Digital & AI
Regulation (EU) 2022/2065
Digital Services Act
Digital Services Act
Very large platforms have to explain their feeds, take illegal content seriously, and stop dark patterns — without making every comment section a courtroom.
Does this hit me?
You get clearer complaint tools, ads transparency, and a way off hyper-personalized feeds on the biggest apps. Illegal goods and scams should be harder to sell.
Check in the wizardPick a country in the header to see who enforces this at home. Union text is not the last word for directives.
How it rolls in
Nov 2022
Entered into force.
Aug 2023
Rules hit the largest designated platforms.
Feb 2024
Applies to other intermediaries.
Why it exists
The old e-commerce rules were written before social media. The DSA updates who is responsible for what you see online, with extra duties for the biggest sites.
What actually changes
- You can flag illegal content and should get a reason if a post is taken down.
- Very large platforms must assess systemic risks (disinformation, child safety) and publish transparency reports.
- Recommender systems must offer at least one option not based on profiling.
- Targeted ads to minors based on profiling are banned; some sensitive targeting is banned for everyone.
How it hits you
You get clearer complaint tools, ads transparency, and a way off hyper-personalized feeds on the biggest apps. Illegal goods and scams should be harder to sell.
For citizens
What this does to everyday life
Rights, bills, and what you can ignore. You are usually not the one who files — companies and states are.
Feeds and ads
On the biggest platforms you should get a feed option that is not built on profiling, and a clearer view of why an ad was shown. Ads that profile children are banned.
Take-downs with a reason
If a post is removed, you should get an explanation and a way to appeal. The DSA does not invent a new list of banned opinions; it forces process.
Safer marketplaces
Sellers of goods should be easier to trace. Scam shops and illegal products are the target, not your neighbourhood listings done honestly.
Rights you actually get
- Notice, statement of reasons, and appeal on content moderation.
- A non-profiling recommender option on very large platforms.
- Complaint to the Digital Services Coordinator in your country.
Costs and trade-offs
- More 'are you sure?' screens and age checks.
- Some niche content may be over-moderated by cautious platforms — appeal is the designed answer.
What you can do
- Use the in-app appeal before you go to a regulator.
- On a VLOP, look for the setting that turns off profiling in the feed.
What you can ignore
- You are not the 'host' of a platform because you posted a comment.
- The DSA is not a licence for governments to order general monitoring of everyone.
If something goes wrong
Platform appeal first, then the Digital Services Coordinator (often the media or communications regulator). Police for actual crimes.
More citizen notes across files: For people
Heard this? Not quite.
Claim: The DSA is an EU speech police.
It does not create a new list of banned opinions. It forces process: notice, action, appeals, and risk work. What is illegal still comes from other laws.
Latest official statements
All EU NewsNo tagged Commission, Parliament or Council statement in the current feeds.
Board one-pager
Board one-pager
Who this is for: EU digital, product and data teams. Regulation (EU) 2022/2065. Fully applicable since February 2024.
Scope
- You host user content, run a marketplace, app store, or social/video service available in the EU.
First 90 days
- Week 1: Decide your role: mere conduit, caching, hosting, online platform, or VLOP.
- Week 2: Publish a usable notice channel and a statement-of-reasons template.
- Month 2: If you are a platform: trader traceability, ToS in plain language, and points of contact for authorities.
Penalties: Up to 6% of worldwide annual turnover for very large platforms; lower national fines for others. The Commission enforces against designated VLOPs.
For companies
How to stay on the right side of this file
Practical order of work, not a substitute for counsel. Intermediary services (hosting, platforms, marketplaces). Extra duties for very large platforms and search engines.
You are probably
In if you host, cache, or mere-pipe third-party information in the Union. Size sets the depth.
Effort
Small host: a ticket path and a reasons template. Platform: a compliance function.
Budget
Moderation ops dominate legal fees.
Roles in this file
The same company can wear more than one hat. Classify before you buy a tool.
Intermediary
Host, cache, or conduit.
