What kinds of services are regulated by the DSA?
DSA's purpose
The purpose of the regulation is to prevent illegal and harmful activities on the internet and the spread of misinformation. The DSA aims to ensure a safer internet for users, protect fundamental rights, and create an open and fair environment for digital platforms.
The DSA regulates so-called intermediary services. For something to be considered an intermediary service, it must be an information society service (as defined in EU Directive 2015/1535) and also fall under one of the following categories:
- mere conduit (for example, internet access services)
- caching (intermediate storage services)
- hosting (hosting services)
Common to the three categories of intermediary services is that they are involved in transmitting «information provided by the recipient of the service» over the internet. What this entails is not defined in the DSA, but the purpose of the regulation and the context in which the term is used suggest that it refers to information that has semantic content, where the content could potentially be associated with, for example, illegal activities or illegal content. The «mere conduit» category also includes services that involve providing access to a communication network, such as internet access services.
To determine whether a service falls within or outside the scope of the DSA, each actor must make a specific assessment of the technical functionalities of their services. The assessments may change over time. 1.
Read more about Digital Services Act on the Norwegian Goverment's webpages (in Norwegian only) or The Norwegian Communications Authority's (Nkom) webpage (in Norwegian only).
Many different actors are involved in making content available on the internet for the user
Content is made available online by a content provider uploading it to a server connected to the internet. A content provider can use their own infrastructure to make the content available or utilize a hosting service provider that offers storage and publishing of the content on its servers.
When a user visits a website, the content of the website is sent from the server where it is stored to the user via the internet. The internet connection is provided by an Internet Service Provider (ISP). Usually, multiple ISPs are involved in transporting the content from the server it is stored on to the user. The ISPs do not have insight into the specific content being transmitted over the internet and are only responsible for ensuring that the information is sent and received by the correct user.
Many different actors are involved in making content available on the internet for the user
The road to the correct address: the domain name system
To access content or other services on the internet, the user's machine must know the IP address of the server where the content is stored or the service is offered. This address is retrieved by querying the global Domain Name System (DNS).
Each domain name has a set of machines that respond to queries about addresses under the domain name. These machines are called name servers. It is the name servers for the individual domain names that provide the information that enables users to connect to servers offering content or services over the internet.
Information about which name servers are associated with a domain name is queried from the name servers of the top-level domain where the domain name is registered. Norid provides the name service for the Norwegian country code top-level domain .no. Thus, we are one of several players that ensure it is technically possible to make queries in the global domain name system.
The IP address to the server with content is retrieved by looking it up in the domain name system (DNS)
Read more about the domain name system and how it works, and the role of DNS in the production of internet services (in Norwegian only).
Norid's services do not fall under the DSA
Norid is the registry for the Norwegian country code top-level domains .no (Norway), .sj (Svalbard and Jan Mayen), and .bv (Bouvet Island). We allocate, manage and register domain names under these top-level domains based on an agreement with the international administrator for top-level domains (ICANN/IANA) and within the framework of applicable law. Only the .no domain is open for registrations.
Norid manages the name service and registration service for the Norwegian top-level domains. The registration service processes applications for domain names under .no in accordance with applicable allocation rules and maintains a register of usage rights for the various domain names. As described above, information about which name servers are associated with a domain name is queried from the name servers managed by Norid. The information that Norid receives from a service recipient in connection with the name service and registration service is limited to technical data related to the domain name system and data necessary to establish a domain subscription (name and contact information of the domain subscriber).
Lookups in the domain name system occur before the content is transported, and the lookup only results in the user's machine becoming aware of the IP address of the server where the content is located. Neither Norid's name servers nor the name servers for individual domain names store or convey the content itself. Thus, Norid's role stops where the roles of content providers and other service providers begin.
We believe that our services do not constitute information society services as defined in EU Directive 2015/1535. Neither the registration service nor the name service transmits the type of meaningful information that the directive and the DSA are intended to regulate, and it is also questionable whether the services can be said to meet the requirement of being «usually provided for remuneration» by the recipient of the service. In any case, our services fall outside the DSA's definitions of mere conduit, caching, and hosting services. Therefore, our services are not intermediary services in the DSA's sense and are not covered by the DSA's scope.
