cross-domain framework spanning information ecosystems, elections and public administration, in order to test whether a thin model can be applied to a single, active regulatory case rather than illustrated across several at once.
Table 2.3 tests the indicators for Purpose. It asks five questions:
- Disclosure: has detail been provided on how the system works and was it offered freely or only when someone asked?
- Independent verification: has anyone checked the disclosure is accurate and does that happen routinely or only after something's gone wrong?
- Public availability: how easily can results of verification be accessed?
- Methodological concurrence: are all systems measured against the same, externally set rules, or does each get judged by its own?
- Depth of verification: was the system's logic checked, or simply confirmed to exist?
Table 2.3. Purpose (Architectural Transparency) - whether a system’s governing logic is disclosed, verified, visible, consistently benchmarked and genuinely examined
| Indicator | Scoring Guidance (0 / 1 / 2) |
|---|---|
| Disclosure of optimisation objective or declared decision logic | 0: Not disclosed even on request 1: Disclosed reactively, on request or under legal challenge 2: Disclosed proactively on a continuous reporting cycle |
| Independent verification of declared logic against operation | 0: No independent verification exists 1: Verification occurs only after a specific complaint or incident 2: Routine, continuous verification independent of complaint |
| Public availability | 0: Findings not published 1: Findings available only via request (e.g. Freedom of Information) 2: Findings proactively published on a fixed cycle |
| Methodological concurrence across subjects | 0: No common standard exists; each subject’s verification is conducted against criteria that subject, or its own hired verifier, was free to define 1: A common procedural framework applies (e.g. a shared assurance standard) but substantive benchmarks remain subject-defined 2: Verification is conducted against a common, externally specified substantive standard applied consistently across subjects |
| Depth of verification | 0: Verification confirms only that a stated control or piece of documentation exists 1: Verification confirms the control produces some observable effect, without characterising the underlying logic or measuring the effect’s size or direction 2: Verification characterises the actual ranking, weighting or optimisation logic, or draws on the system’s own internal experimental evidence (e.g. holdout-group testing) |
Methodological concurrence tests something the other indicators do not directly capture. Transparency is usually understood as a property of the relationship between a single system and a single observer: is enough disclosed, verified and published for that observer to form a judgement. Where many structurally similar systems are subject to the same disclosure regime, a further question arises: are those systems being measured against a shared standard, such that a given score for one system means the same thing as an equal score for another, or is each system’s verification conducted against a benchmark that system, or its own hired verifier, was free to define for itself.
A system can score well on disclosure, verification and public availability for every subject individually, while still failing to produce comparable information across subjects, if the standard against which each subject is verified is not itself held constant. This is a practical concern. Four platforms in the DSA's first reporting round, AliExpress, Facebook, Instagram and TikTok (Albert, 2025), received a Disclaimer of Opinion on their systemic-risk obligations (Articles 34 and 35), meaning their auditor declined to state any conclusion at all, positive or negative, because a European Commission investigation was open at the time. This was not four auditors independently reaching the same judgement. The European Contact Group, the industry body representing the major firms conducting DSA audit work, has set out the position that auditors should in many cases refrain from concluding where the Commission is investigating, an approach already evident in the first cycle and restated in guidance updated in 2025 (Albert, 2025). A coordinated industry position on when not to exercise the judgement Article 37 exists to require, not an absence of standards but an agreed one. The DSA's audit regime, structured to permit this, even while formally requiring disclosure, verification and publication from every subject, has not delivered architectural transparency in the sense my thin standard requires; it has delivered nineteen separate bilateral relationships between platforms and their chosen auditors, applying the common vocabulary of a single regulatory framework. Nineteen private conversations do not add up to one public safeguard.
Depth of verification tests something distinct from methodological concurrence. Both can fail independently of one another. Concurrence asks whether verification is conducted against a shared standard across subjects. Depth asks a prior question of any verification exercise considered on its own: whether it examines what a system’s governing logic actually does, or only whether a stated control exists and produces some observable effect. This focuses on an issue arising from the early stages of the DSA audits. Recommender-system audits under the DSA’s first reporting round were assessed independently by several researchers and the finding recurs across sources that did not coordinate with one another. Bouchaud and Ramaciotti (2024, p. 14), evaluating methodologies used across social media recommender-system audits more broadly, reached a closely related conclusion by a separate route. Reviewing the first round of recommender-system audit findings across platforms, Chapman (2025) found that because platforms and auditors developed their operative definitions independently of one another, comparing the results was, in his words, like "comparing apples to artichokes." What the audits verified, on inspection, tended to be narrower still than inconsistent definitions alone would suggest. YouTube’s auditors reported that they had inspected changes to recommender outputs before and after a user modified a setting and confirmed that the setting influenced the system’s main parameters; Meta’s auditors, examining Facebook, confirmed only that a preference control was accessible from the interface (Solarova et al., 2026, p. 6). Neither exercise characterised the ranking or amplification logic the control was supposed to govern or measured the size or direction of the effect the control produced. This matters. Platforms already hold better evidence than this. Product teams run large numbers of internal experiments against holdout groups every year specifically to measure what changes to recommender design actually do (DSA Observatory, 2025) and this experimental evidence does not appear to be what audits examine. The gap, in other words, is not that the relevant information about algorithmic behaviour does not exist. It is that verification does not reach it. Meßmer and Degeling (2023, p. 2) warned, before the first audits, that the DSA's lack of concrete audit guidelines could foster "audit-washing", that is, "platforms exploiting audits to legitimise their practices and neglect responsibility". The first audit cycle suggests that risk has materialised, and my paper adopts the term for it.
Together, concurrence and depth complete the picture disclosure, verification and public availability leave open. A system can score well on those three, poorly on concurrence because its benchmark is self-defined and poorly again on depth because even its self-defined benchmark was never tested against the system’s actual behaviour. These are three separate ways for a transparency regime to fail while still producing what looks, from the outside, like extensive documentation. As Pasquale warns, transparency may simply provoke complexity as effective at defeating understanding as secrecy itself; transparency is an interim step towards intelligibility, not a substitute for it (Pasquale, 2015, p. 8).
Petition, the second index, asks whether an external party, beyond the system’s own operator, is empowered to receive an individual’s demand for justification and act on it. The DSA captures this indicator. Article 20 establishes an internal complaint-handling mechanism, through which a platform reviews its own moderation decisions; Article 21 goes further, requiring platforms to submit to review by externally certified out-of-court dispute settlement bodies, independent of the platform and accredited by a national Digital Services Coordinator. Initially, this looks like exactly the external addressee my Harm Index requires. It is qualified in one respect that the indicators need to register precisely, Article 21 bodies are expressly barred from imposing a binding outcome. The text states that a certified body "shall not have the power to impose a binding settlement of the dispute on the parties". Platforms must engage with the process in good faith and must report on outcomes as part of their mandatory transparency reporting under Article 24. However, nothing in the Article requires them to implement what the body decides. Pettit draws the same line. Standing requires being able to command attention and respect and "it is not enough that others condescend and confer such attention and respect by way of responding to a supplication or petition" (2002, p. 350). A route of petition that the platform may answer or decline at will does not yet confer standing. Article 21 therefore satisfies the external-addressee half of Petition while falling short, by design rather than by accident, of the enforceability half.
Table 2.4 tests the indicators for Petition. It asks four questions:
- Existence of an external addressee: is there someone to go to who is not the platform itself?
- Enforceability: how binding are remediation requirements?
- Accessibility: is the route free to a genuine complainant, or does cost or complexity stand in the way?
- Outcome reporting: are results published in enough detail to show whether the process actually works?
Table 2.4. Petition (Justificatory Addressability) - whether a working, independent, accessible and accountable route to challenge a system exists
| Indicator | Scoring Guidance (0 / 1 / 2) |
|---|---|
| Existence of an external addressee for individual grievances | 0: No channel external to the system’s own operator 1: Internal complaints process only (DSA Article 20) 2: External, independently certified body empowered to review and rule (DSA Article 21) |
| Enforceability of findings | 0: Advisory only, no obligation on the operator to respond 1: Operator must engage in good faith and report the outcome, but is not required to implement the finding (DSA Article 21’s non-binding standard) 2: Binding finding with a remediation obligation |
| Accessibility of the channel to an individual citizen | 0: Realistically usable only by well-resourced actors 1: Formally open to individuals but carries cost or procedural burden for the claimant 2: Free or nominal-cost, low-barrier, direct individual access |
| Outcome reporting | 0: Outcome statistics not reported 1: Aggregate statistics reported but not broken out by claim type or reversal rate 2: Outcome statistics reported with sufficient granularity to assess whether the channel functions (e.g. reversal rate, response time), consistent with DSA Article 24 |
The fourth indicator, outcome reporting, is included based on the Article 24 requirement that platforms report exactly the data needed to score this indicator as part of their routine transparency reporting. Scoring it requires no separate data-collection exercise. Appeals Centre Europe, one of the certified Article 21 bodies, identifies why this indicator matters in practice. Of 1,565 decisions taken between January and August 2025, 77 percent overturned the platform's original decision, but around two-thirds of those were default decisions, issued because the platform had not supplied the content needed to review the dispute. Where the Centre could examine the content, it overturned the platform in roughly half of cases (Appeals Centre Europe, 2025, pp. 15–16). Where platforms responded, they implemented only around half of the decisions against them (pp. 35, 42). The mechanism can therefore be stalled by withholding content and, when it rules against a platform, declined. A regime can score close to full marks on disclosure of outcomes and still leave the underlying grievance unresolved. Reporting that a decision was overturned is not the same thing as requiring the platform to act on it.
A working comparator is useful to illustrate that the enforceability gap in Article 21 is a design choice rather than an unavoidable feature of external redress mechanisms. The United Kingdom's Freedom of Information Act 2000 gives individuals a structurally similar right: where a public authority refuses or mishandles a request for information, the requester may apply to the Information Commissioner's Office for a decision under section 50. The Commissioner's decision notice is, in the ICO's own description, legally binding (Information Commissioner's Office, n.d.); if a public authority fails to comply, the Commissioner may certify that failure to the High Court, where it may be treated as contempt of court, and either party may appeal to the First-tier Tribunal. The mechanism is not immune to challenge, but the baseline is compliance, not invitation. The contrast with Appeals Centre Europe lies at both ends of the process. Where a public authority withholds the information the Commissioner needs, the Commissioner can compel it by information notice (Freedom of Information Act 2000, s. 51); where a platform withholds the content a dispute body needs, the body can only issue a default decision. Where the Commissioner finds against an authority, the authority must comply; where the Appeals Centre finds against a platform, compliance is the platform's choice. In the cases reported only around half of such decisions were implemented (Appeals Centre Europe, 2025, pp. 35, 42). On the two indicators Article 21 does not fully satisfy, the FOIA/ICO regime scores at the top: an external body independent of the public authority and a finding the authority is legally required to implement. The comparison also bears on the concurrence problem identified in Purpose. FOIA addressability runs through a single statutory regulator applying one consistent standard to every public authority. DSA addressability runs through a range of independently certified ODS bodies, each setting its own procedural rules, which, as one legal commentary reviewing the emerging practice has already noted, "tend to differ between bodies" (Freshfields, 2025). The DSA’s redress architecture is not simply weaker than the ICO model on enforceability. It reproduces, within addressability itself, the same fragmentation the concurrence indicator was built to catch in the audit regime.
Peer, the third index, asks whether those subject to a system have any structural standing to contest the rules that govern it, rather than only the individual outputs those rules produce. This is the index the DSA supports least directly. Co-authorship is the one condition the Act does almost nothing to secure. Two mechanisms bear on it. Article 40 creates two research access routes. Under Article 40(4), on a reasoned request from the Digital Services Coordinator of establishment, platforms must give vetted researchers access to data "for the sole purpose of conducting research that contributes to the detection, identification and understanding of systemic risks" and to assess risk mitigation measures (Regulation (EU) 2022/2065, Art. 40(4)), with researcher status granted against the conditions in Article 40(8). Article 40(12) adds a narrower route, limited to data "publicly accessible in their online interface" (Art. 40(12)). Neither route reaches system logic itself: explanations of the design, logic and functioning of algorithmic systems can be required only by the Digital Services Coordinator or the Commission (Art. 40(3)). Article 48 provides for voluntary crisis protocols, strictly limited to "extraordinary circumstances affecting public security or public health" (Art. 48(1)). The Commission encourages platforms to participate in drawing them up (Art. 48(2)) and "may, where necessary and appropriate", involve civil society organisations (Art. 48(3)), and the protocols' measures are tied to activation in a crisis (Art. 48(4)(b)–(c)). It is a discretionary channel that switches on in extraordinary circumstances rather than a permanent one. Neither mechanism gives an ordinary citizen a route into contesting governing logic directly; both are, at best, proxy channels through which researchers or civil society bodies might do so on citizens' behalf.
Understanding of system logic under the DSA is therefore not absent but tiered. Depth of access increases as distance from the public increases. Individuals receive outputs and summaries through statements of reasons (Regulation (EU) 2022/2065, Art. 17) and the main parameters of recommender systems (Art. 27). The public receives aggregates and audit conclusions (Arts 15, 24(5), 42(4)). Researchers receive data (Art. 40(4), (12)). Only the auditor (Commission Delegated Regulation (EU) 2024/436, Art. 5(2)) and regulators (Regulation (EU) 2022/2065, Art. 40(3)) reach the systems themselves, a version of what Pasquale calls “qualified transparency” (Pasquale, 2015, p. 142). From them, the public receives a conclusion and, where an audit is disclaimed, nothing. The wider public is the DSA's addressee, yet it stands furthest from understanding what it is meant to hold to account.
Table 2.5 tests the indicators for Peer. It asks three questions:
- Contesting channel: is there a route or method to challenge the system logic?
- Independence: is the body undertaking the challenging free of the platform's funding or control, or is it effectively marking its own homework?
- System access: can the system logic be verifiably challenged?
Table 2.5. Peer (Minimal Co-authorship) - whether those subject to a system have any real, independent standing to contest its governing logic
| Indicator | Scoring Guidance (0 / 1 / 2) |
|---|---|
| Permanent channel to contest the governing logic itself, not just individual outputs | 0: No such channel exists 1: Channel exists but is narrow or conditional (e.g. activated only during a declared crisis, as under DSA Article 48) 2: Permanent, general-purpose channel available at all times |
| Independence of any structural-input mechanism from the entity whose systems are contested | 0: Mechanism is internal to, or controlled by, the regulated entity, including where the entity has replaced the mechanism following adverse findings 1: Mechanism is nominally external but selected or funded by the regulated entity 2: Mechanism is fully independent, governed by parties other than the regulated entity |
| Functioning access to system-level data enabling external contestation of the governing logic | 0: No external access to system-level data exists 1: Access exists (e.g. DSA Article 40 vetted-researcher access) but is documented as incomplete or unreliable 2: Access is complete, reliable and enables independent reconstruction or verification of the governing logic |
The evidence available for the third indicator, functioning access, illustrates why access alone does not satisfy the index. An academic audit of the data researchers actually receive through Article 40(12) access found it to be "substantially incomplete and systematically biased" (Bekavac and Mayer, 2026, p. 3), meaning the one channel built to approximate structural co-authorship does not, on inspection, reliably work. A mechanism can exist on paper, in the sense the first indicator asks about, while failing the third indicator because the access it provides cannot support the kind of independent reconstruction of governing logic that would make contestation meaningful.
Together, the three tables are not three independent checklists sitting side by side. They describe a single relationship that properly functions as a whole. Purpose identifies what a system does and, where verification is meaningful, who is answerable for it. Without an identifiable author, or a proxy standing in for one, there is no one to direct a demand for justification toward and Petition has nothing to attach to. Petition, in turn, gives an individual complaint somewhere to go, but a channel that only ever resolves single disputes, one at a time, after the fact, leaves the governing logic that produced the dispute untouched. It is Peer that gives affected parties any standing to contest that logic directly, rather than relitigating its outputs indefinitely. Peer, of this kind, depends on the same identifiability that Purpose was designed to establish in the first place: a party cannot meaningfully contest rules whose author or logic it cannot see. The three indices are, in this sense, mutually constituting rather than cumulative. A regime that scores unevenly across them, strong on Purpose and weak on the other two, has not partially met the standard. It has built one working part of a mechanism that does not function without the other two. Sandri and Novelli reach a similar conclusion about the interlocking of delegation failures, in which opacity prevents contestation and accountability is hollowed out "even while formal institutions remain outwardly intact" (2026, p. 13). The Harm Index formalises that interdependence as a necessary-and-sufficient structure, so that the failure of any one condition registers in the headline score.
Some candidate indicators that appear in governance literature were considered and deliberately excluded. Toledo's (2026) systematic review of algorithmic accountability in public administration identifies five recurring governance dimensions, among them ethical governance and public trust (pp. 13, 16). Neither survives the three tests set out above. Ethical governance, typically operationalised, asks whether a system’s values-based commitments are well drafted, which is a matter of degree rather than a threshold a system either crosses or does not and scoring it would reintroduce exactly the comparative, quality-of-polish judgement the third test excludes. Public trust fails a different test: it is an outcome of the conditions my Harm Index measures, not one of those conditions itself. Toledo's own framework situates it later in the same way, as a product of democratic legitimacy rather than one of its conditions (Toledo, 2026, p. 24). Including it would risk treating a symptom of unaccountable power as though it were evidence of the power’s presence or absence, when the causal relationship runs the other way. A further candidate, a direct measure of algorithmic fairness or bias in outcomes, was excluded specifically to follow my paper’s thin commitment: a fairness indicator would require the Index to adjudicate whether a system’s outputs are substantively just, a thick, contested normative question my paper has deliberately declined to tackle, rather than the narrower, thin question of whether the system’s governing logic is identifiable, challengeable and open to contestation regardless of what that logic turns out to produce. My Harm Index measures whether accountability's preconditions, identifiability, challengeability, standing to contest, are met. It does not, by design, measure the fairness of any particular decision those preconditions allow. A model built to do both would no longer be thin enough to sit at the edge where my paper needs it to operate.
Petition and Peer do not carry equal empirical weight in the DSA test cases that follow. Article 24's outcome-reporting requirement means the data needed to score most of Table 2.4's indicators already sits inside the same transparency reports this paper draws on for Purpose, resulting in Petition being provided for. Peer is limited, reflecting the DSA's structure. Article 40's access regime is the only mechanism bearing on it directly, the evidence available about that mechanism is critical rather than merely thin. No comparable volume of published, cross-platform data exists to test it the way Purpose and Petition can be tested. Each indicator is given formal scoring guidance and a brief account of why it is included in the Harm Index, shaped in part by recent DSA-specific commentary examining recommender-system audit practice, beyond the sources cited directly above (DSA Observatory, 2025). What this Section has not done, deliberately, is show what any of these scores looks like against a real system. That is Section 4's task.
Section 3 - DSA, VLOPs (Very Large Online Platforms) and VLOSEs (Very Large Online Search Engines)
Under Article 37 DSA, VLOPs and VLOSEs must be subject to independent audits at least once a year (Regulation (EU) 2022/2065, Art. 37; Commission Delegated Regulation (EU) 2024/436), with audit reports and audit implementation reports published under Article 42(4). As of September 2026, two annual cycles of audit reports have been published, in late 2024 and late 2025 (Albert, 2025; KPMG, 2026).
The DSA contains five Chapters comprising 93 Articles. Not all Articles are subject to audit. Many provide the administrative, supervisory and enforcement framework for mechanisms not undertaken by providers. The audited obligations sit within Chapter III (Articles 11–48), which sets out providers' due diligence obligations (Regulation (EU) 2022/2065, Art. 37(1)). The Articles outside Chapter III could support a broader, deeper model assessing how well Member States, the EU, auditors and VLOPs and VLOSEs interact and create space for developed democracy. However, that is not the purpose of this research.
