“Something Old, Something New:” On the European Commission Code of Conduct on Countering Illegal Hate Speech Online+ and Some Missed Opportunities

 

“Something Old, Something New:”

On the European Commission Code of Conduct on Countering Illegal Hate Speech Online+ and Some Missed Opportunities

Noa Mor and Yuval Shany

 

While Meta has recently transformed its approach to content moderation in the U.S., including the relaxation of hate speech restrictions, the European arena continues to build and intensify its control over online content. One recent development in this regard is the adoption of the Code of Conduct on Countering Illegal Hate Speech Online+ (“The Code of Conduct+”), announced by the European Commission on January 19, 2025.[1]

The Code of Conduct+ includes voluntary commitments undertaken by leading digital platforms to curb illegal online content. These platforms include Facebook, Instagram, YouTube, X (formerly Twitter), TikTok, LinkedIn, Snap Inc., and Microsoft-hosted consumer services, among others.[2] It is a new version of the original Code of Conduct for Countering Illegal Hate Speech Online, signed by Google (YouTube), Facebook, X, and Microsoft-hosted consumer services in 2016 (“The 2016 Code”). Additional companies committed themselves to adhering to the 2016 Code in the following years. All of these companies are now signatories to the Code of Conduct +.[3]

I.The Code of Conduct+: What’s New?

Like the 2016 Code, the approach taken in the Code of Conduct+ focuses on the time it takes digital platforms to restrict access to content after it had been reported. We discuss this aspect of the Code of Conduct+ below. Still, notwithstanding this common ground and additional similarities between the two Codes, the Code of Conduct+ also introduces important changes, some of which draw on the practical experience gained during the implementation of the 2016 Code. 

First, unlike the 2016 Code, the Code of Conduct+ is formally integrated into a comprehensive regulatory framework – the 2022 Digital Services Act (“DSA”), which encourages the drawing of voluntary codes that contribute to its proper application.[4] Adhering to the requirements set out in the new Code suggests compliance with the DSA (though it does not guarantee it).[5] In addition, most of the Code of Conduct+ signatories are ‘very large online platforms’ (“VLOPs”), which face particular obligations under the DSA. For them, compliance with the new Code’s requirements may also be recognized as suitable risk mitigation measures.[6]

Second, the Code of Conduct+ represents a more sophisticated and extensive approach to content moderation than the 2016 Code. The previous Code was a short document, drafted before the DSA came into being, at a time when the online content landscape was smaller in scope and less dependent on AI systems for content moderation and generation.  By contrast, the Code of Conduct+ sets out a detailed process for assessing compliance with some of its central provisions. It also formalizes and develops practices already carried out pursuant to the 2016 Code.

One example of such normative development concerns collaboration between the platforms, the monitoring reporters (see discussion below), and the Commission. The Code of Conduct+ adds, in this regard, a requirement for annual gatherings and a shared online knowledge hub, including legal resources for assessing the legality of content, best practices, and information on the challenges and opportunities posed by technologies relevant to the generation and detection of illegal content.[7] Another example is the structured transparency requirements concerning content moderation practices outlined in the new Code, versus the brevity with which transparency was addressed in the 2016 Code. As part of this update, the Code of Conduct+ adds information disclosure commitments for the platforms pertaining to "the measures taken to address illegal hate speech as part of their content moderation policies.” These commitments may cover, among other actions, those affecting the availability, visibility, and accessibility of content, including proactive measures for detecting and reviewing hate speech. The disclosed information may also relate to the training provided to content moderators, the languages covered in the moderation processes, and the technologies used.[8]

The new Code of Conduct+ also embraces flexibility in acknowledging the importance of context and circumstances in adhering to its requirements. It recognizes the relevance of differences between the platforms – including the size and nature of their services, the resources available to them, and the risk of illegal hate speech on their platforms – for complying with its provisions.[9] Additionally, the Code of Conduct+ addresses the potential need to adjust its assessment methodology in the future, following changes in digital platforms’ content moderation practices and “in view of technological, societal, market and legislative developments.”[10]