Notice-and-action scaled to your role. Do not general-monitor.
Online platform
A host that stores and disseminates to the public.
Trader traceability, complaints, transparency reporting.
VLOP / VLOSE
Designated by the Commission.
Risk assessments, audits, data access for researchers, crisis response.
Are you in scope?
Act now- You host user content, run a marketplace, app store, or social/video service available in the EU.
Usually not, if
- A brochure website with no user posting or seller accounts.
- You are not designated as a VLOP unless you are enormous — but basic hosting duties can still apply.
First moves
- Week 1Decide your role: mere conduit, caching, hosting, online platform, or VLOP.Legal
- Week 2Publish a usable notice channel and a statement-of-reasons template.Trust & safety
- Month 2If you are a platform: trader traceability, ToS in plain language, and points of contact for authorities.Product + legal
- A small forum still needs a working abuse mailbox and a human who answers.
- Do not promise 'we never take content down' — illegal goods and illegal content still need a process.
If you skip this
- DSC complaint you cannot show a statement of reasons for.
- Trader IDs missing on a marketplace.
- A VLOP audit finding on systemic risk you never wrote down.
Done looks like
- A public notice channel.
- A reasons template that a reviewer can actually use.
- A DSC contact.
Keep this evidence
- Notice-and-action logs.
- Transparency report if you are large enough to owe one.
- Trader verification files for marketplaces.
Ask vendors
- Who is the EU legal representative?
- How do you handle illegal-content notices that we pass through?
Where programmes usually break
- General monitoring that the DSA does not require — and that can collide with other rights.
- Ignoring trader KYC on a marketplace until a dangerous product ships.
Call counsel when
- You might be close to VLOP thresholds.
- Illegal-content orders from several States.
- A trusted-flagger fight.
Enforcement
Up to 6% of worldwide annual turnover for very large platforms; lower national fines for others. The Commission enforces against designated VLOPs.
Digital Services Coordinator in each Member State; Commission for VLOPs/VLOSEs.
Need a stack, not one file? Open the company desk
Professional briefing
Legal architecture and duties
For counsel, compliance, and policy teams. Not advice. The Official Journal still wins.
- Instrument
- Regulation
- Legal basis
- Art 114 TFEU · Regulation (EU) 2022/2065
- Application
- In force November 2022. VLOPs/VLOSEs from 25 August 2023; other intermediaries from 17 February 2024.
The DSA is a due-diligence statute for intermediary services, scaled by size. It does not create a new list of illegal speech; it forces process (notice, statement of reasons, appeal) and, for very large platforms, systemic-risk management. Extra-territorial: offering services to recipients in the Union, regardless of place of establishment.
How the file is built
Layered duties
All intermediaries (Arts 11–15) → hosting (16–18) → online platforms (19–32) → VLOPs/VLOSEs (33–43). Getting the layer wrong is the usual scoping error.
Designation
VLOP/VLOSE = average monthly active recipients ≥ 45 million, designated by the Commission. Designation, not self-label, triggers the heavy chapter.
Enforcement split
Digital Services Coordinators for most providers; Commission exclusive for VLOP systemic duties.
Operators
| Role | Who | Core duties |
|---|---|---|
| Mere conduit / caching / hosting | Classic e-commerce intermediary types. | Point of contact, legal representative if non-EU, terms, transparency; hosting gets notice-and-action. |
| Online platform | Hosting that disseminates to the public (shops, app stores, social). | Internal complaints, out-of-court dispute, trader traceability (KYT), ads repository basics, ban on dark patterns in specified cases. |
| VLOP / VLOSE | Designated very large platforms and search engines. | Systemic-risk assessment and mitigation, independent audit, data access for researchers, compliance officer, non-profiling recommender option. |
Scope
Services offered to recipients in the Union. A legal representative in the Union is required for providers with no establishment here.
In
- Intermediary services: conduit, caching, hosting.
- Online platforms and search engines, including marketplaces.