Within Chapter III, two Articles, 34 and 35, do much of the work my paper needs. Article 34(1) names what counts as a risk. It gives four broad categories: the dissemination of illegal content; negative effects on fundamental rights, including human dignity, privacy, freedom of expression, non-discrimination, the rights of the child and consumer protection, listed "in particular" rather than exhaustively; negative effects on civic discourse, electoral processes and public security; and negative effects related to gender-based violence, the protection of public health and minors and serious negative consequences to a person's physical and mental well-being. Freedom of expression and non-discrimination sit closest to my paper's concern with vertical accountability and the space of reasons; the other categories matter to the Act, but less directly to the argument developed here. Article 34(2) names what must be examined as a possible cause of that risk: it requires platforms to assess how these four categories are influenced by, among other things, "the design of their recommender systems and any other relevant algorithmic system". The algorithm is, in this narrow sense, firmly inside the legal framework: 34(1) sets the harm, 34(2) puts the algorithm on the list of things that might be causing it. What neither Article does is define its own terms with enough precision to test a risk assessment or an audit against a fixed benchmark: what counts as a "significant" effect, what "plain and intelligible language" requires, what the "most significant" parameters of a recommender system are. Each of those terms is left for the platform, and the auditor it engages, to define. The same imprecision carries through to the next stage of the Act. Article 35(1) requires platforms to put in place "reasonable, proportionate and effective" mitigation measures once a risk has been identified. What counts as proportionate mitigation, like what counts as a significant effect, is left for the platform to determine in the first instance. Sandri and Novelli identify why this matters beyond legal drafting. The severity of a harm and the level of risk deemed acceptable are evaluative judgements. When such judgements are delegated to a private provider "the underlying value choices become as opaque as the technical operations that carry them", leaving open "who is authorized to set the risk attitude on the public's behalf" (2026, pp. 6–7). Under Articles 34 and 35, that authority sits with the platform.
Audits are conducted against two Regulations. Regulation (EU) 2022/2065 sets out what the DSA requires of providers and Commission Delegated Regulation (EU) 2024/436 sets out how audits must be performed. Alongside these sit the DSA Transparency Database, which records providers' statements of reasons (SORs) for content moderation decisions (Regulation (EU) 2022/2065, Arts 17, 24(5)), and the professional assurance standards auditors apply, such as ISAE 3000 (Revised) (International Auditing and Assurance Standards Board, 2013). Audit recommendations are not legally binding. A provider must take account of them and produce an audit implementation report within one month, but it may decline to implement a recommendation if it justifies its reasons and sets out any alternative measures (Regulation (EU) 2022/2065, Art. 37(6)). Non-compliance does not lead to enforcement automatically: the Commission may open proceedings and, where it finds an infringement, adopt a non-compliance decision and impose fines (Regulation (EU) 2022/2065, Arts 66, 73–74). Providers select their own auditor and may change auditor between cycles, subject to independence requirements, including a bar on any organisation auditing the same provider for more than ten consecutive years (Regulation (EU) 2022/2065, Art. 37(3)). In practice, only AliExpress and X changed auditor, with the rest choosing continuity for the second cycle (Albert, 2025). The arrangement resembles the remedy Pasquale proposed for black-box firms: algorithms opened for inspection, if not to the public at large, then to 'some trusted auditor' (Pasquale, 2015, p. 141). The DSA adopts the auditor but not the trust. The auditor is chosen and paid by the firm it audits, with the public receiving only its conclusion.
My Harm Index is tested against three VLOPs: Facebook, X and YouTube. This provides a consistent application referencing the same Articles. Within Google's services, Google Search is designated a VLOSE (Google Ireland Limited, 2025b, p. 1). It is subject to the DSA, but to a narrower set of obligations.
The distinction between the two designations (VLOP/VLOSE) is not one of scale. Article 3 defines "online platform" and "online search engine" as separate categories (Regulation (EU) 2022/2065, Art. 3(i), (j)). An online platform stores and disseminates information to the public at a recipient's request, whereas an online search engine allows users to input queries and returns results. Chapter III, Section 3 (Articles 19–28), which covers among other things internal complaint-handling, out-of-court dispute settlement, trusted flaggers and advertising transparency, applies by its own terms only to providers of online platforms. Section 2 (Articles 16–18), including notice-and-action, applies only to hosting services and Section 4 (Articles 29–32) only to online platforms allowing consumers to conclude distance contracts with traders. Google Search's audit report reflects this. Only two Section 3 sub-articles, Articles 24(2) and 24(3), are listed as applicable with every sub-article in Sections 2 and 4 marked not applicable. In most cases, Google's stated rationale is that the obligation "does not apply to Google Search as it is an online search engine" (Google Ireland Limited, 2025b, p. 4). Google Search was therefore not used as this study's third platform. In the same audit cycle, its report lists 41 applicable sub-articles against 76 for YouTube (Google Ireland Limited, 2025b; 2025c). Several of the model's twelve indicators would therefore have had no applicable DSA obligation from which to draw evidence, making cross-platform comparison impractical.
DSA Audit Logic Matrix
For each audited Article, the auditor reaches one of three statutory conclusions or, where it cannot reach one with reasonable assurance, records no conclusion (see "What a disclaimer means" below).
This gives four possible states per Article, per cycle:
- Positive (P)
- Positive with Comments (PC)
- Failed (F)
- Disclaimed (D)
The statutory "negative" conclusion is coded here as Failed (F). This reflects my framing: the DSA's most explicit democratic reference is the systemic risk category in Article 34(1)(c), which requires VLOPs and VLOSEs to assess "any actual or foreseeable negative effects on civic discourse and electoral processes, and public security" (Regulation (EU) 2022/2065). Read through the lens of democracy, a provider's failure to meet a DSA obligation is also a failure of the conditions supporting democratic space.
Comparing an Article's state across the two published cycles gives 4 × 4 = 16 possible Cycle 1 → Cycle 2 transitions. The transition labels, compliance and architecture readings and status scores in the table below are my coding scheme, developed for this research. They are not categories used in the DSA or in the audit reports.
Table 3.1. The Audit Matrix: Scheme for Cycle 1 → Cycle 2 audit transitions
| C1 → C2 | Label | Compliance reading | Architecture reading | Status |
|---|---|---|---|---|
| P → P | Sustained clean record | Best possible outcome | Verification working, nothing to report | 2 |
| P → PC | New concern | Decline | Verification still working | 1 |
| P → F | New failure identified | Regression | Verification still working (caught it) | 0 |
| P → D | Clean record loses verification | Unknown, cannot tell | Regression: working process stopped engaging | 0 |
| PC → P | Issue resolved | Improvement | Verification working | 2 |
| PC → PC | Issue persists | Unresolved but non-critical | Verification working, same soft spot both times | 1 |
| PC → F | Issue escalated | Worsening | Verification working (caught the escalation) | 0 |
| PC → D | Flagged issue loses verification | Unknown, cannot tell | Regression: a visible soft spot becomes invisible | 0 |
| F → P | Full remediation | Repaired | Verification working | 2 |
| F → PC | Partial remediation | Improved, not resolved | Verification working | 1 |
| F → F | Persistent failure | Unresolved problem | Verification working both times (caught it twice) | 0 |
| F → D | Documented failure loses verification | Unknown | Regression: working process stops engaging | 0 |
| D → P | Full resolution from opacity | Repaired | Verification recovers | 2 |
| D → PC | Partial resolution from opacity | Improved | Verification recovers | 1 |
| D → F | Resolved-negative | Unresolved problem | Verification recovers (produces negative outcome) | 0 |
| D → D | Verification not obtained | Unknown | Non-engagement continues unchanged | 0 |
Source: Coding scheme. Positive, Positive with comments and Negative are the statutory conclusion categories (Regulation (EU) 2022/2065, Art. 37(4)(g)); Negative is coded here as F. D marks the unlabelled no-conclusion outcome (Commission Delegated Regulation (EU) 2024/436, Art. 8(8)).
The ISAE 3000 (Revised) assurance standard, under which the audits examined were conducted, provides reasonable assurance within a defined scope, not exhaustive verification. The auditor reduces engagement risk to an acceptably low level in the circumstances of the engagement, and reasonable assurance is less than absolute, reflecting factors such as selective testing and evidence that is persuasive rather than conclusive (International Auditing and Assurance Standards Board, 2013, paras 12(a)(i)(a), A14). A fall in non-positive findings between cycles could therefore reflect improved practice or reduced audit attention. Distinguishing between the two would require obligation-by-obligation tracking of applicability and testing depth across cycles. This falls outside the scope of my process-level Harm Index model. A natural extension of this work, for future research, would be a depth-of-testing audit trail. This would track not just whether an Article appears in the non-positive findings, but what sample size, materiality threshold and evidence basis supported each positive conclusion, to establish whether practice has reliably improved or audit attention has merely reduced.
PC, F and D each generate a documented flag, a specific problem the auditor identifies and reasons through in the report. A P typically comes with process commentary, confirmation that the platform's stated procedure was followed. However, that commentary is assessed against criteria that can vary by auditor and by platform. My Harm Index applies the same twelve indicators to every P, so the Article is measured against a consistent, external standard rather than the platform's own account of its process. This is what gives my model a degree of universality across platforms and why the outcome varies.
What a disclaimer means
Under the DSA's audit regime, the auditor must reach one of three conclusions on each audited obligation: positive, positive with comments or negative, each with a reasonable level of assurance (Regulation (EU) 2022/2065, Art. 37(4)(g); Commission Delegated Regulation (EU) 2024/436, Art. 8(1)). Where the auditor cannot reach a conclusion at that level, the Delegated Regulation does not create a fourth category; it requires the audit report to explain the circumstances and the reasons why that level of assurance could not be achieved (Commission Delegated Regulation (EU) 2024/436, Art. 8(8)). This fourth outcome is therefore unlabelled in the DSA framework. ISAE 3000 (Revised), the assurance standard under which most audits are conducted, names it a disclaimer of conclusion, issued where a limitation of scope prevents the auditor from obtaining sufficient appropriate evidence (International Auditing and Assurance Standards Board, 2013, para. 74(a)). Ernst & Young LLP (EY) states that, where obligations are subject to formal Commission proceedings, it "may disclaim an opinion on such individual obligations or commitments" (Ernst & Young LLP, 2025, p. 136). A disclaimer is neither a finding of non-compliance nor a finding of compliance.
For the edge of democracy, this matters. A disclaimer is a formal statement that the process built to answer the question "is this platform complying with the law?" was unable to answer it, for that obligation, in that year.
Disclaimers and the Harm Index
My model treats a disclaimer as functionally equivalent to a failure to verify and scores it 0 on the process indicators (Independent verification, Depth of verification, Outcome reporting), regardless of the reason given. This is a coding choice, not a legal classification. Whether the auditor lacked evidentiary access or the obligation overlapped with a parallel legal proceeding makes no difference to the score. My model does not ask whether the platform complied. It asks whether independent, audited verification confirmed that the obligation was met. A disclaimer and a negative conclusion are legally distinct, but in the Harm Index they produce the same score: in both cases, no external body has confirmed that the obligation was met during that period.
Tracking resolution across cycles
My research covers two consecutive audit cycles for each platform. A disclaimed obligation can move in one of four directions the following year and each is treated differently:
- Unresolved: the same obligation is disclaimed again. This produces two 0’s in a row.
- Resolved, negative: the auditor forms an opinion and it is unfavourable. The audit process has started working again, even though the substantive finding is poor; this is scored as a change in kind from "unresolved," not treated identically to it. A coded score is likely to be 0.
- Resolved, positive: the auditor forms a favourable opinion. Verification has occurred and the obligation is no longer counted as an open gap. The coded score will move to 2.
- Resolved, positive with comments: Verification has occurred and the obligation is no longer counted as an open gap. The coded score will move to 1.
Why disclaimers matter
A disclaimer is where the DSA's accountability architecture fails. In the reports examined for this study, disclaimers cluster on the obligations most central to the model (Table 3.2). Ernst & Young LLP declined to reach a conclusion on the same 14 Facebook sub-articles in both cycles, all subject to ongoing Commission investigations (Ernst & Young LLP, 2024, p. 2; 2025, pp. 3–4). In the second cycle, BDO LLP was unable to provide an opinion on 10 X sub-articles under formal Commission proceedings (BDO LLP, 2025, p. 5). Seven sub-articles, spanning notice-and-action, interface design, systemic risk assessment and mitigation and researcher data access, were disclaimed for both platforms. YouTube, by contrast, received a conclusion on every applicable obligation in both cycles (Google Ireland Limited, 2024b, p. 137; 2025c, p. 178).
Where verification is absent in a cycle, and remains absent across cycles, the platform's most significant exercises of power are those with the least publicly accessible evidence. This is the phenomenal form of the addressee problem: a system whose most significant conduct is structurally unreachable by the very mechanism built to hold it answerable, the DSA audit process. Table 3.2 shows two routes to that outcome. For Facebook, and for X in the second cycle, verification stopped where Commission investigations began. The auditor records that Meta imposed no limitations and cooperated fully (Ernst & Young LLP, 2025, p. 3). Nothing was hidden: the mechanism could not produce an output. In X's first cycle, by contrast, FTI could reach no conclusion on two obligations because the information needed was treated as privileged or not supplied (FTI Consulting, 2024, pp. 109, 238)1. Whether the cause is a parallel proceeding or a provider's non-disclosure, the result is the same: no independent verification for that obligation in that cycle.
Table 3.2. Sub-articles on which no audit conclusion was reached, by platform and cycle
| Sub-article | Subject | Facebook C1 | Facebook C2 | X C1 | X C2 | YouTube C1 | YouTube C2 |
|---|---|---|---|---|---|---|---|
| 14(1) | Terms and conditions | D | D | – | – | – | – |
| 16(1) | Notice-and-action mechanisms | D | D | – | – | – | – |
| 16(5) | Notice-and-action: notification of decision | D | D | – | D | – | – |
| 16(6) | Notice-and-action: processing, incl. automated means | D | D | D | D | – | – |
| 17(1) | Statement of reasons | D | D | – | – | – | – |
| 20(1) | Internal complaint-handling | D | D | – | – | – | – |
| 20(3) | Internal complaint-handling | D | D | – | – | – | – |
| 24(5) | Submission to Transparency Database | D | D | – | – | – | – |
| 25(1) | Online interface design | D | D | – | D | – | – |
| 28(1) | Protection of minors | D | D | – | – | – | – |
| 34(1) | Systemic risk assessment | D | D | – | D | – | – |
| 34(2) | Systemic risk assessment: factors | D | D | – | D | – | – |
| 34(3) | Risk assessment: supporting documents | – | – | D | – | – | – |
| 35(1) | Risk mitigation | D | D | – | D | – | – |
| 39(1)–(3) Three sub-articles | Advertising repository | – | – | – | D | – | – |
| 40(12) | Researcher data access | D | D | – | D | – | – |
| Total | 14 | 14 | 2 | 10 | 0 | 0 | |
| Stated reason | Commission investigations | Commission investigations | Evidence not provided by X | Commission proceedings | – | – | |
| Source | Ernst & Young LLP (2024, p. 2) | Ernst & Young LLP (2025, pp. 3–4) | FTI Consulting (2024, pp. 24, 35, 108–109, 237–238) | BDO LLP (2025, p. 5) | Google Ireland Limited (2024b, p. 137) | Google Ireland Limited (2025c, p. 178) |
Key: D = no audit conclusion reached - = conclusion reached or not applicable.
Audit Governance
How an article is reported, the final audited decision, is driven by four elements. It starts with an article of the DSA. A rule such as "Providers of online platforms shall not design, organise or operate their online interfaces in a way that deceives or manipulates the recipients of their service " (Article 25(1)) or "provide recipients of services with a concise, easily-accessible and machine-readable summary of the terms and conditions, including the available remedies and redress mechanisms, in clear and unambiguous language." (Article 14(5)). The article says what a platform must do, but nothing about how that is checked.
General guidance on independence and access is provided by Article 37, the DSA's audit clause. It says platforms must be independently audited every year, sets basic ground rules for the auditor (independence, no conflicts of interest) and says every audit must end in one of three verdicts. However, Article 37 does not guide how an auditor should reach that verdict. It requires the auditor to describe, after the fact, methods used and remedial actions, if appropriate.
Guidance for the DSA audits is provided by the Commission's Delegated Regulation (EU) 2024/436. This is where the ‘how’ of auditing is contained, covering aspects such as how much evidence is enough, "’reasonable level of assurance’ means a high but not absolute level of assurance” (Commission Delegated Regulation (EU) 2024/436, Art. 2(13)), how big a sample has to be and the measurements and benchmarks applied.
The fourth element is guidance provided by the auditors' professional bodies. The majority of the professional guidance is provided by the ISAE 3000 standards. The DSA does not specify a particular set of guidelines or mandate which professional rubric is used. This is a theoretical issue, but it complicates any cross audit matching where different standards are used by auditors. The guidance from the EU is derived from the DSA “Audits performed pursuant to paragraph 1 shall be performed by organisations which: … have proven objectivity and professional ethics, based in particular on adherence to codes of practice or appropriate standards” (Regulation (EU) 2022/2065, Art. 37(3)(c)) and the Delegated Regulation “audits shall be performed by using appropriate auditing methodologies to reduce the assessed audit risks to a level that enables the auditing organisation to reach audit conclusions at a reasonable level of assurance” (Commission Delegated Regulation (EU) 2024/436, Art. 10(1)).
Issues
The multi-element nature of the audit process, together with the lack of enforcement available to auditors or the EU, creates several issues which impact on the edge of democracy issue my research is concerned with. The most dangerous of these, if we are to protect democracy from algorithmic harm, can be summarised as follows:
DSA Article 37(6) duty is to "take due account" of a recommendation, not to implement it. A platform can read a recommendation, disagree and ignore, provided it records why. There is no penalty or escalation in Article 37 or the Delegated Regulation for refusing an operational recommendation. The only route to any consequence at all is the Commission separately, independently deciding to open an investigation. This is a different legal track with no automatic link to what the audit found.
The audit process is diagnostic. An auditor can request data, ask questions and provide conclusions. It cannot order a fix or impose interim measures beyond the general cooperation duty “Providers of very large online platforms and of very large online search engines shall afford the organisations carrying out the audits pursuant to this Article the cooperation and assistance necessary to enable them to conduct those audits” Article 37(2). The EU’s enforcement tools: investigations, binding decisions, fines up to 6 percent of global turnover, exist under DSA Articles 65–76 and can create a legal environment where a platform could choose to comply, to avoid further fines and censure for example. However, there is no direct trigger requiring the EU to act if Articles in the DSA are not passed. Article 66(1) “The Commission may initiate proceedings … (if platforms infringe) any of the provisions of this Regulation”. The key phrase here is ‘may’.
A failure that repeats across cycles produces no built-in escalation within the DSA. Each audit may produce the same finding and recommendation in each cycle. Nothing in the audit mechanism itself provides a means to pressure or change the consequence for a problem that was not fixed the first time. It just gets recorded again.
The disclaimer option lets the process exit the hardest questions entirely, without penalty for exiting. Every audit obligation is supposed to end with the auditor making a judgement: the platform is compliant, it is not, or it is compliant with some caveats. Problematically, the rules allow a fourth option. If something outside the auditor's control blocks them from gathering enough evidence, most often, an investigation already looking into the same issue, they are allowed to say nothing at all. This does not require bad faith on anyone's part, but the structure creates room that can be used opportunistically whether or not it is. The obstacle can be genuinely evidentiary. An auditor cannot necessarily see what an investigation can see and cannot rule out that the investigation knows something that would change the audit's answer. However, the same structure also creates a second, discretionary route to the identical outcome. If an auditor becomes aware, during audit planning, that a set of Articles is under investigation, they may choose not to investigate that Article at all, rather than being blocked from doing so. Both routes produce the same disclaimer on the record and nothing in the process distinguishes a disclaimer reached through genuine evidentiary block from one reached through discretionary avoidance. In the Harm Index, both routes score 0 (see "Disclaimers and the Harm Index").
