The DSA (Digital Services Act) is Regulation (EU) 2022/2065, the European Union law that sets due diligence obligations for online intermediaries and defines when they are liable for illegal content shared by their users. In platform regulation it is the EU rulebook for content moderation, transparency and systemic risk, while its sister law, the DMA, addresses competition and gatekeeper power.
The DSA entered into force on 16 November 2022 and has applied to all covered services since 17 February 2024. It replaced and updated the liability rules of the e-Commerce Directive of 2000 and added a graduated set of duties that grow with the size and role of the service. This description is for orientation and is not legal advice.
How the DSA layers obligations by service type
The DSA works like a nested set of obligations: every category inherits the duties of the categories above it and adds its own. A simple network operator carries few duties, while a very large social network carries all of them.
| Service category | Examples | Main added obligations |
|---|---|---|
| Intermediary services | Internet access, DNS, caching | Points of contact, legal representative, terms and conditions, transparency reports |
| Hosting services | Web hosting, cloud storage | Notice and action, statement of reasons, reporting suspected serious crime |
| Online platforms | Social networks, app stores, forums | Complaint handling, trusted flaggers, ad transparency, protection of minors, dark pattern ban |
| Online marketplaces | Platforms connecting traders and consumers | Trader traceability and compliance by design |
| VLOPs and VLOSEs | Services above 45 million EU users | Systemic risk assessment, audits, data access, ad repository |
Micro and small enterprises are exempt from most online platform duties unless designated as very large. The threshold for designation is 45 million average monthly active recipients in the EU, roughly 10 percent of the population, and designation is made by the European Commission.
Liability rules and the notice-and-action mechanism
The DSA keeps the conditional liability exemptions for mere conduit, caching and hosting. A host is not liable for user content as long as it has no actual knowledge of illegality and acts expeditiously once it obtains such knowledge, typically through a notice.
The regulation also confirms that there is no general monitoring obligation, and its Good Samaritan clause protects providers that run voluntary own-initiative checks. What counts as illegal content is defined by other EU or national law, not by the DSA itself.
The table shows the main stages of the content moderation process the DSA prescribes for hosting services and platforms.
| Stage | What the provider must do | Purpose |
|---|---|---|
| Notice | Offer an easy electronic mechanism to report illegal content | Give users and flaggers a channel |
| Decision | Process notices diligently, prioritize trusted flaggers | Timely and objective handling |
| Statement of reasons | Explain any restriction to the affected user | Transparency of each decision |
| Internal complaint | Allow free appeal for at least six months | Correct mistaken decisions |
| Out-of-court settlement | Engage with certified dispute bodies | Independent review without courts |
Statements of reasons are submitted to the public DSA Transparency Database, which makes moderation decisions across the EU searchable at scale.
Duties of very large online platforms
Very large online platforms and search engines face the strictest duties because their design choices affect society as a whole. They must assess and mitigate four broad systemic risk categories: illegal content, fundamental rights, civic discourse and elections, and public health, minors and well-being.
- Annual systemic risk assessment and reasonable, proportionate mitigation measures.
- Independent audit of compliance at least once a year.
- At least one recommender option not based on profiling.
- A public, searchable advertisement repository.
- Researcher data access for vetted researchers studying systemic risks.
- A compliance function, crisis response cooperation and an annual supervisory fee capped at 0.05 percent of turnover.
Obligations for designated services start four months after designation, so the first group of very large platforms became bound in August 2023, earlier than the general application date.
Enforcement and how the DSA compares with related laws
Enforcement is shared. Each member state appoints a Digital Services Coordinator to supervise providers established on its territory, while the European Commission has exclusive power over the systemic duties of very large services. Fines can reach 6 percent of worldwide annual turnover, with periodic penalties up to 5 percent of average daily turnover.
| Law | Main focus | Key difference from the DSA |
|---|---|---|
| DMA | Fair competition on gatekeeper platforms | Ex ante economic rules, not content duties |
| e-Commerce Directive | Information society services | Original liability rules, now moved into the DSA |
| UK Online Safety Act | Harmful content and child safety in the UK | Duty of care model with codes from Ofcom |
| Section 230 | US immunity for user content | Broad immunity without due diligence duties |
Formal proceedings against several large platforms have been opened since 2023, and decisions continue to shape how terms such as systemic risk and dark patterns are interpreted. Delegated acts, guidelines and codes of conduct are still evolving, so practical requirements may change over time.
Common compliance mistakes
- Assuming the DSA only targets giants. Basic duties apply to every intermediary serving EU users.
- Generic statements of reasons. Each decision must name the legal or contractual ground and the facts.
- Ignoring non-EU establishment rules. Providers without an EU base need a legal representative in the Union.
- Treating user numbers loosely. Platforms must publish average monthly active recipients at least every six months.
A plain-language summary
The DSA is the EU rulebook for online services that carry other people’s content. It does not decide what is illegal; national and EU laws do that. Instead, it tells services how to handle reports, how to explain removals and how to let users complain.
The bigger the service, the more it must do. The largest platforms must study how their design can harm society and fix those risks, much as a stadium with fifty thousand visitors needs more safety measures than a small cafe.
An example from practice
A regional online marketplace with about two million monthly users in the EU receives a notice that a listed toy lacks mandatory safety markings. Under the DSA, it reviews the notice, removes the listing and sends the trader a statement of reasons citing the product safety rule and the facts. The trader appeals through the internal complaint system and provides a valid conformity document, so the marketplace restores the listing within a few days.
Because it is a marketplace, the company had also collected and verified the trader’s identity and registration details before the trader could sell. The outcome is a documented, reviewable decision trail that the national Digital Services Coordinator can inspect, with no need for the platform to monitor every listing in advance.