Third, the Code of Conduct+ formally establishes a compliance assessment mechanism that relies on monitoring exercises (much of which was already carried out in practice, as part of the 2016 Code’s implementation).[11] According to the new Code, the monitoring exercises will be performed by a list of “Monitoring Reporters,” who are “Not for profit or public entities with expertise on illegal hate speech in at least one EU Member State.” They may also be “Trusted Reporters,” recognized under the DSA for their expertise in flagging illegal content.[12]

The monitoring reporters need to be approved both by the Commission and the platforms, but the latter have the final say.[13] The Code of Conduct+ provides that the process for agreeing on the list of monitoring reporters shall not be disclosed.[14] It is not clear from the Code of Conduct+ if the identity of the monitoring reporters will be published. Their consolidated findings, however, will be shared with the public.[15]

The monitoring reporters will conduct annual exercises that assess platforms’ content moderation practices during a maximal monitoring period of 6 weeks. During this time, the monitoring reporters are to flag “content that, to their best knowledge, is illegal hate speech and found on Signatories’ services, using designated reporting processes when and where applicable.” If such designated reported processes are not provided by the platforms, the monitoring reporters will use the reporting process available for regular users.[16]

The Code of Conduct+ also includes mechanisms to settle disputes between the platforms and the monitoring reporters concerning the legality of content, and regulates the suspension of monitoring reporters whose findings were considerably disputed by the platforms.[17] In a separate provision, the new Code also enables the suspension of monitoring reporters whose submissions include a significant number of errors.[18]

Fourth, the 2016 Code of Conduct had set a 24-hour time window for digital platforms to assess the majority of reported content, and, if necessary, remove or disable access to it. However, in practice, it seems that the Commission expected the 24-hour window to apply to more than 50% of the reported content.[19] The annual evaluations of the 2016 Code over the years indicate a general increase in the rate of content reviewed and removed within 24 hours, reaching around 90% of the content in 2020.[20] From 2021, however, a decrease in these figures can be seen, reaching around 65% in 2022.[21]  

The Code of Conduct+ internalizes these results. It requires platforms to assess the majority of notices within 24 hours. However, it also states that “[s]ignatories will apply their best efforts to go beyond this target and aim for two-third (at least 67%) of those notices,” thus formally aligning its requirements with existing removal rates.[22]

II.Open Questions and Drawbacks

While presenting a more structured, detailed, and demanding framework, the Code of Conduct+ also raises several concerns. Some of these challenges stem from continued reliance on the same enforcement mechanisms embodied in the 2016 Code, rather than developing new ways to respond to online hate speech and maintain a safe digital landscape. 

1. The Dual Normative Source for Identifying Violating Content

What is the normative source for determining that specific content constitutes “hate speech” according to the Code of Conduct+? The answer is, unfortunately, not straightforward.

The 2016 Code stated that digital platforms will assess users’ reports regarding the illegality of content “against their rules and community guidelines and where necessary national laws.” This wording effectively treats the platforms’ own policies as the primary normative standard against which content should be evaluated.[23] The Code of Conduct+ strengthens, to some extent, the role played by the EU law and national law as normative standards that define hate speech. It maintains that digital platforms will assess whether reported content “is in violation of the Signatories policies, and/or on the basis of the applicable law,” thereby putting national law and EU law on par with the platforms’ own law. Note that when introducing the Code of Conduct+, the Commission emphasized that it aims to curb illegal hate speech according to EU and national law.[24]

Nonetheless, the wording of the Code of Conduct+ (“policies and/or applicable law”) is still opaque. If the purpose of the Code is to tackle illegal hate speech, as the Commission emphasized, why not require that the identification of content as hate speech will conform with applicable law, and that platforms’ content moderation policies will accordingly conform with such law?  