This ability to disclaim clusters on some of the most important Articles, the ones where the edge of democracy issue resides.
Article 25(1) requires that “Providers of online platforms shall not design, organise or operate their online interfaces in a way that deceives or manipulates the recipients of their service or in a way that otherwise materially distorts or impairs the ability of the recipients of their service to make free and informed decisions”.
Article 28(1) focuses on protection of minors where they “shall put in place appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors”.
Article 34(1) states that platforms “shall diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of their service and its related systems, including algorithmic systems, or from the use made of their services”.
Article 40(12) has an open data requirement requiring that platforms “shall give access … to real-time data, provided that the data is publicly accessible in their online interface by researchers”.
What connects the four Articles is not that the platforms are guilty of anything on the record, a disclaimer is not a finding of non-compliance. What connects them is that a form of oversight continues. An investigation may be scrutinising exactly these questions, but the channel built to be visible, the one a researcher could read, is void. Auditing an obligation that might otherwise be disclaimed produces an outcome rather than a void, even where that outcome is negative and disputed by the platform. As I show, when applying the Harm Index, X's Cycle 1 record on Article 34 and the related obligation 35(1) was mixed rather than uniformly negative: Positive with comments on 34(1), Negative on 34(2), No Conclusion on 34(3), where FTI could not obtain the supporting documents despite several requests, and Negative on 35(1) (FTI Consulting, 2024, pp. 34–36, 238). In Cycle 2, BDO reached no conclusion on 34(1), 34(2) or 35(1), all under formal Commission proceedings (BDO LLP, 2025, p. 5). Only 34(3) produced a finding, Positive, with that resting on an assurance that supporting documents "will be preserved" and an inspection that the risk assessment itself had been retained, within a single examination period that could not test the three-year retention requirement (BDO LLP, 2025, p. 52). A negative conclusion is a position on the record. A disclaimer forecloses even that. It produces neither a favourable nor an unfavourable finding, only an absence. This is the edge-of-democracy issue: not that manipulative design, child safety, systemic risk and independent research access go unexamined, but that the public's own means of holding that examination to account is empty where it matters most. Power over civic discourse, minors and the platform's own account of its risks continues to be exercised either way. What is lost is an addressee's ability to question it, or to hold anyone answerable for it. That loss recurs, in the case examples, across successive audit cycles. This is a structural feature of how the audit regime and the investigatory regime fail to communicate with each other, resulting in the erosion of democracy in this area.
Where the audit does reach a finding, it has no way to resolve a disagreement about what the law requires. The auditor's conclusion is an informed opinion, not a legal determination. Binding findings of non-compliance are a reserve of the Commission's enforcement powers (Regulation (EU) 2022/2065, Arts 66, 73–74), subject to review by the Court of Justice of the European Union (Art. 81). Within the audit itself, interpretation begins with the platform. Meta's auditor records that management is responsible for "making interpretations, defining ambiguous terms and developing benchmarks" to implement the obligations being audited (Ernst & Young LLP, 2024, p. 1; 2025, p. 2). Disclaimers aside, a platform can therefore dispute a finding not by denying the facts, but by contesting the meaning of the obligation itself. X's first-cycle audit shows how this could work. X took the position that its advertising recommender systems may not be subject to the same legal requirements as other recommender systems and FTI, unable to consider this "an unreasonable position", recorded "No Conclusion" in respect of those systems, within an otherwise Positive with comments finding on Article 38(1) (FTI Consulting, 2024, pp. 248, 251). Nothing in the audit process adjudicates a dispute of this nature. The platform's only mandatory response is procedural. Within one month of receiving operational recommendations, it must adopt an audit implementation report, and where it does not implement a recommendation, it must justify its reasons and set out any alternative measures (Regulation (EU) 2022/2065, Art. 37(6)); both reports are then transmitted to the Commission and the Digital Services Coordinator and made public (Art. 42(4)). The platform responds to a finding with its own reading of the obligation and that reading stands unless the Commission takes enforcement action. This highlights a gap in the DSA's power to enable change. Where interpretive power over the law's meaning sits, within the audit, with the object the law is meant to constrain, the audit stops being a check on the platform and becomes, as a consequence, a forum the platform can use to author the rule it is being measured against.
Indicator – Article Crosswalk
Each of the twelve indicators across Tables 2.3-2.5 of my model draws on one or more Articles of the DSA and some Articles inform more than one indicator. This allows mapping of each indicator to the specific articles that generate verifiable evidence for it. In the tables below I attach Articles to indicators with a reason why the Article and indicator are paired. This is further linked to the platform, Article and Cycle from the three platforms applied to my model. This evidence is included in the three appendices, providing the foundation for applying my model to other platforms and future cycles.
The indicator-Article mapping and the reasons given for each pairing are my own methodology choices. Descriptions of what each provision requires are taken from Regulation (EU) 2022/2065 and Commission Delegated Regulation (EU) 2024/436, cited by pinpoint in each table.
Table 3.3. Purpose (Architectural Transparency)
1. Disclosure - was detail offered freely, or only extracted?
| Primary articles | Why |
|---|---|
| Article 14(1) (terms and conditions) | Requires platforms to state, directly within the Terms and Conditions, information on content-moderation policies/tools (including algorithmic decision-making and human review) and internal complaint-handling rules of procedure, in "clear, plain, intelligible, user-friendly and unambiguous language". Whether that's stated directly or only reachable via linked pages is the disclosure question. |
| Articles 15(1), 24 (transparency reporting) | The periodic disclosure obligation, largely quantitative: orders received, notices, own-initiative moderation, complaints and use of automated means (Art. 15(1)), plus platform-specific figures on out-of-court disputes, suspensions and average monthly active recipients (Art. 24(1)–(2)). |
| Article 27(1)-(2) (recommender transparency) | Disclosure of why content is suggested |
| Article 39(1) (advertisement repository) | Disclosure duty specific to advertising, structurally separate from content moderation. |
2. Independent verification - is disclosure checked, and how routinely?
| Primary articles | Why |
|---|---|
| Article 37(1), (4)(d) (independent audit) | The verification mechanism itself: annual independent audit of Chapter III obligations (Art. 37(1)), with the report describing "the specific elements audited, and the methodology applied" (Art. 37(4)(d)). |
| Article 34(1), 35(1) (risk assessment / mitigation) | Verified annually as part of the same audit cycle; whether verification reaches these is a live question given the disclaimer pattern. Audited under Art. 37(1)(a); specific audit methodologies in Delegated Reg. Arts 13–14. |
3. Public availability - how easily can verification results be accessed?
| Primary articles | Why |
|---|---|
| Article 24(5) (Transparency Database) | Public-facing verification-adjacent output. Disclosure of moderation actions rather than audit results specifically. |
| Article 42(4)(c)-(d) (publication of audit report and implementation report) | The actual publication duty |
4. Methodological concurrence - externally set rules or self-defined?
| Primary articles | Why |
|---|---|
| Article 37 + Delegated Reg. (EU) 2024/436 | Commission Delegated Regulation (EU) 2024/436 sets the audit process externally: the audit risk analysis (Art. 9), audit methodologies and materiality threshold (Art. 10), quality of audit evidence (Art. 11) and sampling (Art. 12), with methodologies drawn up "without influence from the audited provider" (Recital 22). The audit criteria themselves, however, are defined based on the benchmarks the provider uses to monitor its own compliance (Commission Delegated Regulation (EU) 2024/436, Art. 10(2)(a), read with Art. 5(1)(a); Recital 22). The professional standard auditors apply (e.g. ISAE 3000) is set by neither Regulation; the audit report need only reference "any auditing standards applied in the audit, as applicable" (Commission Delegated Regulation (EU) 2024/436, Annex I, Section B.5). |
| Article 20(4) (and any other finding citing the “audited provider's developed supplemental criteria") | EY defines these as the "audited provider's legal interpretation, operational benchmarks and definitions" (Ernst & Young LLP, 2025, p. 6). It applies the same definition to YouTube, stating that "many of the obligations needed to be supplemented by the audited provider's own legal determination, operational benchmarks and/or definition of ambiguous terms" (Google Ireland Limited, 2025c, p. 172). The phrase signals that the benchmark was self-authored, not externally imposed. See, for example, Art. 20(4) for Facebook (Ernst & Young LLP, 2025, p. 34) and Art. 24(5) for YouTube, measured against the provider's own "4-day" operational benchmark (Google Ireland Limited, 2024b, p. 73). |
5. Depth of verification - system logic checked or just confirmed to exist?
| Primary articles | Why |
|---|---|
| Article 37(4)(d), Delegated Reg. Art. 10(2) (audit procedures) | The methodology statement itself shows whether checking went beyond existence-confirmation. |
| Any Disclaimed Article | The cleanest possible negative case. Whatever checking occurred, no conclusion was reached and the report records only why (Delegated Reg. Art. 8(8)). |
Sources: Regulation (EU) 2022/2065; Commission Delegated Regulation (EU) 2024/436; audit reports as cited. Indicator-Article mapping by the author.
Table 3.4. Petition (Justificatory Addressability)
6. Existence of an external addressee - is there someone besides the platform?
| Primary articles | Why |
|---|---|
| Article 11(1), 12(1) (points of contact) | The most literal "someone to go to" for authorities and for users respectively. |
| Article 37(1) (the auditor) | A structural external addressee, even if its independence is separately in question (see Table 3.5). |
7. Enforceability - how binding is a remediation requirement?
| Primary articles | Why |
|---|---|
| Article 37(6) / 42(4)(d) (implementation report) | Recommendations are non-binding by design. The provider can decline and explain why, which is direct textual evidence of weak enforceability. |
8. Accessibility - free of cost or complexity to a genuine complainant?
| Primary articles | Why |
|---|---|
| Article 16(1) (notice and action) | The initial reporting route. Mechanisms must be "easy to access and user-friendly" and allow notices to be submitted "exclusively by electronic means". |
| Article 17(3)(f) (statement of reasons: redress information) | The route is only accessible if the complainant is told it exists. Statements of reasons must give "clear and user-friendly information on the possibilities for redress", including out-of-court dispute settlement. |
| Article 20(1), (3) (internal complaint-handling) | The main complaint route. Recipients must have access, for at least six months after a decision, to a system that lets them complain "electronically and free of charge" (Art. 20(1)), and the system must be easy to access and user-friendly (Art. 20(3)). |
| Article 21(1), (5) (out-of-court dispute settlement) | The escalation route. Recipients may select any certified body (Art. 21(1)), and for them dispute settlement must be "available free of charge or at a nominal fee" (Art. 21(5)). |
9. Outcome reporting - published in enough detail to show the process works?
| Primary articles | Why |
|---|---|
| Article 17(1) (statement of reasons) | The individual-level outcome report. |
| Article 24(5) (statement-of-reasons database submission) | The aggregated public version of the same. |
| Article 42(4)(c)-(d) (audit/implementation report publication) | The process-level outcome report. |
Sources: Regulation (EU) 2022/2065; Commission Delegated Regulation (EU) 2024/436; audit reports as cited. Indicator-Article mapping by the author.
Table 3.5. Peer (Minimal Co-authorship)
10. Contesting channel - is there a route to challenge system logic, not just receive reports about it?
| Primary articles | Why |
|---|---|
| Article 21(1), (2), (5) (out-of-court dispute settlement bodies) | A certified outside body can hear a dispute, but it "shall not have the power to impose a binding settlement of the dispute on the parties" (Regulation (EU) 2022/2065, Art. 21(2)). Pressure comes from cost allocation, since the platform bears the body's fees where the recipient wins (Art. 21(5)) and from public reporting, not from an override power. Disputes concern individual decisions (Art. 21(1), referring to Art. 20(1)) not the system logic that produced them. |
11. Independence - is the checking body free of the platform's funding or control?
| Primary articles | Why |
|---|---|
| Article 37(3)(a)-(c) (auditor independence requirements) | The direct textual independence standard the auditing organisation must meet before it can be engaged at all. |
| Delegated Reg. 2024/436, Annex I, Section B.4 | Where the auditor provides a declaration of interests and documents attesting its independence under Art. 37(3)(a) and (c). |
| Delegated Reg. 2024/436, Annex I, Section B.5 | Where the auditor states which professional auditing standard it actually followed. The audit report need only reference it "as applicable”. |
12. System access - can the system logic itself be verifiably challenged?
| Primary articles | Why |
|---|---|
| Article 40(12) (researcher data access) | The DSA's mechanism for independent outside access. VLOPs must give researchers access "without undue delay" to data, including real-time data where technically possible, but only data that is "publicly accessible in their online interface" and only for research on systemic risks. It gives access to data, not to system logic directly. |
| Article 24(5) (Transparency Database) | Platforms must submit their decisions and statements of reasons to the Commission for inclusion in a publicly accessible, machine-readable database. This channel is weaker than Art. 40(12) in principle, since it holds aggregate disclosure rather than research access, but it is unaffected by the disclaimer pattern and has independently extracted evidence2. |
| Auditor's own methodology statement (required by Article 37(4)(d): "a description of the specific elements audited, and the methodology applied") | The paid auditor's access is bounded by its own scoping choices. Meta's auditor states that it examined internal controls "but not for the purpose of expressing an opinion on the effectiveness of the audited provider's internal control" (Ernst & Young LLP, 2024, p. 5; 2025, p. 5). This is EY's standard scoping language, which also appears in its YouTube report (Google Ireland Limited, 2025c, p. 5). The limit is therefore structural rather than specific to Meta and it is set by the auditor's methodology, not by Art. 37(4). |
| Article 38 (non-profiling recommender option) | A narrow, opt-out form of system access. VLOPs must provide "at least one option for each of their recommender systems which is not based on profiling". |
Sources: Regulation (EU) 2022/2065; Commission Delegated Regulation (EU) 2024/436; audit reports as cited. Indicator-Article mapping by the author.
Section 4 - Measuring the Platforms: Meta, X and YouTube
Section 3 set out the structural case for why DSA-mandated audit alone cannot be trusted as a self-sufficient accountability mechanism. Section 4 tests that case against evidence. The Harm Index, twelve indicators across three sub-indices (Purpose, Petition, Peer), applies in full to three VLOPs: Facebook (Meta), X and YouTube, chosen for contrast.
X's auditor relationship changed entirely between cycles. Of the nineteen services initially designated as VLOPs or VLOSEs, all of which have now published two rounds of audit reports, only two, AliExpress and X, changed auditor (Albert, 2025). X replaced FTI Consulting with BDO LLP, a member of the European Contact Group, whose guidance advises auditors not to reach conclusions on obligations under Commission investigation (Albert, 2025). The professional basis of the audit changed too: FTI applied ISACA's IT audit and assurance standards (FTI Consulting, 2024, p. 11), whereas BDO conducted its engagement under ISAE 3000 (BDO LLP, 2025, p. 4).
X's response to its first-cycle audit was selective. It accepted some recommendations, committing, for example, to update its trusted flagger guidance and its transparency reporting manual (Twitter International Unlimited Company, 2024, pp. 29, 35). But where FTI reached negative conclusions on contested or investigated obligations, X met the findings with reinterpretation or deferral rather than correction. FTI found X non-compliant on online interface design (Art. 25(1)) and the protection of minors (Art. 28(1)) (FTI Consulting, 2024, pp. 33, 191). X replied that the first finding "goes beyond the requirements of Article 25", and that the auditor's proposed age-assurance standard "does not comply with Article 28.3 DSA" (Twitter International Unlimited Company, 2024, pp. 42, 52). FTI also reached negative conclusions on systemic risk assessment and mitigation (Arts 34(2), 35(1)) (FTI Consulting, 2024, pp. 35–36). On these, and on Article 25, all under Commission investigation, X stated that it "does not intend to implement the auditor's recommendation and will await the EC's decision in the investigation" (Twitter International Unlimited Company, 2024, pp. 42, 57–58, 62; see also Albert, 2025).
YouTube serves as the control case. Its auditor reached a conclusion on every applicable obligation in both cycles, including the systemic risk obligations under Articles 34 and 35 that were disclaimed for Facebook in both cycles and for X in Cycle 2 (Table 3.2; Google Ireland Limited, 2024b, p. 137; 2025c, p. 178). Its headline Harm Index score of 1 diverges from the 0 recorded for both Meta and X under the same model and DSA rules (see the platform results below). Together the three span the range the model is built to detect: concentrated failure, contested failure and a partial pass.
One scoring choice carries through every table that follows: a disclaimed Article scores 0 on the relevant process indicators, as a documented failure would, whatever the reason given (Section 3, "Disclaimers and the Harm Index"). The tables apply this rule without restating it.
Tables 4.1–4.3 set out the scores for all three platforms, one table per index. Each table asks one question of every platform.
Purpose (five indicators) how strong is the architectural transparency of its governing logic
Petition (four indicators) can its decisions be challenged
Peer (three indicators) can its logic be contested
Each cell gives the score and the band it corresponds to; the full scoring guidance for each indicator is set out in Tables 2.3–2.5.
The evidence and reasoning behind every score follow, platform by platform.
Table 4.1. Purpose (Architectural Transparency): scores by platform
| Indicator | DSA Articles | Meta | X | YouTube |
|---|---|---|---|---|
| Disclosure of optimisation objective or declared decision logic | 14, 15/24, 27, 39 | 1: Disclosed reactively | 1: Disclosed reactively | 1: Disclosed reactively |
| Independent verification of declared logic against operation | 34/35, 37 | 0: No independent verification | 0: No independent verification | 2: Routine, continuous verification |
| Public availability | 24(5), 42(4)(c)–(d) | 2: Proactively published on a fixed cycle | 2: Proactively published on a fixed cycle | 2: Proactively published on a fixed cycle |
| Methodological concurrence across subjects | 37; Delegated Reg. (EU) 2024/436 | 1: Common procedural framework; subject-defined benchmarks | 1: Common procedural framework; subject-defined benchmarks | 1: Common procedural framework; subject-defined benchmarks |
| Depth of verification | 37(4); disclaimed Articles | 0: Confirms only that a control exists | 0: Confirms only that a control exists | 1: Confirms an observable effect; logic not characterised |
| Index score | 0 | 0 | 1 |
Source: author's scoring.
Evidence for each score is given in the platform narratives below and in Appendices A–C.
Meta
Indicators reflecting minimal, record-generating compliance: Disclosure (1), Methodological concurrence (1), Public availability (2). Meta meets its formal disclosure obligations on the statutory cycle: EY reached positive conclusions on terms and conditions and recommender transparency in both cycles (Ernst & Young LLP, 2024, pp. 49, 51; 2025, pp. 61–62). However, those obligations require disclosure of a recommender system's main parameters (Regulation (EU) 2022/2065, Art. 27(1)–(2)), not its optimisation objective. What Meta's systems are optimised for has surfaced reactively, through litigation discovery: internal documents record a decision to reduce advertising load for teenage users to "maximize long-term revenue growth" (In re Social Media Litigation, 2026, p. 21). The formal route to data is constrained, with the Commission preliminarily finding Meta in breach of its researcher data access obligations (European Commission, 2025a). Meta's audit reports and audit implementation reports are likewise published as Article 42(4) requires (Regulation (EU) 2022/2065, Art. 42(4); Ernst & Young LLP, 2024; 2025; Meta Platforms Ireland Limited, 2024; 2025), which satisfies a statutory obligation. On Methodological concurrence, the audit criteria for Article 20(4), which requires complaints to be handled in a timely manner, rest on a benchmark Meta set itself. EY describes such benchmarks as the "audited provider's developed supplemental criteria", comprising its "legal interpretation, operational benchmarks and definitions" (Ernst & Young LLP, 2025, p. 6). That benchmark changed between cycles. In Cycle 1, management defined "timely" as complaints "decisioned within 72 hours" (Ernst & Young LLP, 2024, p. 31); in Cycle 2, it was redefined as handling reviews "as quickly as reviewer resources allow", against an internal goal of seven days (Ernst & Young LLP, 2025, p. 34). The benchmark is therefore one Meta can, and did, revise at its own discretion, rather than an externally fixed requirement.