This is also in line with the current legal opinion in Norway. Registries are not considered providers of information society services under the Norwegian e-commerce regulations, where the term is defined with nearly identical wording as in DSA 2.
Read more: Legal analyses of Norid's services
Norid has conducted two separate legal analyses to determine whether our services fall under the DSA. The analyses concern Norid's services as a registry, but they may also be helpful for registrars and name server providers who need to assess whether they are covered by the regulations.
Here you can find the two analyses in addition to a letter we have written to the Ministry of Digitalization and Administration regarding the issue:
Norid does not control content on the internet
Norid does not engage in content control on websites and does not have the authority to intervene regarding websites with potentially illegal content. 3.
«The similarity that domain names have with other assets, such as trademarks, argues that domain names can be seized. Additionally, there is a need to be able to disable a domain name to prevent criminal activities from continuing. Norid does not monitor the content of websites and does not have the authority to take action against websites that may appear to violate the law; that responsibility lies with the police and the judicial system.»
HR-2009-01692-U, vist til i HR-2019-1743-A, our underline
Decisions regarding the removal of content, especially through measures against internet infrastructure, require a process that safeguards the legal rights of the parties involved. In Norway, this authority is assigned to the police and the prosecution, which can seize digital content or domain names in accordance with the Criminal Procedure Act § 203
In addition, several consumer authorities have the authority to decide on the removal of digital content. However, if the consumer authorities wish to take measures against domain names, the handling is assigned to the courts to ensure that legal rights are upheld in these cases. 4.
Read more about illegal content on the internet and Norid's guidelines for authorities that can take action against domain names.
Registrars must themselves assess whether they offer services covered by the DSA
According to the Norwegian Domain name regulation 5 Norid shall delegate parts of the registration process to registrars. These are companies that have entered into an agreement with Norid for the right to resell domain subscriptions under the .no domain. The registrars assist companies and individuals in applying for domain names, and they manage the domain subscription on behalf of the subscriber, for example, by renewing or terminating it. They act as a liaison between the registry and the subscriber, guiding the subscriber on what is necessary to subscribe to a domain name.
Registrars compete to provide the best possible assistance to subscribers when it comes to ordering and maintaining domain subscriptions with Norid. We have not conducted an assessment of the technical functionality that each individual registrar uses to connect to Norid's registration service, but we still find it difficult to see how the implementation of tasks related to the role as a registrar 6 could fall under the scope of the DSA.
Most registrars, however, offer their customers various additional services related to the use of the domain name, including web hosting, email, and tools to create webpages. This means that even if an entity is not covered by the DSA due to its tasks as a registrar, it may have other roles and provide other services that are covered. Telenor is an example of a registrar that is also an internet service provider and a hosting service provider.
Sources
- 1. See, for instance, points 28 and 29 in the preamble to the regulation (our underline): “[…] providers of services establishing and facilitating the underlying logical architecture and proper functioning of the internet, including technical auxiliary functions, can also benefit from the exemptions from liability set out in this Regulation, to the extent that their services qualify as ‘mere conduit’, ‘caching’ or ‘hosting’ services” and “[…] Whether a specific service constitutes a ‘mere conduit’, ‘caching’ or ‘hosting’ service depends solely on its technical functionalities, which might evolve in time, and should be assessed on a case-by-case basis."
- 2. See, for instance, the preparatory works for the amendment to the Marketing Act, Prop. 8 LS (2019–2020) point 13.5, pages 104-105.
- 3. See also Prop. 8 LS (2019–2020) chapter 13.4.1 page 100 and Prop. 93 LS (2023–2024) pages 184 and 358 regarding the subscriber's responsibility for the use of domain names
- 4. Marketing Act § 43. Similar provisions can be found in the Tobacco Damage Act § 36 d, the Broadcasting Act § 2-12, and the Alcohol Act § 9-4. The exception is the Medicines Act § 21 a, which grants the Norwegian Directorate of Health authority to issue orders without court proceedings. This is justified by considerations of life and health.
- 5. The Norwegian Domain Name Regulation § 5
- 6. The tasks of the registrars are described in more detail in Norid's registrar agreement