The EU Digital Services Act (DSA) is a tiered rulebook for digital intermediaries operating in the European Union. It applies baseline duties to services such as hosting providers, marketplaces, social networks, app stores and search engines, while designated very large online platforms and search engines face additional systemic-risk, audit, data-access and recommender-system obligations. The exact requirements depend on the service category, user scale and whether the European Commission has issued a VLOP or VLOSE designation.
What the Digital Services Act requires, in brief
Regulation (EU) 2022/2065—the Digital Services Act—sets one EU-wide framework for intermediary services. The European Commission describes its scope broadly: online services operating in the EU must comply, but not with an identical checklist. A service may be an intermediary service, a hosting service, an online platform, an online marketplace or an online search engine. Duties increase with the service’s role and reach.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
The EU Digital Services Act | $209.06 | Buy on Amazon |
| 2 |
|
Principles of the Digital Services Act | $154.37 | Buy on Amazon |
| 3 |
|
The Digital Services Act Explained | $13.99 | Buy on Amazon |
| 4 |
|
European Digital Services Act and Digital Markets Act: Full text of Regulations (EU) 2022/1925 and... | $37.90 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
The general DSA regime became applicable on 17 February 2024. A separate, more demanding layer applies to designated Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs). The Commission uses more than 45 million monthly users in the EU as the threshold for designation. A designated service generally has four months after notification of designation to meet the additional obligations.
Who does the Digital Services Act apply to?
The DSA can apply when a provider offers an intermediary service to recipients in the EU, even if the provider is established elsewhere. The category matters because each level adds duties to the previous one.
#1 Best Overall
| Service category | Typical examples | How the DSA treats it |
|---|---|---|
| Intermediary service | Services that transmit, cache or host information for users | Forms the broadest coverage level; specific duties depend on the function performed. |
| Hosting service | Cloud, web-hosting and services storing user information | Must provide affected users with clear, specific reasons when covered content is removed or access is restricted. |
| Online platform | Social networks, content-sharing services, app stores, travel and accommodation platforms | Adds user-reporting, statements-of-reasons, advertising, transparency and (for most platforms) user-number duties. |
| Online marketplace | Services connecting consumers with third-party sellers | Adds seller verification and traceability-related measures, alongside ordinary platform duties. |
| Online search engine | Services enabling users to search across websites | Ordinary search services have applicable baseline duties; designated VLOSEs face the large-service systemic-risk regime. |
Small and micro-enterprises are exempt from some of the more burdensome requirements. That does not mean every small provider is outside the DSA: the applicable service definition and the specific exemption must be checked against the Regulation’s operative text.
When did the rules take effect?
- 17 February 2024: the DSA’s general provisions became applicable across the EU.
- After designation: a VLOP or VLOSE receives a four-month compliance period for its additional obligations, measured from notification of designation.
- 1 July 2025: the implementing regulation standardising DSA transparency reporting took effect, according to the Commission.
- February 2026: the first harmonised transparency reports under that implementing regulation were published.
Designation lists, reporting templates, Commission guidance and enforcement decisions can change. A platform making a provision-by-provision legal assessment should use the current Regulation, implementing acts and the latest Commission material rather than relying on an old checklist.
Baseline duties for online platforms
Provide a way to report illegal content, goods or services
Platforms must offer a user-facing mechanism for reporting content, products or services that are illegal under EU or national law. The reporting route should be usable without specialist knowledge and should allow the platform to receive enough information to assess the notice. This is a reporting channel, not a promise that every report will result in removal: the platform must apply its applicable legal and terms-of-service processes.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Explain moderation decisions to affected users
Hosting services, including online platforms, must give an affected user a clear and specific statement of reasons when they remove content or otherwise restrict access. A generic message such as “violates our rules” may not satisfy the requirement when it fails to identify the relevant rule or the main facts behind the decision.
Online platforms also send these statements of reasons to the Commission’s public, machine-readable DSA Transparency Database. The database makes moderation explanations available for public analysis, subject to the framework’s permitted exclusions and data-protection constraints.
Rank #2
Publish moderation transparency reports
Intermediary service providers must publish moderation transparency reports at least annually. VLOPs and VLOSEs must report at least every six months. Reports cover information such as moderation activity and the way automated or human systems are used, in the format required by the applicable rules.
Most online platforms—excluding small and micro-enterprises—must also publish their self-assessed number of monthly users in the EU and update that figure every six months. The Commission says the first harmonised reports using the standardised framework appeared in February 2026, following the implementing regulation’s entry into force on 1 July 2025.
Make advertising identifiable and explain its delivery
Advertisements shown on a platform must be recognisable as ads. The platform must identify who placed the ad and provide information about why the particular user is seeing it. The DSA also prohibits targeting based on sensitive personal data such as religion, race or sexual orientation.
These rules concern the transparency and targeting conditions around an ad; they do not turn every commercial communication into illegal content. Platforms still need processes that distinguish advertising from ordinary user posts and expose the required information at the point where the ad is displayed.
Stop deceptive interface design
The DSA prohibits “dark patterns”—interface designs that deceive or materially manipulate users or otherwise substantially impair their ability to make a free, informed decision. Examples can include making a reject option unusually difficult to find or using misleading presentation to push a user toward a choice. Compliance requires reviewing the full interaction flow, not merely changing the wording of a button.