The current dual reference to the platforms’ policies, on the one hand, and EU and national law, on the other hand, may result in legal uncertainty and under- and over-enforcement of applicable law, as well as difficulties in overseeing and challenging decisions made by the platforms. The Code of Conduct+ obviously tries to accommodate platforms' interests in maintaining discretion over their policies and applying similar normative standards across different national jurisdictions.[25] Still, the lack of clear normative guidance undermines the proper realization of the Code’s purpose of effectively dealing with contents defined under EU and national law as illegal hate speech, and weakens associated guarantees for the rule of law, procedural fairness, and democratic values.

We believe that far-reaching decisions regarding the outer boundaries of freedom of expression and the spread of dangerous content should be made by democratic lawmakers rather than left to the discretion of private companies or be embodied in a fuzzy combination of these two normative sources (“and/or”). Even if imperfect, many national laws reflect and incorporate democratic mechanisms for decision-making and often include transparency safeguards and public participation channels, which digital platform policies lack. This was highlighted in the recent swift (and controversial) changes to Meta’s content moderation practices and policies announced just before the inauguration of President Trump. Besides concerns regarding the nature of the changes and their real-world ramifications, criticism was also leveled against the quick timeline in which these changes were developed and the limited circle of people involved.[26]

2. The Monitoring Process

The Code of Conduct+ “Monitoring Reporters” mechanism raises several doubts and questions. Despite the critical role played by the reporters, the Code fails to provide information regarding the measures taken to ensure the chosen reporters represent a broad and inclusive array of opinions and agendas. The aforementioned confidentiality that the Code applies in this regard further restricts public scrutiny. As mentioned above, it’s not even clear if the list of reporters will be shared with the public.

Moreover, the Code establishes the involvement of a “Third party coordinator,” who will be selected by the Commission and approved by the platforms. This third party will “take an administrative role in helping the Commission to identify potential new Monitoring Reporters,” among their other tasks.[27] Notwithstanding its potential significance, the criteria for selecting the third party, or the transparency measures safeguarding their selection and operation do not appear in the Code. The potential biases surrounding the monitoring reporters’ selection and the importance of cultivating trust in them invite further consideration also in light of Meta’s (controversial) allegations regarding their fact checkers’ biases, leading to the termination of their work in the U.S.[28]

Additionally, the Code of Conduct+ encourages the use of designated reporting systems for monitoring exercises.[29] However, it is unclear how it would be ensured that such designated reporting channels do not receive “special treatment” by the platforms, compared to regular users’ reports. Such special treatment might hinder the effectiveness of the assessment processes conducted under the Code, and the extent to which they identify actual limitations of the content moderation processes in place.  

Finally, it’s doubtful that monitoring a sample of the overall reports that platforms receive can adequately capture the entire array of content moderation challenges at scale and sufficiently expose systematic challenges. Furthermore, the unique sampling conducted by the monitoring reporters and the designated dispute-settlement arrangements outlined in the Code may leave important content moderation areas, such as appeal processes and the “Community Notes” feature, out of the Code’s reach.[30]

3. The Enforcement Mechanism

The Code of Conduct+ builds on the same enforcement principle set out by the 2016 Code: a reactive methodology that relies on the reporting of content. Nonetheless, since 2016, digital platforms have developed a robust array of proactive AI-driven tools for evaluating and restricting access to content, often performed before users view and report it. According to Meta, for instance, the rate of content that was proactively flagged and removed using their AI tools has arisen from 52% in 2018,[31] through 80.5% in 2019, to 94.7% in 2020.[32] These AI measures now also include Large Language Models – transformative technologies whose capabilities rapidly progress – and are used, inter alia, to assess harmful content. They now provide, as Meta states, “a second opinion on some content” before enforcement actions are taken by the company.[33] This trend is connected to the way in which the 2016 Code was evaluated by the Commission, and to the encouragement it gave digital platforms to incorporate automatic detection technologies.[34] The Code of Conduct+, however, does not seem to take these far-reaching technological developments into account.

Given the enormous growth in the number of users and the volume of content shared, along with the risks posed by harmful content, not including an assessment of the automation tools currently in use or available to platforms seems like a misstep.