Indicators reflecting the absence of independent examination: Independent verification (0), Depth of verification (0). These two scores are of concern. They do not indicate that Meta was tested and found deficient. Rather, no independent verification occurred in either audited year in respect of the systemic risk obligations (Arts 34(1), 34(2), 35(1)). In both cycles, and in near-identical terms, EY stated that ongoing Commission investigations meant it could not obtain sufficient appropriate evidence and that it did "not express a conclusion" on these and eleven other sub-articles (Ernst & Young LLP, 2024, p. 2; 2025, pp. 3–4; see Table 3.2). Where EY did examine Meta's controls, it did so "not for the purpose of expressing an opinion on the effectiveness of the audited provider's internal control" (Ernst & Young LLP, 2024, p. 5; 2025, p. 5).
The relationship between the 2 and the two 0s. Considered in isolation, "findings proactively published on a fixed cycle" suggests good transparency practice. However, what is published on these obligations is that no conclusion was reached, rather than any substantive finding about the systems themselves. Publication also does not make the public the report's audience. The audit report is "intended solely for the information and use of" Meta, the Commission and the Digital Services Coordinator (Ernst & Young LLP, 2024, p. 3). From Cycle 2 it expressly excludes "users of the service" (Ernst & Young LLP, 2025, p. 4). This is EY's standard wording, also used in YouTube's report (Google Ireland Limited, 2025c, p. 5) and so a feature of the audit architecture rather than of Meta's conduct. Meta's documentary record is timely. Evidentiary content, on the obligations of greatest consequence, is minimal. The pattern is one of visible process and untested substance, (Arts 34(1), 34(2), 35(1)) recurring across both zero scores as the obligations where that gap is concentrated. Ultimately, because Independent verification and Depth of verification both score 0, Meta fails the Purpose index outright.
X
Disclosure (1). Cycle 1 findings (Articles 14(1), 14(2)) show algorithmic decision-making, human review and internal complaint-handling procedures documented nowhere in X's Terms and Conditions directly (FTI Consulting, 2024, pp. 66–67). The information exists but is dispersed across separately linked pages rather than stated at the point a user would need it (p. 13). X's Rules and Policies are treated inconsistently against its formal Terms of Service and users are not informed when they change (pp. 71, 73). Disclosure occurs, but reactively and diffusely rather than as a matter of routine, proactive practice resulting in a score of 1.
Independent verification (0). Articles 34(1), 34(2) and 35(1) were disclaimed in Cycle 2 (BDO LLP, 2025, p. 5). Under the disclaimer rule it scores 0, whatever a prior cycle found. It is nonetheless worth noting what Cycle 1 had found before the disclaimer took effect. FTI returned Positive with comments on 34(1), Negative on 34(2), No Conclusion on 34(3), and Negative on 35(1), where mitigation effectiveness was measured only by the volume of content that evaded proactive detection, with no other effectiveness measure in use (FTI Consulting, 2024, pp. 34–36). In Cycle 2, three of the four obligations were disclaimed outright. The fourth, 34(3), returned Positive, but on the strength of an assurance that supporting documents "will be preserved" and an inspection that the risk assessment itself had been retained (BDO LLP, 2025, p. 52).
Public availability (2). X's audit and implementation reports are published on the statutory cycle required under Article 42(4), proactively rather than on request. Nothing in the appendix evidence distinguishes X's case from Meta's or Google's on this narrow point.
Methodological concurrence (1). Article 20(4) requires internal complaint-handling to be applied in a timely, non-discriminatory, diligent and non-arbitrary manner. This is the DSA's standard, not X’s. The Cycle 1 finding is not that X substituted its own benchmark, as Meta did, but that FTI could not verify the DSA's existing standard was applied consistently. Complaints from high-profile accounts, when escalated, could not be confirmed as reviewed under the same criteria as standard accounts (FTI Consulting, 2024, pp. 142–143). The framework is externally set; whether it was met consistently across different classes of user remains unverified.
Depth of verification (0). In Cycle 2, BDO disclaimed 10 of X's sub-articles and, for a further 14 where no occurrences were reported, "only assessed the design of processes, systems and controls", performing no tests of implementation or operating effectiveness (BDO LLP, 2025, pp. 5–6). Of 75 conclusions, 24 therefore carry no operational verification. Cycle 1 had tested substantively: of FTI's 82 obligation-level conclusions, 9 were Negative and a further 29 Positive with comments or No Conclusion (FTI Consulting, 2024, pp. 20–44).
What the pattern shows. X's failure is broader than Meta's. Where Meta's two 0s concentrated on a fixed pair of obligations disclaimed identically across both cycles, X's two 0s sit on top of a documented collapse in scrutiny. A Cycle 1 that tested substantively found issues. This was followed by a Cycle 2 in which almost a third of the obligations discussed stopped being tested at all. Independent verification and Depth of verification both register 0 not for lack of checking, but because whatever checking occurred has now not been reported on. This is a more concerning trajectory of the two platforms, since it shows genuine oversight capacity being withdrawn rather than never having existed. Because Independent verification and Depth of verification both sit at 0, X fails the Purpose index outright. This is the same conclusion reached for Meta, though the underlying narrative here is one of erosion across cycles rather than a static, repeated gap.
YouTube
Disclosure (1). In Cycle 1, Articles 14(5) and 14(6) both returned Positive with comments (Google Ireland Limited, 2024b, pp. 28, 30): the terms-and-conditions summary and translation obligations were tested and broadly met with recommendations only. Articles 39(1) and 39(2) (advertisement repository) similarly returned Positive with comments (Google Ireland Limited, 2024b, pp. 109, 111). In Cycle 2, Article 14(6) returned Negative: 24 of 33 in-scope terms were not published in all 24 official Member State languages (Google Ireland Limited, 2025c, pp. 26–27). YouTube represented that the most deficient term was published in all languages by 19 June 2025, which EY did not evaluate (Google Ireland Limited, 2025c, p. 27). The remaining 23 were still under assessment at the time of the implementation report (Google Ireland Limited, 2025a, p. 11). Disclosure occurs and is independently tested every cycle, but the pattern across both cycles is one of partial or delayed compliance rather than proactive disclosure, band 1.
Independent verification (2). In my coding of EY's obligation-level conclusions for YouTube (Appendix B), every applicable risk-assessment and mitigation sub-article received a conclusion in both cycles. Articles 34(1) and 34(2) returned Positive with comments in both cycles (Google Ireland Limited, 2024b, pp. 96, 98; 2025c, pp. 103, 106). Article 34(3) returned Positive in both (Google Ireland Limited, 2024b, p. 100; 2025c, p. 107). Article 35(1) returned Positive in Cycle 1 and Positive with comments in Cycle 2 (Google Ireland Limited, 2024b, p. 102; 2025c, p. 111). Articles 35(2) and 35(3) are not obligations on the provider and were marked not applicable (Google Ireland Limited, 2024a, p. 50; 2025a, p. 38). EY's own declaration confirms the result: in both reports, the section for obligations where "an audit conclusion could not be reached with a reasonable level of assurance" (Article 8(8) of the Delegated Regulation) reads "Not applicable" (Google Ireland Limited, 2024b, p. 137; 2025c, p. 178). No risk-assessment or mitigation obligation was therefore disclaimed or left without a conclusion in either cycle. This is the strongest record on this indicator of any platform in the study.
Methodological concurrence (1). EY declares that both engagements were conducted under ISAE 3000 (Revised) (Google Ireland Limited, 2024b, p. 6; 2025c, p. 6), as the Delegated Regulation's Annex I, Section B.5 requires. The procedural standard is named and external to YouTube. The substantive benchmarks are not. In both cycles EY states that "many of the obligations needed to be supplemented by the audited provider's own legal determination, operational benchmarks and/or definition of ambiguous terms" (Google Ireland Limited, 2024b, p. 10; 2025c, p. 172). The Article 24(5) finding, for example, is measured against YouTube's own "4-day operational benchmark" (Google Ireland Limited, 2024a, p. 24). This is the same language EY used auditing Facebook (Ernst & Young LLP, 2024, p. 11; 2025, p. 122). The same auditor applies the same caveat to both clients. A common procedural framework with provider-defined substantive benchmarks is band 1.
Depth of verification (1). The Articles tested, 14(6)'s translation completeness (Google Ireland Limited, 2025c, pp. 26–27), 24(1)'s transparency-report specificity (Google Ireland Limited, 2024b, p. 68; 2025c, p. 75), 22(1)'s trusted-flagger delay (Google Ireland Limited, 2025c, p. 60) are procedural and reporting-focused. As such, they are not obligations that reach the platform's ranking, weighting, or recommender logic. A tested, disclaimer-free examination, but of process rather than of the system's governing logic itself.
What the pattern shows. YouTube's Purpose record is the only one of the three with no indicator at 0. The strongest indicator, independent verification, contrasts with Meta's and X's weakest results, systemic risk assessment and mitigation, a reversal of the pattern on the other two platforms. The three 1s, Disclosure, Methodological concurrence, Depth of verification, show the record does not yet clear the top band on every indicator. YouTube's record shows disclaimer-free testing throughout, and a named procedural standard, though with provider-defined substantive benchmarks. However, the benchmarks against which compliance is measured remain YouTube's own.
Its Purpose score is 1. No indicator at 0, so YouTube does not fail the Purpose index outright, unlike Meta and X. This is the first index score, for any platform in this research, above the minimum.
Table 4.2. Petition (Justificatory Addressability): scores by platform
| Indicator | DSA Articles | Meta | X | YouTube |
|---|---|---|---|---|
| Existence of an external addressee for individual grievances | 11, 12, 37 | 1: Internal channel only; no certified external body | 1: Internal channel only; no certified external body | 1: Internal channel only; no certified external body |
| Enforceability of findings | 37(6), 42(4)(d) | 0: Advisory only | 0: Advisory only | 1: Must engage and report; not required to implement |
| Accessibility of the channel to an individual citizen | 16, 20, 21 | 0: Realistically usable only by well-resourced actors | 0: Realistically usable only by well-resourced actors | 1: Open to individuals; cost or procedural burden |
| Outcome reporting | 17, 24(5), 42(4)(c)–(d) | 0: Outcomes not reported | 2: Reported with enough granularity to assess function | 1: Aggregate statistics only |
| Index score | 0 | 0 | 1 |
Source: author's scoring.
Evidence for each score is given in the platform narratives below and in Appendices A–C.
Meta
The one indicator reflecting a functioning channel, existence of an external addressee. Article 12(1) establishes a single point of contact through which EU users can communicate directly with Meta. The Cycle 1 audit found this channel working, with one qualification: 1 of 25 sampled requests was not answered within Meta's own 7-day "rapid response" target, attributed to a volume spike (Ernst & Young LLP, 2024, p. 16). A channel exists and, on the evidence tested, functions. It falls short of the top band because it is a point of contact rather than the external, independently certified body the top band specifies.
The three indicators reflecting the absence of functional recourse: Enforceability (0), Accessibility (0), Outcome reporting (0). On Enforceability, Meta declined an auditor recommendation in Cycle 2. EY concluded that Meta complied with Article 14(2), with comments, and recommended that Meta assess whether changes to the webpages linked from its Terms of Service were significant enough to notify users (Ernst & Young LLP, 2025, p. 15). Meta replied that the recommendation would extend compliance "beyond the contours of Art. 14(2)", and that "no additional measures, over and above MPIL's existing measures, have been implemented" (Meta Platforms Ireland Limited, 2025, pp. 4–5). X made the same move on Article 25, arguing that its auditor's finding "goes beyond the requirements" of the Article (Twitter International Unlimited Company, 2024, p. 42). Nothing in the audit regime compels reconsideration: a provider may decline a recommendation provided it justifies its reasons (Regulation (EU) 2022/2065, Art. 37(6)). The regime is advisory by design.
On Accessibility, the evidence is mixed rather than absent. The 0 reflects a judgement on that mixed record rather than a default. Article 20(4) and 20(5) were tested and returned Positive with comments, the same finding already noted under Methodological concurrence, where two sampled appeals missed Meta's self-set 7-day timeliness target. Set against that finding is a much larger disclaimed cluster: Articles 16(1), 16(5), 16(6), 20(1) and 20(3), covering the notice-and-action and internal complaint-handling mechanisms, were disclaimed in both cycles (Ernst & Young LLP, 2024, p. 2; 2025, pp. 3–4; see Table 3.2). The tested evidence, on Article 20(4), indicates only how quickly Meta handled appeals that had already been successfully lodged, measured against Meta's own timeliness benchmark (Ernst & Young LLP, 2024, pp. 31–32; 2025, pp. 34–35). The disclaimed obligations cover an earlier question: whether the routes into that process, flagging content and lodging a complaint at all, are accessible to a genuine complainant in the first place. The indicator is scored on the obligations that define the channel, not the one obligation that happened to be tested, which is why the mixed record still returns 0.
On Outcome reporting, Article 17(1), the statement-of-reasons obligation, was disclaimed in both cycles. Article 17(3) was tested in Cycle 2 and returned Positive with comments: Meta's statements of reasons did not specify whether a decision followed a notice or automated detection, as Article 17(3)(b) requires (Ernst & Young LLP, 2025, p. 30). The score remains 0: the disclaimer rule applies to the obligation that defines the indicator, Article 17(1), whatever a narrower, adjacent obligation shows.
What the pattern shows. A working point of contact exists and is evidenced. Beyond that, the audit record either finds against Meta directly (Enforceability), finds only on a narrow procedural item while leaving the substantive mechanism untested (Accessibility), or is silent on the core obligation by disclaimer while returning a finding on an adjacent one (Outcome reporting). In each of the three failing indicators, some evidence exists; in none of them does it meet the obligation the indicator is testing.
Because Enforceability, Accessibility and Outcome reporting all sit at 0, Meta fails the Petition index outright. One functioning point of contact does not offset the absence of enforceability, of accessibility on the mechanisms that matter, or of outcome transparency on the core reporting obligation.
X
Existence of an external addressee (1). Articles 11(2) and 12(2) require X to make its points of contact for authorities and users easy to identify. In Cycle 1, FTI found the information publicly available but not easily accessible: a process-flow error in the Help interface meant the relevant form was reached only by clicking "Contact Us" twice (FTI Consulting, 2024, pp. 20, 53–54, 63). X reports having fixed the flow in August 2024 (Twitter International Unlimited Company, 2024, pp. 2–4).
Enforceability (0). Article 14(4), Cycle 1: FTI concluded Positive with comments (FTI Consulting, 2024, p. 21). Its detailed finding states that “insufficient evidence of objectivity was seen in enforcement of the Terms of Service”, attributing this to "accepted privileges for accounts with large followers or certain checkmarks" (FTI Consulting, 2024, p. 77). X did not simply decline the recommendation; it inverted the finding's premise. It argued that high-follower accounts require "prioritized moderation for effective risk mitigation" (Twitter International Unlimited Company, 2024, pp. 11–12).
Accessibility (0). In Cycle 1, FTI reached a Negative on Article 16(3): having confirmed content as illegal in one Member State, X does not assess whether it is illegal in others where it may be viewed (FTI Consulting, 2024, pp. 23, 99). Articles 20(1), 20(4) and 20(5) each returned Positive with comments: statements of reasons to advertisers did not identify the violation, escalated complaints from high-profile accounts could not be verified as reviewed under the same criteria and redress notices sometimes omitted out-of-court dispute settlement information (FTI Consulting, 2024, pp. 26–27). Article 16(6) reached No Conclusion in Cycle 1 and, with 16(5), was disclaimed in Cycle 2 (FTI Consulting, 2024, p. 24; BDO LLP, 2025, p. 5). Unlike Meta's record on this indicator, each of these tested obligations surfaced a deficiency rather than a narrow caveat.
Outcome reporting (2). Articles 17(1), 17(2) and 17(3) returned Positive with comments in Cycle 1: statements of reasons for advertisers did not identify the violation, advertisers were not consistently notified of monetisation restrictions from the date imposed and statements of reasons for pausing ads revenue sharing omitted redress information (FTI Consulting, 2024, pp. 24–25). In Cycle 2, all three returned Positive (BDO LLP, 2025, pp. 26–29). Deficiencies identified in Cycle 1 were retested a year later and found resolved: identification, followed by remediation and independent verification that the remediation held.
What the pattern shows. X's Petition record does not fail uniformly, attracting scores across the full 3 value range. A working point of contact exists, functioning despite a navigational defect. Outcome reporting shows the audit mechanism working as intended, an issue corrected, then independently confirmed as resolved. Set against that, Enforceability and Accessibility show a more troubling pattern: not absence of testing, as with Meta, but active contestation of a finding's legal meaning and a consistent run of tested obligations each returning a real deficiency rather than a caveat. Where Meta's failures came from obligations never reaching an opinion, X's come from obligations that were tested, opined on and either disputed or found wanting outright. Because Enforceability and Accessibility both sit at 0, X fails the Petition index outright. One functioning point of contact and one genuinely resolved obligation do not offset the absence of enforceability or of accessibility on the mechanisms that matter.
YouTube
Existence of an external addressee (1). Articles 11 and 12, the points of contact for authorities and for users, returned Positive in both cycles (Google Ireland Limited, 2024b, pp. 17–22; 2025c, pp. 14–18). This is a stronger record than Meta's (a single missed 7-day target out of 25 sampled requests) or X's (a process-flow defect making the channel hard to reach). The auditor, EY, is itself an external party, appointed in both cycles (Google Ireland Limited, 2024a, p. 3; 2025a, p. 3). The indicator still scores at band 1 rather than 2: the top band specifically requires the external, independently certified body under Article 21, not a point of contact under Articles 11 and 12.
Enforceability (1). No declined recommendation appears in YouTube's implementation reports (Google Ireland Limited, 2024a, pp. 6–44; 2025a, pp. 8–28). Every finding is engaged with and most are remediated or in progress, though not all: on Article 16(1), YouTube is still "determining the extent to which remediation is necessary and appropriate" (Google Ireland Limited, 2025a, pp. 13–14). This is the strongest enforceability record of any platform in the study. Band 2 is structurally unreachable for platforms under the current DSA architecture: Article 37(6) obliges only that a recommendation be "taken due account of", never implemented. No mechanism exists to compel a fix regardless of platform conduct. YouTube's score of 1 therefore reflects the best available outcome under a ceiling the DSA itself imposes, not a shortfall in YouTube's own response. The democracy-relevant finding here is not about YouTube specifically: Meta's Article 14(2) shows what the same architecture permits when a platform chooses otherwise. Until a positive audit finding carries a direct enforcement consequence, every platform retains the fallback ability YouTube chose not to use.
Accessibility (1). Articles 16(1), 16(5), 16(6) and 20(1) were tested in both cycles, and none was disclaimed (Google Ireland Limited, 2024b, pp. 33, 38–39, 50; 2025c, pp. 31, 35, 37, 47). Article 21, not applicable in Cycle 1, returned Positive on 21(1), 21(2) and 21(5) in Cycle 2 (Google Ireland Limited, 2024a, p. 50; 2025c, pp. 55–58). YouTube's record is one of full testing. This is a fuller and more consistent testing record than either Meta (a disclaimed core cluster) or X (a run of comprehensive deficiencies). Each auditor finding is a narrow operational gap rather than an untested obligation or a systemic failure. In Cycle 2, the notice mechanism for allegedly illegal content was not operable on the desktop webpage for users without a YouTube channel, though those users could still report through the Help Centre webform (Article 16(1)) (Google Ireland Limited, 2025c, p. 31). In Cycle 1, YouTube did not retain evidence of when decisions on notices were made. In Cycle 2, YouTube represented that it had retained this from 27 March 2025, but EY did not obtain evidence of it (Articles 16(5) and 16(6)) (Google Ireland Limited, 2024b, pp. 38–39; 2025c, pp. 35, 37). Also in Cycle 2, a public-facing appeal policy stated that appeals could be filed up to 90 days after a warning or strike, when the system allowed six months (Article 20(1)) (Google Ireland Limited, 2025c, pp. 46–47).
