The Digital Services Act is an EU regulation that sets rules for how online intermediaries — from internet providers to social networks to marketplaces — handle illegal content, advertising, algorithms, and user rights. It has applied in full since February 17, 2024, with the largest platforms bound since August 2023, and it backs its obligations with fines of up to 6% of a company’s worldwide annual turnover.1StreamLex. DSA – Art. 52 What follows is a plain summary of what the DSA requires, who it covers, and how it is enforced.
Who the Rules Apply To
The DSA is layered. Every tier inherits the obligations of the one below it and adds more. At the base sit “intermediary services” like internet access providers and domain registrars, which only transmit or route information. Hosting services, such as cloud providers and web hosts, come next because they store user content. Online platforms — social networks, app stores, marketplaces — carry heavier duties because they organize content and distribute it to the public.2European Commission. The Digital Services Act
The strictest rules apply to Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs): services with at least 45 million average monthly active users in the EU, roughly 10% of the population.3EUR-Lex. Regulation (EU) 2022/2065 – Digital Services Act The Commission has designated over two dozen services in this category, including Facebook, Instagram, YouTube, TikTok, X, Amazon Store, Google Search, Bing, Temu, Shein, Wikipedia, and LinkedIn.4European Commission. Supervision of the Designated Very Large Online Platforms and VLOSEs
Geography of headquarters doesn’t matter. The DSA reaches any service offered to people in the EU that has a “substantial connection” to it, shown by things like offering the service in an EU language, accepting an EU currency, or appearing in a national app store. Being technically reachable from Europe is not enough on its own. Non-EU providers within scope must appoint a legal representative in a member state where they operate. That representative is the point of contact for regulators and can be held personally liable for the provider’s non-compliance.
Reporting and Removing Illegal Content
Every hosting service must run a notice-and-action system that anyone can use to flag content they believe is illegal. The system has to be electronic, easy to find, and simple to use. A valid notice explains why the content is illegal, gives the exact URL, and includes the reporter’s name, email, and a statement that the information is accurate. Once a notice contains those elements, the platform must confirm receipt without delay and later tell the reporter what it decided and how to appeal.5eu-digital-services-act.com. Article 16, the Digital Services Act (DSA)
The mechanism has teeth because of how liability works. Hosting services are shielded from responsibility for user content only until they have “actual knowledge” that something is illegal. A valid notice creates that knowledge. Ignore it, and the shield falls away.
The DSA also formalizes “trusted flaggers” — organizations with proven expertise in a specific type of illegal content. National Digital Services Coordinators award the status, which is valid across the EU. Platforms must handle these notices with priority, and trusted flaggers must publish annual reports on the notices they submit.6European Commission. Trusted Flaggers Under the Digital Services Act (DSA)
Separately, when a platform becomes aware of information suggesting a serious criminal offense that threatens someone’s life or safety, it must alert law enforcement. That obligation runs alongside content moderation, not through it.
Your Rights When a Platform Moderates You
When a platform removes your content, hides it, suspends your account, or cuts off monetization, it owes you a “statement of reasons” identifying the specific legal basis or terms-of-service provision behind the decision. The same rule applies whether a human or an automated system made the call, and platforms cannot moderate in an arbitrary or discriminatory way.7European Commission. DSA: Making the Online World Safer
If you disagree, you have a layered appeal path. First is the platform’s internal complaint system, which must be electronic, free, and open for at least six months after the decision.8eu-digital-services-act.com. Article 20, the Digital Services Act (DSA) People who submitted notices can also complain when a platform refuses to act.
If that doesn’t resolve things, you can take the dispute to a certified out-of-court settlement body. These bodies are independent from platforms and certified by national Digital Services Coordinators. You choose any certified body that handles your dispute type and language. Settlement is typically free or low-cost, and if the body rules in your favor, the platform pays the fees. The decision is not binding, and you keep the right to go to court at any point.9European Commission. Out-of-Court Dispute Settlement Bodies Under the Digital Services Act
Advertising, Dark Patterns, and Minors
Every online platform that shows ads must make four things immediately clear: that the content is an ad, who is behind it, who paid for it if different, and the main criteria used to target it at you. You also need a way to see and change those targeting parameters.10StreamLex. DSA Article 26 – Advertising on Online Platforms
Certain targeting is off-limits entirely. Platforms cannot target ads using sensitive personal data like religious beliefs, sexual orientation, health information, or political opinions. Profiling-based targeted ads to minors are banned outright.11eu-digital-services-act.com. Article 28, the Digital Services Act (DSA)
The regulation also prohibits “dark patterns,” interface designs that distort users’ ability to make free, informed choices. Cancellation flows buried behind retention screens and cookie banners that make “Reject” harder to find than “Accept All” are the kinds of practices in scope.12European Parliamentary Research Service. Regulating Dark Patterns in the EU: Towards Digital Fairness
Platforms accessible to children must put “appropriate and proportionate measures” in place to protect minors’ privacy, safety, and security. In practice this means defaulting minors’ accounts to private, disabling high-risk features like autoplay and live streaming by default, restricting contact from strangers, adapting recommendation systems away from harmful content loops, and providing child-friendly reporting tools.
