FR#152 – The DSA Needs Big Tech
Last week was the FOSDEM conference, where my time was mostly spend chatting with people so I had little time actually listen to all the talks at the event itself. I want to spend some time on one panel in particular, because while rewatching the panel I realised it surfaced some pretty deep structural issues between the fediverse and the DSA.
The panel “The Fediverse and the EU’s Digital Services Act” brought together Alexandra Geese, a Member of the European Parliament and one of the lead negotiators of the DSA; Felix Hlatky, the recently appointed Executive Director of Mastodon; and Sandra Barthel, founder of the Alliance of Open Networks. The title of the panel suggested this was about complementary approaches to the same problem of how Europe can protect democratic discourse online, but turns out there’s a bit more to it.
Geese laid out the DSA’s most powerful provision clearly. Article 34 requires Very Large Online Platforms (VLOPs, defined as platforms with more than 45 million monthly active users) to assess systemic risks, and allows the Commission to mandate changes to algorithms, targeting systems, and business models. This, Geese argued, is what makes the DSA meaningful. It gives Europe the ability to intervene in how platforms shape public discourse, without having to become a “ministry of truth” that decides what content is or isn’t allowed.
Hlatky then described the fediverse as a fundamentally different kind of network. “It’s a network of a lot of small networks. In fact, in the fediverse there’s around 30,000 active small servers.” He went on: “From a regulatory point of view, it’s very attractive because they all of them default under the SME exemption, small medium enterprises, so all of these servers are very small so they fall under this exemption.” When asked what makes the fediverse a nicer place than mainstream social media, Hlatky pointed to design and culture: “Polarizing content on Mastodon and the broader fediverse, it will never be amplified in the same way as in other networks, simply because of design choice, that this content doesn’t have this strong amplification. But the second thing that is probably more important is that trust and safety is not an afterthought, something that is bolted on later because we need this for regulatory compliance, but it’s part of the initial product design process.”
These are both reasonable statements on their own, but positioned next to each other it is visible that both Geese and Hlatky describe projects that work against each other. Geese’s entire model depends on VLOPs actually existing, as without a platform that crosses the 45 million monthly active users article 34 of the DSA has nothing to act upon. The DSA’s power to force algorithmic changes, to mandate risk assessments, to reshape business models, all of it requires a centralized platform large enough to qualify. Without a VLOP, the DSA actually does very little. On the other hand, Hlatky, as the Executive Director of one of the largest software developers building the alternative, is explicitly celebrating the fact that nothing in the fediverse qualifies for the DSA, and that the structure of the network makes it likely that nothing will ever qualify. The network architecture of the fediverse creates the possibility for the large majority of participants (if not everybody) to avoid DSA regulation via the SME exemption.
During the panel, Geese was remarkably candid about the geopolitical pressure the European Commission faces when trying to enforce the DSA against US-based platforms. She described how US government threats, including tariff escalation and NATO posturing, are actively deterring the Commission from enforcement. In her framing, DSA enforcement is no longer just a regulatory question, and she sees it as one of three fundamental geopolitical conflicts facing Europe, alongside defense against Russia and economic competitiveness, and argued that enforcing the DSA requires political courage at the highest levels of European leadership.
This problem of political will only matters if VLOPs exist to enforce the DSA against. In a network of 30,000 small servers, there is no entity for the Commission to pressure, and no platform for the US government to shield through diplomatic coercion. The fediverse sidesteps the geopolitical vulnerability that Geese described, but does so by eliminating the regulatory lever entirely.
The very geopolitical pressure that makes DSA enforcement difficult is itself an argument for the fediverse. If the Commission can be coerced into not enforcing against US-based VLOPs, then a network architecture without VLOPs is more resilient, not just technically but geopolitically. But that resilience comes at a cost to both sides of the current power dynamic. For the US, a world without VLOPs removes the ability to fuse state power with platform power, the dynamic that currently allows the US government to shield companies like X and Meta from European regulation. For the EU it removes the regulatory lever that the Commission has spent years building, and with it the role the EU has carved out for itself as the global counterweight to Big Tech. The EU’s position in digital governance, as well as the way the EU understands itself, is built around being the entity that regulates platforms. Without platforms large enough to regulate, that position loses its foundation.
For Hlatky, this avoidance of the DSA is not a big problem, as he sees many positive traits for the fediverse, such as polarizing content not being amplified and trust and safety being integrated into product design. However, these traits can better be described as how Hlatky views Mastodon, as those are not characteristics that are intrinsic to an ActivityPub network, and the claim that trust and safety is integral to Mastodon’s product design is contested within the community as well. While other ActivityPub software also proclaims these traits, it might just be an emergent property that flows from the type of people and their interest who are the early adopters and new builders of of open social platforms. In a potential world where open social protocols gain mass adoption, I’m not sure these characteristics will hold up, especially if it becomes a hyped new technology that attracts a very different user base with other priorities.
This is something I have written about before: one of the reasons the European Commission actually needs platforms like X to exist is that it has built its entire regulatory infrastructure around the assumption that VLOPs exist. Open social networks don’t just offer an alternative to Big Tech, they undermine the assumptions that European digital regulation is built on. The panel at FOSDEM was collegial and constructive, and everyone agreed that the fediverse is good and the DSA is necessary. But nobody asked the harder question: if the fediverse succeeds in replacing centralized platforms, what regulatory framework takes over from the DSA?
Some other news
For Protocols For Publishers I gave a presentation on the state of the open social web, explaining to publishers how both ActivityPub and atproto have different visions for how a social network can function. In my opinions these visions can be complementary to each other, with atproto well suited for the distribution of news, and ActivityPub creating new primitives for community building. The slide deck can be downloaded here.
PieFed has seen a sustained growth of new users over the last week, increasing it’s total user base by 50% in a week. The main driver of growth for PieFed, created by New Zealand based developer Rimu Atkinson, is a popular post on the BuyFromEU subreddit that describes the platform as an European Reddit Alternative. While impressive growth in relative terms, in absolute terms the entire network is still small, with some 8k monthly active users (MAU) for PieFed and 36k MAU for Lemmy.
Mastodon has announced that they are beginning work on a new onboarding experiment, where they’ll recommend “the closest server geographically that is in the correct language during the sign-up flow.” Mastodon using the mastodon.social as a default server for signup has been a point of critique for years within the community, and the organisation is now addressing this feedback.
Holos continues to be one of the most interesting projects moving ActivityPub forward. It runs an ActivityPub servers on your mobile phone, with a relay that handles your identity, as well as data forwarding for the periods when your phone is inaccessible. The latest update allows you to set your identity based on a domain name you own, fairly similar to atproto. Once the project launches as a 1.0 I’ll write a more detailed explainer about it and why I think it matters, for the protocol-minded people I already recommend taking a look.
FediMTL is a conference about digital sovereignty and the social web, that will be held on February 24, 2026 in Montreal (streaming options also available).
#nlnet
https://connectedplaces.online/reports/fr152-the-dsa-needs-big-tech/