Outcome reporting (1). Article 24(1) (transparency-report specificity on suspensions) returned Negative in both cycles for the same defect: suspensions for manifestly unfounded complaints were not reported per platform (Google Ireland Limited, 2024b, p. 68; 2025c, p. 75). The breakdown was missing again from the August 2024 Transparency Report and was supplied only in February 2025, nine months after the Cycle 1 examination period ended (Google Ireland Limited, 2025c, p. 75). Article 24(5) (statement-of-reasons submission timeliness) returned Negative in Cycle 1, with 14 percent of statements submitted late (Google Ireland Limited, 2024b, p. 73), and Positive in Cycle 2 (Google Ireland Limited, 2025c, p. 80). Article 17 (individual-level statements of reasons) returned Positive in both cycles (Google Ireland Limited, 2024b, pp. 41, 43; 2025c, pp. 39, 41). Both audit reports and both implementation reports are published, satisfying Article 42(4)(c)–(d) (Google Ireland Limited, 2024a; 2024b; 2025a; 2025c). A defect flagged, repeated in the next reporting period and corrected only late holds the indicator at band 1.
What the pattern shows. All indicators score 1. This is based on disclaimer-free testing, with a finding attached to each auditor judgement. The contact channel works but is not the certified adjudicatory body band 2 requires. Recommendations are acted on, but nothing makes a finding binding. Accessibility obligations are tested, but each reports an issue. Outcome reporting has a gap that recurred across both cycles before late correction. This is a different position from Meta, where obligations went untested altogether, and from X, where obligations were tested and either disputed or found deficient. YouTube's Petition record is one of consistent, moderate friction across every indicator, not extreme failure and not complete success either.
Table 4.3. Peer (Minimal Co-authorship): scores by platform
| Indicator | DSA Articles | Meta | X | YouTube |
|---|---|---|---|---|
| Permanent channel to contest the governing logic itself | 21 | 1: Narrow or conditional channel | 1: Narrow or conditional channel | 1: Narrow or conditional channel |
| Independence of any structural-input mechanism | 37(3); Delegated Reg. (EU) 2024/436, Annex I, B.4–B.5 | 1: Nominally external; funding or governance entanglement | 0: Controlled by the regulated entity | 1: Nominally external; funding or governance entanglement |
| Functioning access to system-level data | 40(12), 24(5), 37(4)(d), 38 | 0: No usable external access to system-level data | 0: No usable external access to system-level data | 1: Access exists but incomplete or unreliable |
| Index score | 0 | 0 | 1 |
Source: author's scoring.
Evidence for each score is given in the platform narratives below and in Appendices A–C.
Meta
Contesting channel (1). Article 21 establishes certified out-of-court dispute settlement bodies, and Meta's Cycle 2 audit found this positive, without comment, on 21(1), 21(2) and 21(5) (Ernst & Young LLP, 2025, pp. 40–42). It fails to achieve the top band because of what the mechanism actually reviews. Article 21 bodies rule on individual disputes, whether a specific decision should be overturned, not on the governing logic that produced the decision in the first place. A channel that exists and is tested still scores 1 rather than 2 if its scope is confined to outputs rather than the system that generated them. That is the case here. The space of reasons is limited.
Independence (1). The baseline is Article 37(3) and the Delegated Regulation's independence provisions (Annex I, Sections B.4–B.5). Meta's auditor, EY, is nominally external, a third-party firm, but is selected and paid by Meta itself, in both cycles. That is precisely the funding and governance entanglement band 1 describes: the mechanism is not internal to Meta, but it is not free of Meta's control over who performs the check either. It falls short of band 2, which requires the mechanism to be governed by parties other than the regulated entity.
System access (0). Primary Transparency Database evidence, drawn from Facebook's full July 2026 submissions (29,454,716 statements of reasons; see footnote 2), shows the decision_facts field taking only two values across the entire month: "This account was determined to violate terms of service" (20,628,316 statements) and "This content was determined to violate terms of service" (8,826,400). The same two sentences are used regardless of what was actually decided, across 13 statement categories, both decision grounds and every type of action, including 1,085,971 decisions categorised as negative effects on civic discourse or elections and 933 decisions grounded in illegal content. In a 1,000-row sample from 30 June 2026, the incompatible_content_ground field returned a single identical string, "This was a violation of "sections 3.2" of our terms of service". Whatever reasoning Meta's systems applied, the disclosed output cannot distinguish one case from another. The pattern is not unique to this research. Kaushal et al. (2024), analysing over 131 million statements of reasons submitted by all 16 VLOPs then reporting, between 19 and 28 November 2023 (including around 20 percent of Facebook's submissions to that date), found Facebook using the same two-template structure, then worded "terms of use" and the same single ground string (Kaushal et al., 2024, pp. 1122, 1127). The disclosure has therefore remained essentially unchanged for both audit cycles. Article 40(12), the route through which outside researchers would reach the underlying data, was disclaimed in both cycles (Ernst & Young LLP, 2024, p. 2; 2025, pp. 3–4; see Table 3.2). This evidence also bears directly on an obligation the audit left unverified: Facebook's submissions to the database under Article 24(5) were disclaimed in both cycles (Ernst & Young LLP, 2024, p. 2; 2025, pp. 3–4; see Table 3.2).
A second point of corroboration sits within the audit record itself. Article 38 requires VLOPs to offer at least one recommender option "not based on profiling" (Regulation (EU) 2022/2065, Art. 38), the DSA's only mechanism giving users a structural lever over the logic applied to them. In Cycle 1, EY reached a negative conclusion on this obligation because the option was missing from the Facebook Dating recommender system "between 29 August 2023 to 15 February 2024", roughly five and a half months of the examination period, until Meta implemented it on 15 February 2024 (Ernst & Young LLP, 2024, p. 58). Two separate channels of system access, one for disclosure and one for user control, both show the same gap.
What the pattern shows. A contesting channel and an independence mechanism both exist in some form. Neither is fabricated or absent, the audit record supports a limited version of each. What is missing is the one indicator that would let a genuine act of contestation happen: system-level access good enough to reconstruct or verify the governing logic itself. Without that, the channel and the nominally independent auditor both operate on Meta's own account of what happened, because no other account is available to check it against.
Because System access resolves 0, Meta fails the Peer index outright. A contesting channel and a genuinely external auditor do not amount to co-authorship if neither can be tested against the system's actual logic.
X
Contesting channel (1). In Cycle 1, FTI found 21(1), 21(2) and 21(5) Positive, but because no out-of-court dispute settlement bodies had yet been certified in Ireland, so there were "subsequently no requirements to satisfy" (FTI Consulting, 2024, pp. 27–28, 152). In Cycle 2, BDO found no occurrences and assessed only the design of the process, concluding Positive with comments (BDO LLP, 2025, pp. 6, 35–37). Across both cycles, X has never had this obligation operationally tested. The channel exists on paper in both years; whether it functions has not yet been established either way, which is what band 1 describes.
Independence (0). Like every DSA provider, X selects and pays its auditor. What moves X below band 1 is how that power was used. FTI's Cycle 1 audit reached Negative conclusions on interface design, the protection of minors and the systemic-risk obligations (FTI Consulting, 2024, pp. 33, 35–36, 191). For Cycle 2, X replaced FTI with BDO LLP, a member of the European Contact Group (Albert, 2025), which reached no conclusion on the systemic-risk obligations then under Commission proceedings (BDO LLP, 2025, p. 5). The professional standard changed with the firm, from ISACA's standards to ISAE 3000 (Revised) (FTI Consulting, 2024, pp. 10–11; BDO LLP, 2025, pp. 4, 72). Meta and YouTube hold the same power of selection but did not exercise it against an adverse audit; X did. That is control over the check, not merely entanglement with it.
System access (0). Primary Transparency Database evidence, drawn from X's full July 2026 submissions (379,888 statements of reasons, retrieved 3 September 2026; dataset X726.csv, see footnote 2 and Data), shows a similar pattern to Meta's at a smaller scale. The decision_facts field takes only 10 action-and-trigger combinations across the month, such as "Decision - action Suspend triggered by the system with no human intervention". The decision_ground field returns DECISION_GROUND_ILLEGAL_CONTENT for every statement, with none under the terms-of-service ground on which Meta relies almost exclusively. The illegal_content_legal_ground field shows more surface variety, 74 distinct values across the month, against Meta's single fixed string. But each value is a short internal policy code, such as PlatformManipulation, Cse or NsfwAdultContent, which names the category that applies rather than explaining the specific case. In all of the 379,888 statements, the illegal_content_explanation field repeats that code verbatim: the field meant to explain why content is illegal restates the category instead. Pasquale's description of credit 'reason codes' applies. Rather than explain what happened, they simply name a factor in the decision (Pasquale, 2015, p. 149). A wider menu of categories is still a menu of categories. Data that is schema-compliant but withholds case-specific content functions as a denial of access and is scored accordingly rather than given partial credit for the larger menu. Article 40(12), researcher data access, points the same way: tested Positive in Cycle 1 (FTI Consulting, 2024, p. 40), it was disclaimed in Cycle 2 (BDO LLP, 2025, p. 5) and, under the disclaimer rule, scores 0.
YouTube
Contesting channel (1). Article 21 was Not Applicable in Cycle 1 (Google Ireland Limited, 2024a, p. 50) and tested for the first time in Cycle 2, returning Positive, no comments, on 21(1), 21(2) and 21(5) (Google Ireland Limited, 2025c, pp. 55–58). X's Cycle 1 finding was Positive because no certified dispute-settlement bodies yet existed in its jurisdiction to test against. YouTube's Cycle 2 finding, by contrast, is substantive: EY inspected the service's public-facing site and confirmed it links to the list of certified out-of-court dispute settlement bodies and their contact details, and that this information is "easily accessible… clear, and user friendly" (Google Ireland Limited, 2025c, p. 55). This is a tested mechanism, though what was tested is narrower than it appears. EY's positive conclusion on Article 21(2), the duty to engage in good faith, was measured against YouTube's own definition of good faith: maintaining a process to consider each dispute and respond to the body (Google Ireland Limited, 2025c, p. 56). Over a largely overlapping period, Appeals Centre Europe reported that YouTube had shared no content with it, and 13 of its 29 YouTube decisions were default decisions (Appeals Centre Europe, 2025, p. 48). The audit confirmed that a process exists. However, it did not establish that the process gives a dispute body what it needs to decide. The score is unaffected, since the indicator is already capped at 1 on scope, but the case shows the gaps the Depth of verification and Methodological concurrence indicators are built to register: a control confirmed to exist rather than shown to work, measured against a benchmark the platform wrote. It still caps at band 1 rather than 2, for the same structural reason as Meta and X: Article 21 bodies rule on individual disputes, not on the governing logic that produced the decision.
Independence (1). EY, the same auditor in both cycles, formally declares its engagement under ISAE 3000 (Revised) (Google Ireland Limited, 2024b, p. 6; 2025c, p. 6), as the Delegated Regulation's Annex I, Section B.5 requires. That declaration is auditor-attested rather than independently confirmed, and, as noted under Methodological concurrence, the standard is applied against benchmarks YouTube itself defines. EY is nominally external, but it was appointed by Google Ireland Limited in both cycles and the audit is conducted at the provider's "own expense" (Google Ireland Limited, 2025a, p. 3). This is the same funding-and-selection method that holds Meta at band 1. YouTube avoids X's additional problem, a change of firm and standard between cycles, but does not clear band 2, which requires governance by parties other than the regulated entity.
System access (1). Primary Transparency Database evidence, drawn from YouTube's full July 2026 submissions (4,582,544 statements of reasons, retrieved 3 September 2026; dataset YT726.csv, see footnote 2 and Data), shows decision_facts taking 359 distinct values of explanatory prose that distinguish violation types. In the incompatible_content_explanation field, 4,184,859 of YouTube's 4,582,544 July statements (91 percent) link to a specific policy page; almost all of these (4,148,118) link to Google's advertising policies. The richer explanation is therefore concentrated in advertising decisions, including all 20,375 statements categorised as negative effects on civic discourse or elections. The remaining 434,426 statements carry policy-level rather than case-level explanations, with three standard texts accounting for almost half of them. This is a substantially different pattern from Meta's fixed sentences or X's bare policy codes. It still falls short of band 2. The underlying data remains a grouped export by violation type, not an account of why this particular item was actioned over another matching the same template. A second area of evidence supports the same score: Article 40(12), researcher data access, returned Positive, no comments, in both cycles (Google Ireland Limited, 2024b, p. 117; 2025c, p. 132). YouTube is the only platform with a clean, consistently tested record on this obligation across the analysis. Its Peer score is 1, the same as for Purpose and Petition.
Headline results
Meta's headline result. Purpose, Petition and Peer each floor at 0, through Independent verification and Depth of verification under Purpose, Enforceability, Accessibility and Outcome reporting under Petition, and System access under Peer. Because the headline Harm Index score is the minimum across all three indices, not their average, Meta's overall result is 0. This is not an averaging approach or a single weak indicator dragging down an otherwise adequate record. All three indices fail independently, on different obligations and for different reasons.
X's headline result. Purpose, Petition and Peer each resolve at 0 : through Independent verification and Depth of verification under Purpose, Enforceability and Accessibility under Petition and Independence and System access under Peer. The headline Harm Index score is the minimum across all three indices, the same headline figure as Meta, though reached through a different evidentiary path. Where Meta's failures concentrated on obligations that were never independently tested at all, X's failures are drawn substantially from obligations that were tested and found wanting: a disputed legal interpretation (Enforceability), a run of genuine accessibility deficiencies rather than a single caveat (Accessibility) and an auditor replaced after adverse findings (Independence). X also shows the one clean instance of the audit mechanism working as designed anywhere in either platform's record, Outcome reporting, a genuine failure in Cycle 1 independently verified as resolved in Cycle 2. As with Meta, any one of the three failing indices would have been sufficient on its own to produce this result; the minimum rule confirms a finding that holds under several different ways of reading the same record.
YouTube's headline Harm Index score is 1. Each of its three indices scores 1: no indicator falls to 0, but none clears the top band across a whole index. It is the first result across any platform in this study that moves from the lowest score.
What the Data Shows and Why It Matters for the Edge of Democracy
Thirty-six scored indicators across three platforms, twelve indicators * three platforms, were drawn from primary audit reports, implementation reports and Transparency Database information for July 2026. This provides a set of data which combines third party auditors, platform responses, raw data and DSA Articles.
The result of the Harm Index model is aggregated as follows:
Table 4.4. Aggregated Results
| Table | Meta | X | YouTube |
|---|---|---|---|
| Purpose | 0 | 0 | 1 |
| Petition | 0 | 0 | 1 |
| Peer | 0 | 0 | 1 |
| Harm Index | 0 | 0 | 1 |
Two platforms output the minimum score the model can produce, Meta and X, with YouTube scoring 1. I have shown that the model has scope for variation, not just at the headline level (0, 0, 1) but within it. Across the thirty-six scored indicators, individual scores span the full 0–2 range. Where platforms score poorly or at the top range, this is driven by the evidence base.
How the two 0s are reached provides further evidence of where and how platforms do not achieve the goals of the DSA. Meta's failure is concentrated. The same Articles used in Independent verification and Depth of verification under Purpose and System access under Peer are disclaimed identically across both audit cycles. Nothing was independently tested on the platform's recommender logic and systemic risk in either audit year. X's failure is distributed differently. Articles were tested, and either actively disputed, Enforceability, via a competing legal reading of Article 14(4), or found repeatedly lacking, Accessibility, together with an auditor replaced after adverse findings, Independence. Meta's verification did not reach the target. X's verification functioned procedurally but was defeated substantively. The audit mechanism worked. FTI reached unfavourable findings: a Positive with comments on Article 14(4), qualified by 'insufficient evidence of objectivity' in enforcement (FTI Consulting, 2024, pp. 21, 77) and Negatives on the systemic-risk obligations, Articles 34(2) and 35(1) (FTI Consulting, 2024, pp. 35–36). How X reacted to this is the core problem. X did not accept or decline these findings, it supplied a competing legal reading of the obligation itself, arguing the very conduct FTI flagged was what the law required. On Article 26(2), X declined a recommendation to improve commercial-content detection, citing the auditor's own positive conclusion as its justification for not acting (Annabell, 2025). Where the findings were most problematic, on systemic risk, now under formal Commission proceedings (BDO LLP, 2025, p. 5), X replaced the auditor (Albert, 2025). In each instance, a finding was reached and X's response was not correction but reinterpretation, justification or discontinuation. Verification happened, surfacing non-compliance, but X's response neutralised the finding rather than acting on it. Meta and X achieve the same score through different routes. This is the model's evidence of two structurally distinct ways an accountability mechanism can fail. Similarly, YouTube provides a control case for the model. Each indicator in the three tables clears band 1 resulting in none scoring 0. Its Independent verification score is the strongest recorded for any platform on any indicator in my analysis. This is tested and disclaimer-free in both cycles. These are the systemic-risk Articles (34, 35) where Meta and X failed. YouTube's score of 1, rather than 2, illustrates that the model does not have an automatic-fail risk embedded. A pass is possible under the same rules that produced Meta's and X's 0s.
This pattern is not confined to the three platforms scored here. Two independent studies, each covering different obligations and different platforms, reach the same underlying conclusions. On Methodological concurrence specifically, the self-authored-benchmark problem this model identifies from what is present or absent in individual findings has been stated directly by an auditor. Auditing Facebook's recommender-system obligations under Articles 27 and 38, EY noted that many obligations required supplementing with the audited provider's own legal determination, benchmark or definition of terms (Chapman, 2025; see also Ernst & Young LLP, 2024, p. 11). EY's YouTube reports carry the same statement in both cycles: "many of the obligations needed to be supplemented by the audited provider's own legal determination, operational benchmarks and/or definition of ambiguous terms" (Google Ireland Limited, 2024b, p. 10; 2025c, p. 172). The same auditor applies the same caveat to different clients, so even a shared auditor does not produce a shared benchmark. EY also notes that "the professional standards applied prohibit the auditing organization from developing its own criteria" (Google Ireland Limited, 2025c, p. 172). The benchmarks are therefore authored by the platforms, not the auditors. This correlates with my findings and raises issues of comparability across platforms. Where each platform authors the benchmark it is audited against, consistency across platforms becomes even more difficult to achieve. On the problem of what an auditor's "compliant" verdict establishes, a comparative study of eight platforms' Article 26(2) audits, found all of them rated compliant despite inconsistency in audit methodology: no defined sample sizes in most reports, auditors using different procedures on the same obligation and at least one instance of an auditor's report omitting a disclosure feature the platform itself publicly advertises (Annabell, 2025). Uniform positive findings are achieved by inconsistent means. This raises an increased risk of legitimising the gap the DSA's audit mechanism is in place to close.
The above studies support the same methodological choice my model makes. An auditor's headline verdict, Positive, Positive with comments, compliant, is not treated as the final acceptance. The evidence underlying the audit is re-examined against my model's twelve indicators. Even with the audit process and the DSA being in its early stages, the emerging literature and my Harm Index find the same credibility gap in DSA audit practice.
Returning to my model's underlying claim, outlined in Sections 1 and 2. Democratic erosion via online platforms does not require force or acknowledged denial. It happens when the space of reasons in which citizens could contest a platform's exercise of power is structurally occupied. This is, within the scope of the DSA, exhibited under the formal appearance of accountability in the form of published audits, implementation reports and statements of reasons. I provide the evidence of where and how this can be located. Meta's and X's 0s are not demonstrations that erosion is occurring but demonstrations that the mechanism, DSA, built to verify whether harm is occurring did not, or could not operate on the Articles that work on the edge of democracy. These focus on systemic risk, recommender logic, researcher access to the platform's own account of its conduct. The disclaimer pattern, an auditor declining to reach any conclusion where an investigation is live, is not an abstract, governance-design flaw. It is one with a direct, measurable consequence. This is the reason Meta's Purpose score is 0 for the same two Articles, using the same commentary in consecutive years.