Algorithmic Feeds
Platforms have to explain in their terms of service how their recommendation systems work: what signals they use to prioritize content and why you see what you see. That applies to any platform that ranks or suggests content.
VLOPs and VLOSEs go further. They must offer at least one recommendation option that is not based on profiling, giving users a way to switch to a feed that isn’t shaped by their behavioral data.
Marketplace Seller Verification
Online marketplaces that host third-party sellers face a “know your business customer” duty. Before a trader can list to EU consumers, the marketplace must collect the trader’s name, address, phone number, email, a copy of ID, payment account details, trade register information, and a self-certification that products will comply with EU law.13eu-digital-services-act.com. Article 30, the Digital Services Act (DSA)
Marketplaces can’t just take the trader’s word. They must make “best efforts” to verify the information against official databases or supporting documents. If a trader submits inaccurate information and won’t correct it, the marketplace has to suspend that trader’s access.
Extra Duties for the Largest Platforms
VLOPs and VLOSEs carry obligations that smaller services do not. They must run regular systemic risk assessments covering the spread of illegal content, harm to fundamental rights, effects on civic discourse and elections, and impacts on vulnerable populations including minors. After identifying risks, they have to design and implement mitigation measures, which are subject to independent audit and Commission scrutiny.14eu-digital-services-act.com. Article 34, the Digital Services Act (DSA)
They undergo annual independent audits of DSA compliance, with reports going to the Commission and the relevant Digital Services Coordinator and published within three months.15European Commission. Delegated Act on Independent Audits Under the Digital Services Act All intermediary services publish annual transparency reports covering removal orders, user notices, automated moderation tools, and error rates, but the biggest platforms publish more detail more often.16European Commission. How the Digital Services Act Enhances Transparency Online
Vetted researchers can also demand data access from these platforms to study systemic risks. They must be affiliated with a recognized research organization, independent from commercial interests, transparent about funding, and capable of handling data securely. Platforms have to facilitate access through interfaces like databases or APIs, including real-time data where technically possible.17eu-digital-services-act.com. Article 40, the Digital Services Act (DSA)
A crisis response mechanism sits on top of all this. When extraordinary circumstances create a serious threat to public security or public health across the EU, the Commission can order VLOPs and VLOSEs to take specific action, but only after a recommendation from the European Board for Digital Services. Affected platforms must assess whether they are contributing to the threat, apply proportionate measures, and report back. Any crisis order is capped at three months, extendable once by another three.18eu-digital-services-act.com. Article 36, Crisis Response Mechanism – the Digital Services Act
Enforcement and Penalties
Enforcement runs on two levels. Every member state names a Digital Services Coordinator to oversee compliance for services established in that country. Coordinators can inspect, demand documents, and interview staff.19European Commission. Digital Services Coordinators The European Board for Digital Services, made up of the national coordinators and chaired by the Commission, harmonizes enforcement across borders. The Commission itself supervises VLOPs and VLOSEs directly.
Penalties come in three tiers:
- General non-compliance: fines up to 6% of the provider’s total worldwide annual turnover from the preceding financial year.
- Procedural violations, such as giving incorrect or misleading information, missing responses to requests, or refusing inspections: up to 1% of annual worldwide turnover.
- Periodic penalty payments to compel correction of an ongoing violation: up to 5% of average daily worldwide turnover per day.
For VLOPs and VLOSEs, the Commission imposes these fines directly.20eu-digital-services-act.com. Article 74, the Digital Services Act (DSA) For other services, member states set the penalties within the ceilings the regulation establishes.1StreamLex. DSA – Art. 52 When violations are repeated, serious, and cause significant harm, regulators can temporarily ban a service from operating in the EU.