We are of the view, that the Code of Conduct+ could and should have incorporated new approaches to assess the platforms’ level of compliance with hate speech laws rather than focus almost solely on platforms’ responses to notices (even though notices are a required mechanism under the DSA).[35] These new approaches could include regularly measuring hate speech content accessible on the platforms, or creating channels for limited access to datasets on automatic and human removals.

4. Swift Review and Removal Rates

The Code of Conduct+ requires that more than 50% of the reported content be reviewed and removed within 24 hours, while encouraging a higher rate of 67%. As mentioned above, this demonstrates the continued attachment of the new Code to existing review and removal rates already reflected in the 2016 Code (50%) and its actual implementation (65%).

However, here too, the crafting of the Code of Conduct+ represents a missed opportunity for recalibrating previous practices and expectations. We believe that the required rate for reviewing reported content, and if necessary, removing, or otherwise restricting it within 24 hours, should be close to 100%, at least regarding VLOPs, whose influence and capabilities are considerable and who are the majority of the Code’s signatories. This 100% bar should be the default, leaving room for justified exemptions to be invoked by the platforms in appropriate cases. Adjusting this review and removal requirement makes sense when considering several factors, including the new Code’s goal of enforcing applicable law (rather than just meeting a self-regulation threshold), and the social and political dangers of hate speech. It is also justified in light of the technological advancements described above, and the compliance rates of 90% reached, at one point in time, under the 2016 Code. Moreover, it should be recalled that the Code of Conduct+ quantitative commitments apply only to reported content. There is no obvious reason why VLOPs would not dedicate the human and technological resources required to handle this limited volume of content, instead of legitimizing, in advance, retention of around 33%-50% of the online hate speech reported for longer periods.

Efforts to shorten the time needed to tackle hate speech are essential since the life span of harmful content can be very limited.[36] It should also be remembered that a violating piece of content may circulate and be shared before being reported, potentially circulating online for more than 24 hours, even when it complies with the Code’s requirements.

We emphasize that by no means should this timeframe free the platforms from their responsibility to comply with the Code of Conduct+ in a balanced, responsible, and human rights-respecting fashion, while incorporating robust fairness guardrails. These important aspects of hate speech content moderation did not receive, however, sufficient attention under the Code of Conduct+. This brings us to our final point.   

5. Responsible Content Moderation

The Code of Conduct+ reflects a more responsible approach to online content moderation compared to the 2016 Code, including a context-based stance and a requirement for digital platforms to be “diligent, non-arbitrary and objective” when assessing the illegality of content.[37] Nonetheless, other than such short statements to this effect, the new Code does not incorporate any quantified measures to advance such values and ensure they are properly realized. At the same time, the platforms’ commitment to swiftly remove reported content and other parts of the new Code, such as the monitoring exercise, are clearly articulated. This contrast underscores the lack of clear guidelines regarding responsible and balanced content restrictions.

It should be noted that the transparency summary that the signatories are required to submit according to the Code of Conduct+ encompasses some elements that are relevant to assessing the fairness of the platforms’ content moderation practices. Examples may include, for instance, information regarding users’ appeals and restored content,[38] and “interaction between automation and human review.”[39] Nonetheless, these elements do not appear in the operational, quantifiable part of the Code – i.e., as inherent aspects of the Code’s requirements for content assessment and removal. Instead, these fairness elements are framed as disclosure commitments peripheral to the Code’s central objective.

 

III.Conclusion The Code of Conduct+ is a more sophisticated, structured, and extensive version of its 2016 predecessor. However, it also introduces drawbacks and missed opportunities, some of which stem from its attachment to the approach taken in the previous Code and its implementation over the years. These challenges include, inter alia, the recognition of both national law and the platforms’ policies as valid normative sources against which the violation of content is assessed, thereby undermining legal certainty, procedural fairness, and the rule of law. Additional challenges are reflected in the new Code’s continuous excessive reliance on content reporting – a reactive enforcement approach that cannot tackle current content moderation concerns on its own. The new Code’s limitations also extend to the monitoring process, insufficient required rates for swift review and restriction of content, and the lack of tools to measure and safeguard responsible, balanced, and fair content moderation processes.