YouTube's 1 is equally important to my conclusions. This shows that the erosion my model detects is not an inherent property of internal platform governance, although this could feature, nor of the DSA's architecture. It is contingent, at least partially, on how a given platform's audit relationship is conducted. The same regulatory instrument and indicators concluded a different, better scoring result for a platform whose auditor tested the highest-stakes obligations, in both cycles, without disclaiming them. This supports the need for independent oversight of the audit process itself, with power to inspect individual source material. The gap identified in Meta's and X's records is not inevitable. Disclaimers need not be used as a default. Currently that is a choice left entirely to the audited platform and its chosen auditor. This is the disclaimer functioning as a risk. Not that it wrongly says a platform is compliant, but that it lets an auditor avoid ever having to say it is not.
Section 5 - What the Test Cases Show About Audit Architectures
In Section 4, I tested three of the largest VLOPs against my Harm Index. The twelve indicators show that Meta and X fail across all three indices, placing them beyond the edge of democracy, dominating the space of reasons towards citizens and the state. YouTube achieved the most positive result, with a consistent score of 1 across all three indices. This places it at the edge: standing holds, but precariously, short of secure (2).
A macro-level examination of the 2025 audit reports across 21 VLOPs and 2 VLOSEs, published by KPMG (2026), correlates with my findings. The cohort has expanded from the initial 19 services as newly designated platforms completed their first audit cycle (KPMG, 2026, p. 4). Holding a dual role, KPMG is not a disinterested source. KPMG is a DSA auditor and a member of the European Contact Group, the industry coalition whose guidance on disclaiming obligations under Commission investigation is examined in Section 3 (Albert, 2025). Its analysis is used here as evidence from within the audit profession, not as independent confirmation. The two VLOSEs are included in KPMG's aggregate figures, but they account for 2 of the 23 reports analysed (KPMG, 2026, p. 31). The obligations examined are predominantly Chapter III platform obligations meaning that their inclusion does not distort the findings. The failures are not anomalies confined to Meta, X and YouTube; the audit profession's own cross-platform analysis shows them to be structural features of the wider cohort.
From KPMG, the headline figures in the 2026 cross-platform benchmark suggest a developing compliance. Overall, positive opinions rose to 79 percent, from 72 percent, while negative opinions fell to 6 percent (KPMG, 2026, p. 6). This aggregate finding does not survive when examined in detail. This is supported by KPMG’s finer analysis. Applying my Harm Index, in conjunction with KPMG’s analysis, the aggregate progress proves to be insubstantial. The full audit population exhibits persistent, systemic failures concentrated in the areas governing democratic contestation. Applying my three indices, I show how this conclusion is sustained.
Purpose, Index 1, focuses especially on Articles 34 and 35: risk assessment and risk mitigation. They rank highest by request frequency among the EC's enforcement priorities. Of the 58 requests for information, 15 led to the opening of an investigation or formal proceedings (KPMG, 2026, p. 26). There is no DSA requirement for auditors to disclaim if an EC investigation is underway; as Holznagel (2025, Observation 1) argues, Article 37 contains no provision allowing obligations under investigation to be skipped. On my reading, disclaiming risks rendering the audit opaquer rather than more accountable. The first enforcement outcome indicates what that opacity may conceal. The Commission's €120 million fine on X, its first non-compliance decision under the DSA, concerned deceptive interface design, the advertisement repository and researcher data access (European Commission, 2025b). These are Articles 25, 39 and 40(12), precisely the obligations on which BDO declined to reach a conclusion in X's second audit cycle (Table 3.2). In the same benchmark, KPMG note that Articles 14, 15, 24 and 42 “remain challenging” (KPMG, 2026, p. 6). This is more than a challenge. Platforms, simply put, are failing to provide users with a means to understand what happens to them once they enter a platform’s systems. Data indicates the typical global social media user is active on 6.5 platforms each month (DataReportal, 2026). Within the EU specifically, social media use is reported as an average of 67 percent with the range being 56-90 percent of citizens (data.europa.eu, 2026). A user does not need every platform they use to fail Article 34/35 to be affected. Partial failure across a user's platform portfolio still compounds, returning to my Section 1 position, leaving the user increasingly blind and casting doubt on the extent of their agency. Based on KPMG's analysis, four of my five Purpose indicators score poorly. Only Depth of verification remains clear of issues. Article 14's gaps hit Disclosure and Public availability. Articles 15, 24 and 42's benchmarking problems undermine Independent verification and Methodological concurrence. That is 80 percent of my Purpose indicators, impacted by findings the auditors themselves describe as challenging.
Petition, Index 2, particularly Article 16(5), returned a 43 percent negative-opinion rate. This is the highest failure rate of any Article in the DSA (KPMG, 2026, p. 6). The Harm Index registered the same obligation as unverified for Meta in both cycles and for X in Cycle 2, where Article 16(5) was disclaimed (Table 3.2). KPMG's cohort-wide figure shows it is not an isolated problem but a multi-platform failure. KPMG highlight related issues within the statement of reasons, Article 24(5), Transparency Database transmission and the use of duplicate statements of reasons (KPMG, 2026, p. 17). Petition assesses whether there is addressability. It asks, ‘can a request for justification be issued and acted on?’ Article 16(5) fails that test in nearly half of all audited cases, largely through late notifications and missing redress options. The statement-of-reasons problems KPMG document in their Transparency Database analysis deepen this failure. Duplicate and lost records weaken the evidentiary trail even where a notification is issued. This two-pronged dilution affects the making of a request and the understanding of any reply, if received at all. Addressability is a key space of reasons concept. Barriers to it push platform actions towards the edge of democracy, again.
Peer, Index 3, is implicated by KPMG's findings on transparency data and dispute settlement. Transmission of statements of reasons to the Transparency Database, under Article 24(5), produced duplicate statements and missing submissions. KPMG notes undocumented or unverified calculation methodologies in transparency reporting more broadly (KPMG, 2026, p. 17). Dispute settlement produces a positive and a negative finding. The positive is that challenge is being made. Eleven certified bodies across eight Member States now handle disputes under Article 21 (European Commission, 2026c) and one, Appeals Centre Europe, has received over 30,000 disputes (Hughes, 2026). These typically arrive at out-of-court dispute settlement (ODS) bodies when users contest content or account decisions. The negative lies in how platforms handle the route. Negative audit opinions on Article 21 obligations rose from none in the first cycle to between 5 and 10 percent in the second, citing the lack of a documented ODS process, decision templates that omitted information on dispute settlement bodies, inconsistent notifications and informal handling procedures (KPMG, 2026, p. 16). Platform responses compound this. Because ODS decisions are non-binding, platforms can and do disengage. Hughes (2026) reports that "in the vast majority of cases, platforms are unable or unwilling to provide" the content needed to examine a dispute, especially for account suspensions. In essence, platforms are more likely to withhold content. Platforms are required to engage with ODS bodies in good faith (Regulation (EU) 2022/2065, Art. 21(2); European Commission, 2026c), so persistent non-cooperation is the type of activity that could draw Commission scrutiny. Whether it does is discretionary (Art. 66(1)), with the burden of enforcement falling back on Commission intervention rather than on the dispute mechanism functioning as designed. The impact reaches further into the audit process. Should an Article fall under investigation, it is likely to be disclaimed (Albert, 2025; Holznagel, 2025, Observation 1; KPMG, 2026, p. 14), producing no audit conclusion, which the Harm Index scores 0.
KPMG record zero negative opinions under Article 40 in cycle 2, but their report gives two distinct reasons for this. They do not carry the same weight. Auditors were "unable to conclude" for several platforms because of ongoing EC investigations (KPMG, 2026, p. 23), a disclaimer. Separately, roughly half the population had obligations 40(1) to 40(7) marked "not applicable" because the Delegated Act became operational in October 2025, outside the audit timeframe (KPMG, 2026, p. 23). KPMG presents this as a matter of timing. I read it as inconsistency. Identical circumstances produced different audit treatment. The remaining platforms, facing the same timeline, still received audit opinions on the same Articles (KPMG, 2026, p. 23). That inconsistency points at the standardisation of approach and, more worryingly for the space of reasons, weakens the value of platform analysis individually and across the full cohort. An independent examination of researcher access under Article 40(12) found it "substantially incomplete and systematically biased" (Bekavac and Mayer, 2026, p. 3). Using sockpuppet accounts, Bekavac and Mayer reconstructed what users were shown in TikTok's For You feed during the 2024 US presidential election (July–November 2024) and Meta's Instagram Explore feed during the 2025 German federal election (January–February 2025), over 4,000 posts in total, and compared it with what the TikTok Research API and Meta Content Library returned for the same posts. Researchers could access only around 75 percent of the TikTok posts and 50 percent of the Instagram posts users saw (Bekavac and Mayer, 2026, p. 6)3. The ability to reconstruct or challenge system logic that Peer requires is obscured by the absence of negative findings, which is not the same as a positive outcome. This matters because Article 40(12) provides access specifically for research that "contributes to the detection, identification and understanding of systemic risks in the Union" (Regulation (EU) 2022/2065, Art. 40(12)), and those risks include negative effects on "civic discourse and electoral processes, and public security" (Art. 34(1)(c)). These are core areas my Harm Index is designed to identify and where noumenal power is most threatened. Where elections, civic discourse and public security are dominated, the space of reasons is constrained.
The DSA provides a framework against which VLOPs can be measured. This provides phenomenal outputs which identify multiple areas in which platforms are failing to meet their democratic obligations. This is not just a matter of mistakes being made. The ongoing nature of these problems and platforms' documented unwillingness to cooperate with dispute resolution, even when users are directly affected, show issues of governance, failure to act and disregard for user concerns. These are not accidental. They are choices which reduce users' roles in the accountability structure. KPMG's cross-platform benchmark corroborates my Harm Index, albeit adopting a broad reporting rather than in-depth system analysis. Bekavac and Mayer (2026) provide a highly focused, Article 40, analysis examining Meta and TikTok, directly linking to and reinforcing Article 24 transparency concerns. Articles 24 and 40 are core Articles impacting multiple further Articles. This highlights substantive concerns from my Harm Index. Problems with access and transparency generate a foundation capable of obscuring a platform's purpose. Linking to the interdependent structure of my Harm Index, this creates issues with a willingness to be petitioned and opportunities to challenge. Co-authorship is rendered improbable at even the most minimal of levels.
These choices extend beyond platforms' relationship with users to their relationship with the regulator. Platforms increasingly exercise functions once reserved to states, a shift Pasquale (2017) describes as “replacing the logic of territorial sovereignty with functional sovereignty”. Across the audit record they act towards the state less as regulated entities and more as counterparts contesting its authority to bind them. Platforms define the obligation: the audit criteria are built from benchmarks the audited provider supplies (Commission Delegated Regulation (EU) 2024/436, Art. 10(2)(a); Holznagel, 2025, Observation 2) and Meta treats Article 14(3) as not applicable to a service minors demonstrably use (Section 6). Platforms can and do restrict verification, with obligations under Commission investigation going unaudited and the research access through which compliance could be tested independently returning an incomplete picture of what users see (Bekavac and Mayer, 2026, p. 6). Platforms absorb sanctions. As Section 1 noted, penalties capped at a fraction of turnover (Regulation (EU) 2022/2065, Art. 74(1)) can function as a cost of doing business. The DSA's first penalty, €120 million against X, addressed three transparency obligations while the wider investigation into illegal content and information manipulation remains open (European Commission, 2025b). The response to that decision made the state-versus-platform dimension explicit. In a post on X, the United States Secretary of State said the fine "isn't just an attack on [X], it's an attack on all American tech platforms and the American people by foreign governments" (Rubio, quoted in Wardwell, 2025). The administration linked further fines to the threat of tariffs on the EU (Wardwell, 2025). A dispute between a regulator and a regulated platform was recast as a dispute between states. In Diamond and Morlino's terms, the DSA positions platforms in a relationship of horizontal accountability, answering to public bodies with the legal authority to check them (2004, pp. 25–26). The audit record shows platforms taking part instead as counterparts: choosing the checker, supplying the benchmarks, contesting what obligation means and absorbing the sanction. Diamond and Morlino note that agencies of horizontal accountability can be turned against opponents, at a cost to the credibility of the whole network (p. 26). Describing the X decision as an attack by foreign governments levels that charge at the check itself. Towards citizens, the platform occupies the governing position (Section 1; Klonick, 2018, p. 1603). Towards the regulator, it acts as a peer institution, a relation beyond the platform–user focus of Klonick's account. In both relations, it stands where a state would.
Not knowing how an influencing system works prevents citizens from engaging in the space of reasons at all. Platforms are being shown not to fail democracy in isolated cases. They fail it structurally and at scale.
Section 6 - Limits of Indexing
Section 6 addresses three limits and one further, theoretical question. The first two limits are external, arising from the DSA audit architecture on which the Harm Index depends: the absence of an agreed audit standard and the small number of reporting cycles. The third is internal, following from the Index's minimum-based, non-compensatory aggregation. The question is theoretical, concerning how, and to what extent, a platform’s capacity for structural domination can be registered through external, documentary audit: the bridge between the noumenal and the phenomenal on which the Index is grounded (Forst, 2017).
These issues return to the broader design question introduced earlier. The Harm Index is built as a three-index, twelve-indicator test, with its central methodological choice being deliberately reductive. The question is whether this reduction is appropriate for a structure such as the DSA, or whether it risks excluding core features of platform harm. The answer depends on what the Harm Index is intended to measure. It does not attempt to measure every dimension of platform quality. It asks whether the minimum conditions for a contestable space of reasons remain present.
This does not reject deliberative, thicker, democracy or deny the importance of assessing the quality of public reasoning. Habermas’s deliberative account evaluates mediated political communication in terms of publicity and transparency, inclusion and equal opportunities for participation and the prospect of reasonable outcomes (Habermas, 2006, p. 413). It also depends on a public sphere sufficiently independent of its social environments and capable of sustaining feedback between informed public discourse and responsive civil society (pp. 417–420). My claim and focus is prior to that evaluation. Before the quality of platform-mediated deliberation can be assessed, those subject to platform power must retain minimum standing. This provides the foundation from which to identify governing rules, direct demands for justification to an effective addressee and contest those rules. Where these conditions are absent, deliberation may still occur as observable speech, participation or interaction, but its quality cannot compensate for the prior failure of the conditions that make it democratic. The Harm Index, therefore, operates at the threshold of deliberative assessment, it asks whether the democratic space within which deliberation could count as democratic remains open. The threshold is specified here through Forst’s account of standing in the space of reasons and Diamond and Morlino’s account of vertical accountability, rather than through a direct assessment of discursive quality (Forst, 2017, pp. 45–50; Diamond and Morlino, 2004, pp. 21, 25–29).
Addressing the design choice. My Harm Index has shown that a method can be applied to the complex situations generated by algorithmic practices. Such systems can be rendered impenetrable by design, through secrecy and obfuscation (Pasquale, 2015, pp. 6–7) or through the complexity of the system itself (Burrell, 2016, pp. 4–5). What happens, and how outputs are produced, remains unknown to the addressee. Where information is withheld in order to steer, Forst counts the withholding itself as an exercise of power (Forst, 2017, p. 49 n. 48). Agency is degraded as a result. Addressees within the space of reasons become no more than variables themselves, acted upon rather than reasoned with (Forst, 2017, p. 50). Pasquale identifies obfuscation as concealment through excess, as when a firm answers a request for information with 30 million pages of documents (2015, p. 6), and warns that transparency can provoke complexity as effective at defeating understanding as secrecy. His remedy is to limit it (p. 8). I argue that the same risk attaches to measurement. An index that tracks every variable risks becoming an administrative wall of its own: each additional indicator is another point at which the measured party can contest definitions, supply its own benchmark or hide a failure among many passes. A large-variable approach would therefore reproduce the problem it sets out to measure. Goertz's necessary-and-sufficient structure guards against this: applied here, each added condition must earn its place as necessary, not merely relevant (2006, pp. 35–39). The aim must be to reduce complexity and, where that cannot be achieved, to create an environment in which proxies can at least interpret the system and report back on its behaviour, a version of Pasquale's qualified transparency (2015, p. 142). These proxies are the agencies of horizontal accountability introduced in Section 5: bodies with the "expertise and legal authority needed for such a monitory role" (Diamond and Morlino, 2004, p. 25). Where citizens cannot see into a system, vertical accountability can run only through such proxies, which are in turn informed by researchers and civil society acting as agents of vertical accountability (p. 29). Under the DSA, neither the proxies nor the feed that informs them holds. Diamond and Morlino require public bodies independent of those they oversee (p. 26). The DSA's auditor is instead a private firm, selected and paid by the platform it audits, and it cannot require solutions. The Commission holds that authority but is not obliged to use it (Regulation (EU) 2022/2065, Arts 37(6), 66(1)). Researcher access, the vertical feed, is incomplete (Bekavac and Mayer, 2026, p. 6). The Independence, Enforceability and System access indicators score these conditions.
Reducing complexity matters because, when examining platforms or any other potential democratic impediment, two questions arise: how is harm being caused? and how do we agree on what to include when measuring it? The first tests the hypothesis: how close a platform comes to dominating the space of reasons. The second tests why one variable should be included rather than another. The Harm Index is designed to ask the first question and to provide a means of answering it.
The DSA's structure illustrates why that discipline matters. Chapter III, the audit chapter, contains between 168 and 178 possible points of obligation across its Articles and sub-Articles, depending on how the auditor itemises them.4 That two auditors do not itemise the same chapter identically is itself an instance of the concurrence problem set out in Section 2. The points are only "possible" because not all Articles apply to all VLOPs and, as shown, many do not apply to VLOSEs. Article 14(3) is a case in point: it exempts services not "primarily directed at minors or … predominantly used by them" (Regulation (EU) 2022/2065, Art. 14(3)). What counts as a minor, and how platforms exclude them, is an issue in itself. Facebook does not apply Article 14(3), even though, as its own auditor records, minors use the service (Ernst & Young LLP, 2024, p. 10). The result is that the Article is considered and marked not applicable: a variable given a null value is not the same as an Article left uncommented or disclaimed. In practice, the determination is co-produced within the platform–auditor relationship: the platform supplies the factual and interpretive conditions and the auditor records the resulting applicability judgement. Facebook, for example, has marked Article 14(3) not applicable in both the 2024 and 2025 audit cycles (Ernst & Young LLP, 2024, pp. 9–10; 2025, p. 10). By the second cycle, the determination appears only as a shaded cell in a summary table, with no reasoning given. Regardless of how a platform answers any given Article, it remains open to challenge by the EC, typically not under the Article marked, but under others entirely. The Commission's proceedings against Meta on the protection of minors, for example, concern Articles 28, 34 and 35 (European Commission, 2024a). Article 14(3) therefore escapes scrutiny by the Harm Index, but its underlying concern, impact on minors, is captured by Articles 34 and 35, which sit within Index 1, Purpose.
A model that attempted to track every Article of the DSA, scoring each sub-Article individually, scales massively and multiplies disputes over interpretation. Consider who counts as a minor and how a platform can exclude them from Article 14(3) even when minors of every description evidently do access these platforms. This does not measure harm at the edge. Instead, it becomes a model for measuring the quality of platform service, returning to the in-depth measure declined in Section 2. Such a model is useful in answering a different question: how democratic platforms are and how well they measure against different modes of democracy. That project would move forward on the assumption that the space of reasons is already open, asking how well platforms operate within it. We are not yet at that stage. The Harm Index measures quality at the minimum number of points necessary, assessing not how well a platform performs – at zero it is dominating and at one it sits on the edge of domination - but whether the boundary beyond which questions of quality lose meaning has already been crossed.