- Illegal content as defined by other Union or national law — the DSA is the process layer.
Out, or narrower than assumed
- Micro and small enterprises are carved out of several online-platform duties (not all — check the article).
- Not a general monitoring obligation (Art 8).
- Does not authorise Member States to impose general monitoring either.
Operative provisions
| Anchor | Rule | What it does in practice |
|---|---|---|
| Art 16 | Notice-and-action for hosting: easy, electronic notices; reasoned decisions. | Trust-and-safety queues need legal characterisation, not only keyword filters. |
| Art 25 / 26–28 | Dark patterns banned in specified UI; ads transparency; protection of minors. | Profiling-based ads to minors are out; ‘consent or pay’ models sit under GDPR, not only DSA. |
| Art 34–35 | VLOP systemic-risk assessments (illegal content, fundamental rights, civic discourse, public health, gender-based violence) and mitigations. | Annual (and ad hoc) risk files are the Commission’s audit target. |
| Art 52 | Fines up to 6% of worldwide annual turnover for VLOPs (Commission). | National DSCs handle smaller providers with national penalty frames. |
Secondary law and guidance
- Commission designation decisions and guidelines on average monthly active recipients.
- Delegated acts on independent audits and data access.
- DSC network (European Board for Digital Services).
National layer. Each Member State names a Digital Services Coordinator. Criminal law still defines much of ‘illegal content’. Orders to act against illegal content (Art 9) and to provide information (Art 10) come from national authorities under their own law.
How it sits with other files
Gatekeeper and VLOP sets overlap but are not identical. DMA is contestability; DSA is content and systemic risk.
Ads, profiling, and researcher data access must still satisfy Chapter V and purpose limitation.
Recommender and content-moderation models may be high-risk or GPAI in addition to DSA risk assessments.
Enforcement and private rights
Who
DSC + Commission (VLOP chapter). Trusted flaggers are certified nationally.
Tools
Orders, interim measures, periodic penalties, 6% fines, independent audits.
Private rights
Users get complaints and certified ADR. Collective redress may ride on top via the Representative Actions Directive.
Risk register
| Risk | Signal | Control |
|---|---|---|
| Wrong layer (platform vs hosting vs VLOP) | Consumer app with UGC treated as a ‘small blog’ | Legal opinion on Art 3 definitions; MAU measurement file. |
| Trader traceability failure | Marketplace sellers without traceable identity | KYT before listing; repeat-offender suspension (Art 23). |
| Unauditable risk file | VLOP mitigations described as product slogans | Map mitigations to Art 34 risk taxonomy with metrics. |
Open issues
- How far ‘illegal content’ notices can be used to pressure lawful speech.
- Researcher data access vs trade secrets and GDPR.
- Age-assurance methods that do not themselves violate data minimisation.
Primary sources
Intermediaries must handle illegal content and goods with a real notice process. Very large platforms answer to the Commission; the rest to the national DSC.
You feel it now
In force. DSC complaints are live. VLOP/VLOSE duties already run in Brussels.
Next
More designation fights and audits on very large services.
Where it lands
| Channel | People | Companies |
|---|---|---|
| Your post or listing | You can demand a reason when something is taken down, and a path to contest it. | Notice-and-action, statement of reasons, trusted flaggers. A founder inbox is not a DSA process. |
| Illegal goods and scams | Marketplaces must know their traders. A recall or a scam ad is a DSA plus product-safety file. | Traceability of traders, dark-pattern limits, ads repositories if you are very large. |
Who gains
Users who get a reason; authorities who have a named coordinator.
Who pays
Hosts who only had a community-guidelines email.
Files this pulls with it
- GPSR — Unsafe goods on a marketplace are GPSR and DSA at once.
- Digital Markets Act — Gatekeepers may also be VLOPs — different duties, same company.
Who pays
Online platforms and intermediaries, with the steepest bill for the largest ones.
Who benefits
Users, researchers, and smaller traders competing on cleaner marketplaces.
Read the official text