The first limit is that no agreed substantive standard exists against which auditors measure compliance. The Delegated Regulation fixes the audit process (Commission Delegated Regulation (EU) 2024/436, Arts 9–12), but the DSA leaves core terms, including what counts as "significant", undefined (Section 3), with the audit criteria defined on the basis of benchmarks the audited provider itself supplies (Art. 10(2)(a), read with Art. 5(1)(a)). Auditors' professional standards do not fill the gap: as EY notes, they "prohibit the auditing organization from developing its own criteria" (Google Ireland Limited, 2025c, p. 172). Each platform therefore supplies the benchmark it is then measured against with auditors accepting those benchmarks case by case (Ernst & Young LLP, 2024, p. 31). As the number of VLOPs grows, so will the number of self-authored benchmarks. The problem has the potential to compound over time. The Harm Index does not offer guidance on what an externally imposed benchmark might look like, but it does highlight the need for one. The KPMG cross platform benchmarking report (KPMG, 2026, pp. 9, 14, 19, 23) supports this point. Whilst comparability across auditors was not KPMG's stated purpose, the report illustrates how far interpretation diverges within the 2025 cycle. KPMG's own findings are pitched at the level of headline concern rather than an in-depth analysis, yet those headline concerns point to the same Articles, and underlying issues, that the Harm Index's own in-depth analysis identifies independently. Measurement platform to platform carries this structural limit. However, the absence of an agreed set of guidelines, whilst it constrains cross-platform comparison, does not prevent the Index from identifying whether a platform falls on the domination side of the threshold the Index identifies.
The second limit is time. The DSA is a new instrument, with two full cycles of audits and implementation reports so far submitted. Two cycles are not enough, on their own, to distinguish an emerging pattern from a short-term issue generated as part of the audit embedding process. Later audit cycles might resolve current issues. However, what strengthens the case for harm identification at this early stage is convergence across sources with different methods and different interests. KPMG's cross-platform analysis (KPMG, 2026, pp. 6, 14, 23), which comes from within the audit profession (see Section 5), identifies concerns on the same Articles the Harm Index flags. That a firm inside the European Contact Group reaches headline concerns consistent with the Index is notable. The independent sources come from outside the profession. Holznagel (2025, Observations 1–2) and Albert (2025), analysing the audit reports directly, document the same disclaimer gaps and the reliance on provider-defined benchmarks. Bekavac and Mayer (2026) work from an entirely different evidence base. Using ‘sockpuppet’ accounts, they reconstructed TikTok's For You feed during the 2024 US presidential election and Instagram's Explore feed during the 2025 German federal election, and compared what users were shown with what the platforms' research interfaces returned for the same posts (pp. 3, 6). Researchers could access only around 75 percent of the TikTok posts and 50 percent of the Instagram posts, and, for accessible posts only, 17 and 42 percent respectively of the metadata transmitted to users (p. 6)3. Their concern is research-led scrutiny rather than the Article 37 audit, but the two meet at Article 40(12). That obligation was disclaimed for Facebook in both cycles and for X in Cycle 2 (Table 3.2). Where the audit record does not report, external testing of Meta's Content Library, the tool through which Meta provides Article 40(12) access across its services, found it substantially deficient. As Bekavac and Mayer put it, accountability resting on such access risks becoming "procedurally satisfied but substantively weakened" (p. 13).
The movement the Harm Index captures across this period is not one-directional, pointing only to negative outcomes. Scores shift up and down across indicators and indices, showing the Harm Index responds to change rather than tracking a single downward path, allowing emergent problems to be isolated before poor platform and auditing habits become embedded as standard practice. The dataset is limited, but the harms at stake, including physical risks to users and the possibility of democratic domination, are not merely hypothetical (In re Social Media Litigation, 2026; European Commission, 2026a). Available evidence already indicates that the conditions enabling them are present. Two audit cycles cannot settle every question about the long-term operation of the DSA. They are nevertheless sufficient to justify a provisional threshold diagnosis where the audit record, independent legal analysis and external testing converge on the same failures of verification, access and contestation.
The third limit is the Harm Index's own methodology: minimum-based, non-compensatory aggregation (Greco et al., 2019, pp. 75, 79). The decision rule, and its grounding in the necessary-and-sufficient structure of the concept, is set out in Section 2 (Figures 1 and 2; Goertz, 2006). The resulting values should be understood as ordinal threshold categories rather than cardinal measures of the amount of harm, we are not measuring the quantity of harm at the edge. A score of 0 does not represent twice the harm of a score of 1, and a score of 2 does not indicate the absence of all platform-related harm. Instead, the values identify the platform’s position in relation to the threshold tested by the Index: 0 indicates that a necessary condition has failed; 1 indicates that standing is precarious, at the edge of domination; and 2 indicates that standing is secure: no failure has been identified within the tested conditions. The score therefore records whether the relevant democratic conditions are present, not the quantity or comparative severity of harm.
The rule applies no differential weighting between indicators and no graduated severity within them. Any failing indicator, regardless of how narrowly or badly it failed, is treated as an equally sufficient trigger. This neutral weighting is not an omission but follows from the structure of the concept: each index is necessary, so none can count for more than another (Section 2). It does, however, create a problem for action. Determining which Article failures matter more is not part of the question the Index answers, which is a threshold question: whether the edge of democracy has been crossed into domination. It is, however, central to remediation. If only one indicator/Article pairing failed, the solution to this is straightforward – address that Article. However, where more than one Article fails, as Section 4's findings for Meta and X show, the complexity discussed earlier in this section revolves around providing a weight to Articles. Returning to the earlier Article 14(3) exploration, addressing Articles 28, 34 and 35 would reduce harm to minors but, likewise, removing the ability to disapply 14(3) would also address the minor harm more directly. These are questions that flow from the Harm Index addressing the phenomenal issues generated by platforms pushing domination into a more balanced space of reasons. A future extension of this model, built once the thin, threshold-testing case argued here has been established, would introduce a deliberately weighted layer on top of the existing Index. This preserves the threshold judgement for which the headline score is designed: no necessary condition of democratic standing may be offset by strong performance elsewhere. A weighted layer can then support the separate task of remediation, distinct from the further question of quality that arises only once a system scores 2 throughout (Section 7).
This leaves the theoretical question: the edge of democracy problem linked to noumenal power, which underpins the Harm Index. As I have covered, the Harm Index tests for the thin, threshold question of democracy, not how well debate and choice function, but whether the conditions for them to exist at all are present. Diamond and Morlino set out a minimum threshold for democracy which includes, among other criteria, universal suffrage and alternative sources of information (Diamond and Morlino, 2004, p. 21, drawing on Dahl, 1971). Of these, alternative sources of information is a key criterion linking platform impact and democracy. Where curation and opacity limit meaningful access to alternative sources, for example, the edge condition itself is unmet, and questions of how well debate might proceed cannot yet be asked.
As demonstrated in Sections 1 and 2, the three indices are mutually dependent and together provide the minimum grounding for individual standing within the space of reasons (Figure 1; Table 2.1). Accessing algorithmic logic without an addressee to respond to challenges, Purpose without Petition, renders that access of no practical use. An addressee able to respond, but with no identifiable logic to respond about, Petition without Purpose, leaves the right to object formally available but substantively empty. Without access to the "how" behind a decision, any answer at all can be offered to the "why" raised in an objection, since there is nothing fixed to check it against. Providing access to the logic of outputs and a named addressee without any possibility of contesting the response, Purpose and Petition without Peer, becomes a unidirectional notification, in much the same way the Transparency Database operates (Section 5). Each case, missing a condition, produces not a weaker version of standing but a distinct and independently recognisable overall failure. This mutual dependence means each index is a necessary feature of the other two. The Index triad resembles Bovens's (2007) definition of accountability as a relationship in which an actor must inform and justify its conduct, a forum can question and judge it, and the actor may face consequences (pp. 450–452). For Bovens, transparency alone does not amount to accountability, since it involves no scrutiny by a specific forum (p. 453): the Purpose-without-Petition case above. I take this to illustrate the logic of Section 2. Transparency is necessary but not sufficient, a point Bovens makes in calling it instrumental to accountability rather than constitutive of it (p. 450), and it is non-substitutable. It cannot stand in for an addressee, nor can an addressee stand in for it. Petition's enforceability indicator likewise tracks his requirement that the actor may face consequences, the possibility of which "makes the difference between non-committal provision of information and being held to account" (p. 451). Peer lies outside his framework, by design. Bovens separates participation from accountability, treating it as a prospective input rather than retrospective account-giving (p. 453). The Harm Index includes it because democratic standing requires more than the ability to hold power to account after the fact; it requires some standing in the rules under which that power is exercised. The Index therefore contains accountability in Bovens's narrow sense, but measures more than it.
The accounts of power and domination used here are complementary rather than identical. Forst himself distinguishes his discourse-theoretical account of non-domination from Pettit's neo-republican one: it focuses not on the robust protection of spheres of individual choice but on "the normative standing of persons as justificatory equals" (Forst, 2017, p. 51). Forst identifies the justificatory dimension of power: whether those subject to a rule stand as equal participants in the space of reasons (Forst, 2017, pp. 43, 49). Pettit identifies domination as exposure to arbitrary interference (Pettit, 1997, p. 52), while Gädeke clarifies how domination may be structurally constituted even in the absence of a recurring, directly observable act of interference (Gädeke, 2020, pp. 205–211). I draw on Pettit and Gädeke to specify the structural persistence of domination, while locating its democratic significance, for the Harm Index, in Forst's space of reasons.
Domination, within my use of noumenal power, is a distinct kind of power. Pettit defines it as the capacity to interfere arbitrarily in another's choices, whether or not that capacity is exercised (Pettit, 1997, p. 52). Gädeke adds that the capacity must be structurally constituted. A mugger does not dominate simply because a mugging occurs; what matters is whether the capacity to interfere is robust, enabled by the norms and practices around it, rather than opportunistic (Gädeke, 2020, pp. 205–207). The same distinction applies to platforms. A user need not be acted upon by a platform at a particular moment to be subject to domination. That domination lies in the architecture: unidentifiable logic, lack of addressee, inability to influence outcomes, not any single act of interference. Nor does withdrawal end it. Gädeke's account of systemic domination describes a person who avoids any direct relation with a dominator yet remains subject to the norms and practices that constitute their disempowerment, lacking "the status as a normative authority" (p. 210). Where Pettit would treat such a person as merely at risk of domination, Gädeke treats them as dominated (p. 211). A user who disconnects from platforms likewise reduces their exposure to any specific act of interference, but the architecture, and its capacity to affect every user who remains, is untouched. Aytac (2024, p. 14) reaches a related conclusion by a different route. For Aytac, given network effects and the absence of genuine alternatives, the cost of exit is too high for user consent to carry normative weight. Gädeke's account supports a stronger claim. Even where exit is affordable, it leaves the dominating structure unchanged (Gädeke, 2020, pp. 210–211). Applied to platforms, a user who leaves remains subject to the architecture, as do all who stay. Domination, for Gädeke, is a position of power rather than an action (2020, p. 207). In Forst's terms, that condition is located in the space of reasons rather than inflicted moment to moment (cf. Forst, 2017, pp. 45–46).
This has a direct consequence for how the Harm Index treats withdrawal. A user who deletes their account reduces the phenomenal trace available for individual-level observation: within the Transparency Database, for example, there is less to find. This is why the Harm Index is built to score platform-level, documentary evidence rather than individual complainant or interaction data. A method tied to individual interaction could treat withdrawal as if it resolved the underlying condition. My method, tied to systemic domination, treats such withdrawal as irrelevant to the score, since the architecture, after the user has departed, remains exactly as unaccountable for the users who remain.
The closest prior account of platform domination is Aytac's (2024), which argues on Pettit's neo-republican terms that social media companies dominate citizens in two ways: directly, through content moderation and, indirectly, through algorithmic control that narrows citizens' choices about how to engage in public debate (pp. 8, 13–18). Aytac classifies this as ‘quasi-public domination’. Such domination is seen as private in origin, but targeting individuals qua citizens (pp. 7, 10–11). I differ in four key respects. First, Aytac deliberately adopts an agent-centric conception of domination, setting aside structural accounts on the ground that platform power is centralised and intentional (p. 9). I treat domination as a structurally constituted condition, rather than a capacity of an identifiable agent, in a similar vein to Gädeke and Forst. Second, the public/private categorisation, even qualified as quasi-public, does not locate the problem. As I argued in Section 1, platforms occupy part of the position in vertical accountability that Diamond and Morlino assign to those who govern, exercising power over the space of reasons in which citizens form and contest political judgements, to which justification is therefore owed. The issue is not whether that power is private or public in origin. The problem is that it is exercised from the answerable position without answerability attached. Third, the relationship runs in two directions. Aytac's account concerns platforms' power over citizens. The audit record indicates platforms acting towards the regulator less as regulated entities and more as counterparts, the horizontal dimension of accountability, which the quasi-public framing does not reach (Section 5). Fourth, Aytac's argument is diagnostic (p. 19). The Harm Index operationalises the conditions his argument implies and tests them against the DSA's audit record. That record substantiates two of his replies to objections: regulation leaves enforcement discretion with the companies (pp. 19–20) and platform-built contestation mechanisms fall short of unconditional access to contestation (p. 15). On the first, the audit criteria are built from benchmarks the platforms themselves supply, so that Meta's own definitions, such as 72 hours for "without undue delay", become the standard against which Meta is audited (Ernst & Young LLP, 2024, p. 31; Holznagel, 2025, Observation 2). On the second, the out-of-court dispute settlement route the DSA establishes cannot bind platforms and platforms routinely withhold the content needed to examine a dispute (Hughes, 2026; Section 5), exactly the conditional, goodwill-dependent access to contestation Aytac identifies in the Oversight Board. What Aytac argues from theory, the audit record documents.
In day-to-day use, individuals mostly experience platform behaviour not as domination but as ordinary interaction, feeds refreshing, items liked, recommendations arriving. No person or organisation is physically compelling anything. The same governing logic is applied at scale, to millions of users at once, without any of them individually assenting to or examining it, since at that scale, none of them can. Forst's account of noumenal power locates this kind of conformity at one end of a spectrum of acceptance, running from justifications explicitly weighed and accepted through to those accepted almost blindly, without further question, in the way social conformity is accepted rather than examined (Forst, 2017, p. 41). Platform engagement sits at the almost blind end of that spectrum. The governing logic behind what appears in a feed is not so much rejected or endorsed as simply gone along with, which is precisely why its noumenal character, closing off rather than opening a space of reasons, remains available to an external audit. Whether the audits the DSA produces do this work is a separate question, addressed in Sections 4 and 5, but the possibility of external verification does not depend on users themselves recognising the closure.
A thicker account of democracy would require a correspondingly thicker account of power, one capable of assessing the quality of reasoning and debate itself. Noumenal power is not that. It operates at the threshold level, on the edge, not asking how well an individual reasons, but whether they retain any standing to reason at all. This is what makes it the appropriate theoretical tool for a thin democratic position. At its root, noumenal power names the capacity to shape what individuals think and do through relations of justification and influence (Forst, 2017, pp. 38–50). That capacity is currently held unevenly, with platforms exerting it asymmetrically over those subject to their systems.
Taken as a whole, the absence of an agreed audit standard, the immaturity of the DSA's reporting cycle, the trade-off inherent in minimum-based aggregation and the noumenal grounding set out above, identify the edges of what the Harm Index can do. What it does is convert a threshold claim into three conditions an external analysis can verify, scoring platforms against that threshold using evidence the platforms and auditors have made public. Section 4's application of that threshold and Section 5's account of what it reveals about the audit architecture together provide my diagnosis. This is not a verdict on how well platforms are governed but a finding on whether governance, in the minimal sense the edge requires, is present at all. Section 7 draws this together and considers what a thicker, weighted model, held back from the thin instrument built here, might add once this threshold work is complete.
Section 7 - Conclusion
The core objective of my research was to test whether VLOPs operate at the edge of democracy and whether that condition can be measured. Using the DSA as a case study, I have shown that its requirements can be translated into a minimal set of threshold variables: twelve indicators grouped into three indices. Each index captures an aspect of democratic standing drawn from Forst's space of reasons and Diamond and Morlino's account of vertical accountability. From the wider group of VLOPs covered by the DSA, the Harm Index was applied to Meta, X and YouTube. The Index produces a clear answer. Meta and X both score 0, the lowest score the Index can produce. Under the Index’s non-compensatory rule, derived from a necessary-and-sufficient concept structure in which no condition can be compensated for by performance elsewhere (Goertz, 2006, pp. 35–46), that score means that at least one necessary condition for democratic standing has failed. This means that each platform falls on the domination side of the threshold the Harm Index specifies, the minimum documentary conditions of democratic standing are not all present. YouTube scores 1, clearing the floor but remaining at the edge of domination rather than securely beyond it. On evidence drawn from data that platforms and auditors have themselves made public, together with KPMG's analysis of 21 VLOPs and two VLOSEs, two of the three platforms examined have crossed the threshold into domination: domination in the sense set out in Section 1.
I have demonstrated that threshold crossing can be codified according to where and how failure occurs across platforms. Meta's failure arrives via obligations disclaimed identically in both audit cycles. For Meta, independent verification never happened, so nothing could be found wanting. Here, the audit is empty where the edge of democracy is most exposed. X's failure is different. Its obligations were tested, found to require remediation, but met with reinterpretation of the obligation itself and a change of auditor, rather than action to address the harm-causing behaviour. Where Meta's 0 marks an absence of verification, X's marks disputed verification. YouTube's 1 shows the erosion the Index detects is not a fixed property of the DSA's architecture itself, since the same regulatory instrument and the same twelve indicators produced a different result for a platform whose auditor tested the Articles underlying Meta's and X's own 0 scores, in both cycles, without disclaiming them. The issues raised by Meta's and X's audits are the result of choices available to platforms and auditors under the current rules. These choices do not merely supply evidence of domination. They help constitute the asymmetrical justificatory order through which domination operates, leaving those subject to the systems without effective means to know, challenge or revise the rules governing them (Forst, 2017, pp. 45–50).
The limits examined in Section 6 are part of the methodological choices that made the core findings possible. A model built to test whether the minimum conditions for a contestable space of reasons remain present inevitably declines to test others, such as whether an Article was correctly marked not applicable or whether scoring should sum or average rather than take the minimum. Restricting the Index to a small, non-compensatory set of indicators is what keeps the threshold question separate from a quality-of-service question the Harm Index cannot answer. Grounding the model in noumenal power (Forst, 2017, pp. 45–46) sets aside a thicker, more deliberative account of platform harm in favour of one that can be evidenced from documentary audit alone. What these limits bound is how much the Index can say. They do not bound whether what it says, for Meta and X, is correct.
In creating the Harm Index, weighting has two distinct parts to play, following the threshold judgement. The first is remediation. Where a system fails on several indicators at once, as Meta and X do, a weighted layer built on the diagnostic map Sections 3 and 4 produce can order which failures to repair first (Section 6). It decides the sequence of remediation, not whether remediation is required. The second is quality. Once a system sits securely clear of the threshold, scoring 2 throughout, the question changes from whether standing is present to how well a system performs within an open space of reasons. A weighted, cross-platform layer of that kind would sit in the same family as existing multi-indicator democracy indices, such as V-Dem (Nord et al., 2026), built to rank and compare rather than to threshold-test. What either layer weighs or how is not argued here. Both depend on a settled account of what counts as failure in the first place, which is what the Harm Index provides.
The DSA has worked as a live test case. The twelve indicators are analysed against specific DSA Articles, providing citable evidence. What those indicators test, the minimum conditions for a contestable space of reasons, is not bound to the DSA, geography or regulatory framework. A jurisdiction without an equivalent to Article 37’s audit duty, or without a proxy resembling an Article 21 dispute-settlement mechanism, would score 0 on the relevant indicator by default. There would still be no independent verification or external addressee to generate a higher score. The Index does not require the DSA’s specific architecture to function. It does require that a platform’s operation can be checked against evidence external to the platform, however that check occurs. Extending the model to a non-DSA jurisdiction, the UK’s Online Safety Act for example, would require a new crosswalk between the same twelve indicators and that jurisdiction’s own regulatory instruments, rather than a redesign of the Index itself. The Online Safety Act provides a contrast on one indicator in particular. Ofcom, not the provider, specifies the content of each categorised service's transparency report through transparency notices, and must publish its own report drawing conclusions from them (Ofcom, 2025). Whether that regulator-specified reporting scores higher on Methodological concurrence than the DSA's provider-defined benchmarks is exactly the kind of question such a crosswalk would answer. This is a separate piece of future work from both weighted layers proposed above.
Algorithmic systems can exercise noumenal power over the space of reasons in which democratic life is conducted, including upward through recommender architectures that shape the preferences and judgements citizens bring to political life (Forst, 2017, pp. 38–50). We are rendered almost blind. The DSA is one of the most developed real-world attempts to hold that power to account. What I have shown is that the DSA, on its present public evidence, has not yet closed the gap it was built to close. Chapter III produces disclosure, audit and publication on schedule, but not yet verification that reaches the systems it is meant to verify. Where that verification is absent, it is absent on the Articles pointing to systemic risk, recommender logic and researcher access: exactly where the democratic stakes are highest. The Harm Index measures that edge and identifies where the threshold has failed. The diagnosis does not prescribe a remedy, but it provides the evidential basis on which restorative action can be ordered. I have shown that these questions can be asked and answered using evidence platforms and auditors are required to make public.
Footnotes
- Two outcomes in my dataset do not fit any of the four states. In Cycle 1, FTI recorded "No Conclusion" on two of X's obligations, Articles 16(6) and 34(3) (FTI Consulting, 2024, pp. 24, 35). These are the only obligation-level no-conclusion outcomes across the three platforms' audit records. FTI also declined to conclude on one element within Article 38(1), X's advertising recommender systems, discussed in Section 3. In both cases, FTI investigated and records why it could not conclude: for 16(6), the information needed was regarded by X as privileged and not disclosed (p. 109); for 34(3), the supporting documents were not provided despite several requests (p. 238). Elsewhere in the dataset, Disclaimed marks an auditor's declining to conclude because of an external obstacle, typically a parallel Commission investigation (see "What a disclaimer means"). Here, the obstacle was the provider's own non-disclosure. The model therefore codes both results as Failed (F), 0, rather than Disclaimed. Table 3.2, which records only whether a conclusion was reached, shows both as D. ↩
- Primary Transparency Database evidence cited under Indicator 12 (System access) is drawn from my own data extraction from the European Commission's DSA Transparency Database (European Commission, 2026b). Two extraction rounds inform this analysis.
The first was a 1,000-row sample per platform, retrieved on 30 June 2026.
The second was a full-month extraction of all statements of reasons submitted in July 2026, retrieved on 3 September 2026 via https://transparency.dsa.ec.europa.eu/statement, filtered by platform name (Facebook: 29,454,716; X: 379,888; YouTube: 4,582,544 statements). For all three platforms it covers content_type, decision_visibility, decision_ground, category and decision_facts. For X and YouTube it additionally covers incompatible_content_ground, incompatible_content_explanation, illegal_content_legal_ground and illegal_content_explanation. For X, the two incompatible-content fields are empty for all statements, because every X statement is grounded in illegal content.
Each file records the number of statements for each distinct combination of field values, by day. Distinct values per field were counted across the full month. The datasets are listed under Data below. Summary figures are reported in-text where cited.
↩ - Meta lowered the follower threshold for Content Library access from 25,000 to 1,000 in November 2024 and to 100 in November 2025. Under the latest threshold, around 2.5 percent of the Instagram posts in Bekavac and Mayer's sample would be excluded on that ground alone (Bekavac and Mayer, 2026, p. 7). The 50 percent figure therefore describes access during the study period. The repeated, unilateral revision of the threshold is itself an instance of the platform-defined access criteria scored under Indicator 12. ↩
- Counted from the auditors' summaries of applicable and not-applicable sub-Articles, counting ranges individually (e.g. 30(1)–30(7) as seven). BDO's summaries for X list 168, addressing Article 36 only through 36(1) (BDO LLP, 2025, pp. 9–10); Ernst & Young's summary for Facebook also lists Articles 36(2)–36(11) as not applicable, which brings the count to 178 (Ernst & Young LLP, 2025, p. 10) ↩
Data
Meta July 2026 https://leviathan.website/edge/AppEvi/FB726.csv
X July 2026 https://leviathan.website/edge/AppEvi/X726.csv
YouTube July 2026 https://leviathan.website/edge/AppEvi/YT726.csv
Meta 1000 record sample https://leviathan.website/edge/AppEvi/Meta.csv
X 1000 record sample https://leviathan.website/edge/AppEvi/X.csv
YouTube 1000 record sample https://leviathan.website/edge/AppEvi/YT.csv
The evidentiary basis for Failed, Partial and Disclaimed finding cited in this section is set out in full in supporting appendices: Appendix A (Meta), Appendix B (YouTube), Appendix C (X). Each records the DSA sub-article, audit cycle, page reference and the auditor's finding, drawn directly from the primary audit and implementation reports listed above.
Appendix A https://leviathan.website/edge/AppEvi/Appendix_A_Meta.pdf
Appendix B https://leviathan.website/edge/AppEvi/Appendix_B_Google.pdf
Appendix C https://leviathan.website/edge/AppEvi/Appendix_C_X.pdf
References
Albert, J. (2025) 'What are DSA audits doing for systemic risk enforcement? The case of X', DSA Observatory, 19 December. Available at: https://dsa-observatory.eu/2025/12/19/dsa-audits-what-are-they-good-for/ (Accessed: 2 October 2026).
Annabell, T. (2025) 'DSA audits: how do platforms compare on influencer marketing disclosures?', DSA Observatory, 2 June. Available at: https://dsa-observatory.eu/2025/06/02/dsa-audits-how-do-platforms-compare-on-influencer-marketing-disclosures/ (Accessed: 20 September 2026).
Appeals Centre Europe (2025) Transparency Report: November 2024–August 2025. 1 October. Available at: https://www.appealscentre.eu/wp-content/uploads/2025/09/Appeals-Centre-Europe-Transparency-Report.pdf (Accessed: 10 October 2026).
Aytac, U. (2024) 'Digital domination: social media and contestatory democracy', Political Studies, 72(1), pp. 6–25.
BDO LLP (2025) X's Digital Services Act (DSA) report: 24 August 2024 to 30 June 2025. Twitter International Unlimited Company. Available at: https://transparency.x.com/content/dam/transparency-twitter/dsa/2025-x-dsa-audit-report.pdf (Accessed: 20 September 2026).
Bekavac, L. and Mayer, S. (2026) 'Auditing Meta and TikTok Research API data access under Article 40(12) of the Digital Services Act', arXiv preprint arXiv:2601.12390 [cs.CY]. Available at: https://arxiv.org/abs/2601.12390 (Accessed: 10 September 2026).
Bouchaud, P. and Ramaciotti, P. (2024) 'Auditing the audits: evaluating methodologies for social media recommender system audits', Applied Network Science, 9(1), pp. 1 - 20.
Bovens, M. (2007) 'Analysing and assessing accountability: a conceptual framework', European Law Journal, 13(4), pp. 447–468.
Burrell, J. (2016) 'How the machine "thinks": understanding opacity in machine learning algorithms', Big Data & Society, 3(1), pp. 1–12.
Chapman, P. (2025) 'From Ambiguity to Accountability: Analyzing Recommender System Audits under the DSA', TechPolicy.Press, 28 February. Available at: https://www.techpolicy.press/from-ambiguity-to-accountability-analyzing-recommender-system-audits-under-the-dsa/ (Accessed: 12 October 2026).
Commission Delegated Regulation (EU) 2024/436 of 20 October 2023 supplementing Regulation (EU) 2022/2065 of the European Parliament and of the Council, by laying down rules on the performance of audits for very large online platforms and very large online search engines. Official Journal of the European Union L 2024/436, 2 February. Available at: https://eur-lex.europa.eu/eli/reg_del/2024/436/oj (Accessed: 1 October 2026).
Dahl, R.A. (1971) Polyarchy: Participation and Opposition. New Haven, CT: Yale University Press.
data.europa.eu (2026) Social media use in the EU: From countries to generations. Publications Office of the European Union, 10 June 2026. Available at: https://data.europa.eu/en/publications/datastories/social-media-use-eu-countries-generations (Accessed: 3 September 2026).
DataReportal (2026) Global Social Media Statistics. Kepios, Available at: https://datareportal.com/social-media-users (Accessed: 3 September 2026).
Diamond, L. and Morlino, L. (2004) 'The Quality of Democracy: An Overview', Journal of Democracy, 15(4), pp. 20–31.
DSA Observatory (2025) 'Making Recommender Systems Work for People: Turning the DSA's Potential into Practice', 19 May. Available at: https://dsa-observatory.eu/2025/05/19/making-recommender-systems-work-for-people/ (Accessed: 12 October 2026).
Ernst & Young LLP (2024) Independent audit on Facebook: for the period of 29 August 2023 to 30 June 2024. Meta Platforms Ireland Limited. Available at: https://transparency.meta.com/reports/regulatory-transparency-reports/ (Accessed: 16 September 2026).
Ernst & Young LLP (2025) Digital Services Act (DSA) independent audit on Facebook: for the period 1 July 2024 to 30 June 2025. Meta Platforms Ireland Limited. Available at: https://transparency.meta.com/reports/regulatory-transparency-reports/ (Accessed: 16 September 2026).
European Commission (2024a) Commission opens formal proceedings against Meta under the Digital Services Act related to the protection of minors on Facebook and Instagram [Press release]. 16 May. Available at: https://ec.europa.eu/commission/presscorner/detail/en/ip_24_2664 (Accessed: 5 October 2026).
European Commission (2024b) Commission fines Meta €797.72 million over abusive practices benefitting Facebook Marketplace [Press release IP/24/5801]. 14 November. Available at: https://ec.europa.eu/commission/presscorner/detail/en/ip_24_5801 (Accessed: 8 October 2026).
European Commission (2025a) Commission preliminarily finds TikTok and Meta in breach of their transparency obligations under the Digital Services Act [Press release]. 24 October. Available at: https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2503 (Accessed: 6 September 2026).
European Commission (2025b) Commission fines X €120 million under the Digital Services Act [Press release]. 5 December. Available at: https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2934 (Accessed: 1 October 2026).
European Commission (2026a) Commission preliminarily finds TikTok in breach of Digital Services Act for failing to ensure safe accounts for minors [Press release]. 24 July. Available at: https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1679 (Accessed: 6 September 2026).
European Commission (2026b) DSA Transparency Database. Available at: https://transparency.dsa.ec.europa.eu/ (Accessed: 4 October 2026).
European Commission (2026c) Out-of-court dispute settlement bodies under the Digital Services Act (DSA). Last updated 11 September 2026. Available at: https://digital-strategy.ec.europa.eu/en/policies/dsa-out-court-dispute-settlement (Accessed: 8 October 2026).
Forst, R. (2017) 'Noumenal Power', in Normativity and Power: Analyzing Social Orders of Justification. Oxford: Oxford University Press, pp. 37–52.
Freedom of Information Act 2000, c. 36, ss. 50, 51, 54, 57. Available at: https://www.legislation.gov.uk/ukpga/2000/36/section/51 (Accessed: 5 October 2026).
Freshfields (2025) 'DSA decoded #8: Out-of-court dispute resolution settlement – a new regime', Technology Quotient. Available at: https://www.freshfields.com/en/our-thinking/blogs/technology-quotient/dsa-decoded-8-out-of-court-dispute-resolution-settlement-a-new-regime-102lpac (Accessed: 12 October 2026).
FTI Consulting (2024) Independent audit: Article 37 of Regulation (EU) 2022/2065 (Digital Services Act). Twitter International Unlimited Company. Examination period: 24 August 2023 – 23 August 2024. Available at: https://transparency.x.com/content/dam/transparency-twitter/dsa/dsa-audit/TIUC-DSA-Audit-Report-2024-08-27.pdf (Accessed: 20 September 2026).
Gädeke, D. (2020) 'Does a Mugger Dominate? Episodic Power and the Structural Dimension of Domination', Journal of Political Philosophy, 28(2), pp. 199–221.
Goertz, G. (2006) Social Science Concepts: A User's Guide. Princeton, NJ: Princeton University Press.
Google Ireland Limited (2024a) DSA audit implementation report 2024 (non-confidential version). Available at: https://storage.googleapis.com/transparencyreport/report-downloads/dsa-audit-google-implementation_2023-8-28_2024-5-31_en_v1.pdf (Accessed: 2 October 2026).
Google Ireland Limited (2024b) Independent audit on YouTube for the period of 28 August 2023 to 31 May 2024. Available at: https://storage.googleapis.com/transparencyreport/report-downloads/dsa-audit-youtube_2023-8-28_2024-5-31_en_v1.pdf (Accessed: 2 October 2026).
Google Ireland Limited (2025a) DSA audit implementation report 2025 (non-confidential version). Available at: https://storage.googleapis.com/transparencyreport/report-downloads/dsa-audit-g-implementation_2024-6-1_2025-5-31_en_v1.pdf (Accessed: 2 October 2026).
Google Ireland Limited (2025b) Independent audit on Google Search – Digital Services Act: for the period of 1 June 2024 to 31 May 2025. Available at: https://storage.googleapis.com/transparencyreport/report-downloads/dsa-audit-g-search_2024-6-1_2025-5-31_en_v1.pdf (Accessed: 2 October 2026).
Google Ireland Limited (2025c) Independent audit on YouTube reporting package: Digital Services Act and the European Union's Code of Conduct on Countering Illegal Hate Speech Online. Available at: https://storage.googleapis.com/transparencyreport/report-downloads/dsa-audit-youtube_2024-6-1_2025-5-31_en_v1.pdf (Accessed: 2 October 2026).
Greco, S., Ishizaka, A., Tasiou, M. and Torrisi, G. (2019) 'On the methodological framework of composite indices: a review of the issues of weighting, aggregation, and robustness', Social Indicators Research, 141(1), pp. 61–94.
Habermas, J. (2006) ‘Political communication in media society: Does democracy still enjoy an epistemic dimension? The impact of normative theory on empirical research’, Communication Theory, 16(4), pp. 411–426.
Holznagel, D. (2025) 'Shortcomings of the first DSA audits — and how to do better', DSA Observatory, 11 June. Available at: https://dsa-observatory.eu/2025/06/11/shortcomings-of-the-first-dsa-audits-and-how-to-do-better/ (Accessed: 5 October 2026).
Hughes, T. (2026) 'The DSA's Sleeping Giant is Waking Up', Tech Policy Press, 9 June. Available at: https://www.techpolicy.press/the-dsas-sleeping-giant-is-waking-up/ (Accessed: 3 September 2026).
In re Social Media Adolescent Addiction/Personal Injury Products Liability Litigation (2026) Case No. 4:23-cv-05448-YGR, Document 440. US District Court for the Northern District of California.
Information Commissioner's Office (n.d.) 'FOI complaints and ICO enforcement powers'. Available at: https://ico.org.uk/for-organisations/foi/foi-complaints-and-ico-enforcement-powers/ (Accessed: 20 September 2026).
International Auditing and Assurance Standards Board (2013) International Standard on Assurance Engagements (ISAE) 3000 (Revised): Assurance Engagements Other than Audits or Reviews of Historical Financial Information. New York: International Federation of Accountants.
Kaushal, R., van de Kerkhof, J., Goanta, C., Spanakis, G. and Iamnitchi, A. (2024) 'Automated transparency: a legal and empirical analysis of the Digital Services Act Transparency Database', in Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency (FAccT '24). New York: Association for Computing Machinery, pp. 1121–1132.
Klonick, K. (2018) 'The New Governors: The People, Rules, and Processes Governing Online Speech', Harvard Law Review, 131(6), pp. 1598–1670.
KPMG (2026) Analysis of the 2024/2025 Digital Services Act audit reports: exploring the 2025 DSA audit reports of 21 Very Large Online Platforms and 2 Very Large Online Search Engines: a benchmark study. KPMG Advisory N.V. Available at: https://assets.kpmg.com/content/dam/kpmgsites/nl/pdf/2026/dsa-audit-reports-benchmark-2025-kpmg.pdf.coredownload.inline.pdf (Accessed: 20 September 2026).
Meßmer, A.-K. and Degeling, M. (2023) Auditing Recommender Systems: Putting the DSA into practice with a risk-scenario-based approach. Policy Brief. Berlin: Stiftung Neue Verantwortung, pp. 1 - 60.
Meta Platforms Ireland Limited (2024) Audit implementation report for Facebook regarding Regulation (EU) 2022/2065, the Digital Services Act (DSA): pertaining to the audit report covering the period of 29 August 2023 to 30 June 2024. Available at: https://transparency.meta.com/sr/dsa-audit_implementation_report_Sept_2024_facebook (Accessed: 1 October 2026).
Meta Platforms Ireland Limited (2025) Audit implementation report for Facebook regarding Regulation (EU) 2022/2065, the Digital Services Act (DSA): pertaining to the audit report covering the period of 1 July 2024 to 30 June 2025. Available at: https://transparency.meta.com/reports/regulatory-transparency-reports/ (Accessed: 1 October 2026).
Nord, M., Altman, D., Fernandes, T., Good God, A. and Lindberg, S.I. (2026) Democracy Report 2026: Unraveling the Democratic Era? University of Gothenburg: V-Dem Institute.
Ofcom (2025) Online Safety Transparency Reporting: Final Transparency Guidance. 21 July 2025. Available at: https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/transparency-reporting (Accessed: 15 September 2026).
Pasquale, F. (2015) The Black Box Society: The Secret Algorithms That Control Money and Information. Cambridge, MA: Harvard University Press. Available at: ProQuest Ebook Central (Accessed: 9 October 2026).
Pasquale, F. (2017) 'From territorial to functional sovereignty: the case of Amazon', LPE Blog, 6 December. Available at: https://lpeproject.org/blog/from-territorial-to-functional-sovereignty-the-case-of-amazon/ (Accessed: 6 October 2026).
Pettit, P. (1997) Republicanism: A Theory of Freedom and Government. Oxford: Oxford University Press.
Pettit, P. (2002) 'Keeping republican freedom simple: on a difference with Quentin Skinner', Political Theory, 30(3), pp. 339–356.
Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services and amending Directive 2000/31/EC (Digital Services Act). Official Journal of the European Union L 277, 27 October 2022, pp. 1–102. Available at: https://eur-lex.europa.eu/eli/reg/2022/2065/oj (Accessed: 1 October 2026).
Sandri, G. and Novelli, C. (2026) 'How to Detect and Measure the AI Dangers to Democracy', arXiv:2606.16054 [cs.CY]. Available at: https://arxiv.org/abs/2606.16054 (Accessed: 6 October 2026).
Solarova, S., Mesarčík, M., Pecher, B. and Srba, I. (2026) 'Beyond the Checkbox: Strengthening DSA Compliance Through Social Media Algorithmic Auditing', Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems, pp. 1 - 13.
Toledo, R.R.P. (2026) 'Algorithmic accountability in public administration: a systematic review and conceptual framework for responsible AI governance'. SocArXiv [Preprint]. Available at: https://osf.io/preprints/socarxiv/j495x_v2 (Accessed: 20 September 2026).
Twitter International Unlimited Company (2024) DSA Audit Implementation Report, 27 September 2024 (Cycle 1). Available at: https://transparency.x.com/content/dam/transparency-twitter/dsa/dsa-audit/TIUC-DSA-Audit-Implementation-Report-2024-09-27.pdf (Accessed: 20 September 2026).
Wardwell, F. (2025) ‘An attack on all American tech platforms: Trump admin decries EU fine on Musk's X’, Politico, 5 December. Available at: https://www.politico.com/news/2025/12/05/an-attack-on-all-american-tech-platforms-trump-admin-decries-eus-fine-on-musks-x-00678891 (Accessed: 6 October 2026).