Extra rules for online marketplaces
An online marketplace must verify and display contact details for sellers using the service. Consumers should be able to see who is offering a product or service and how that seller can be contacted before relying on the listing.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Marketplaces must also make reasonable efforts to conduct random checks or use traceability technologies to identify illegal goods or services. The DSA does not make a marketplace automatically liable for every third-party listing; it does require operational measures aimed at reducing illegal trading and improving seller accountability.
What changes when a service is a VLOP or VLOSE?
Designation is based on reach and brings obligations beyond the ordinary platform or search-engine rules. The Commission identifies more than 45 million monthly users in the EU as the VLOP/VLOSE threshold. The figure is monthly and EU-specific; it is not a worldwide user count or a one-day traffic peak.
| Additional obligation | What the designated service must do |
|---|---|
| Systemic-risk assessment | Identify and assess risks created by the service, including illegal content, fundamental-rights impacts, public security, electoral processes, gender-based violence, public health, minors and mental or physical wellbeing. |
| Risk mitigation | Adopt proportionate measures to reduce the identified systemic risks and review whether those measures work. |
| Internal compliance function | Maintain an internal function responsible for DSA compliance, with sufficient independence and authority. |
| Independent audit | Undergo an independent audit at least annually and respond to the resulting recommendations. |
| Recommender choice | Offer at least one recommender-system option that is not based on profiling. |
| Public advertising repository | Maintain a publicly accessible repository containing required information about ads served on the service. |
| Authority data access | Share specified data with competent authorities when the DSA requires it. |
| Vetted researcher access | Provide qualifying, vetted researchers with access needed for permitted research into systemic risks, subject to the DSA’s conditions. |
The risk list is deliberately broad. A large service must examine not only illegal posts but also how its design, recommender systems and business practices may affect elections, children, public health or fundamental rights. A single annual policy document is unlikely to demonstrate that the assessment, mitigation and audit cycle is operating in practice.
How the moderation and risk duties fit together
- Map the service. Identify which functions are intermediary, hosting, platform, marketplace or search-engine functions, and document where EU users are served.
- Determine size and exemptions. Calculate EU monthly users using the applicable methodology, check whether the provider is a small or micro-enterprise, and monitor whether a designation notice has been issued.
- Build notice-and-action workflows. Provide the illegal-content reporting route, record notices, apply consistent decisions and generate a specific statement of reasons for restrictions.
- Prepare transparency outputs. Maintain moderation data, EU user figures and the fields needed for the required annual or six-monthly reports. For online platforms, submit statements of reasons to the public DSA Transparency Database as required.
- Review ads and interfaces. Check ad labels, sponsor identity, explanations for delivery, prohibited targeting categories and user journeys for dark patterns.
- Add marketplace controls where relevant. Verify seller contact information, display it, and operate reasonable random checks or traceability measures.
- If designated, run the systemic-risk cycle. Assess the listed risks, implement mitigations, maintain an independent compliance function, arrange the annual audit, provide the non-profiled recommender option and prepare the ad-repository and data-access processes.
How extensive is platform moderation under the DSA?
The Commission reported more than 9 billion content-moderation decisions in the first half of 2025. It said 99% of those decisions were proactively initiated under platforms’ own terms and conditions. These figures describe the Commission’s reported aggregate for that period; they are not a legal quota and do not mean that 99% of decisions concerned illegal content. The distinction matters because platforms moderate both illegal material and conduct prohibited by their private terms.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWho enforces the DSA?
Enforcement is shared between national authorities and the European Commission. National authorities handle investigative and sanctioning functions within the roles assigned to them. The Commission supervises the additional obligations imposed on designated VLOPs and VLOSEs.
For a platform, this means that a complaint, investigation or information request may involve a national authority, the Commission or both, depending on the service and the suspected breach. Internal records should therefore show not only the final moderation result but also the notice, reasoning, review path, risk assessment and remedial action that produced it.
What the DSA means for users
- You should have a practical way to flag suspected illegal content, goods or services.
- If a hosting service restricts your content, you should receive a clear, specific explanation rather than an unexplained block.
- Ads should be labelled, identify who placed them and explain why they were shown to you; sensitive personal data cannot be used for ad targeting under the specified prohibition.
- On a marketplace, seller contact details should be visible and the platform should carry out reasonable checks aimed at detecting illegal offers.
- On a designated very large service, at least one recommender option must not rely on profiling.
These rights do not guarantee that a platform will agree with a report or restore every restricted post. They create transparency, explanation and accountability mechanisms around the decision.
Common compliance mistakes
- Treating the DSA as one universal checklist: obligations differ by service category, enterprise size and designation.
- Using vague moderation notices: a short label without a specific reason may fail the statement-of-reasons requirement.
- Counting the wrong users: the VLOP/VLOSE threshold is more than 45 million monthly users in the EU, not global registrations or occasional visitors.
- Ignoring private-rule moderation: the Commission’s 2025 figure shows that most reported decisions were initiated under platforms’ own terms, so records must cover terms-of-service enforcement as well as illegal-content notices.
- Publishing stale figures: most non-exempt online platforms must refresh EU monthly-user numbers every six months.
- Assuming a small-company exemption removes every duty: exemptions apply to specified burdens and must be checked against the provider’s actual status and service.
- Leaving design out of compliance: dark-pattern risk can arise from the sequence and presentation of choices, not just from policy text.
What remains to be checked before making a legal determination
The DSA is a regulation with detailed definitions, exceptions and procedural conditions. Current designation lists, reporting formats, Commission guidance, national enforcement practice and audit expectations can change. A platform making a high-stakes decision should verify the operative text and current official guidance for its exact service, establishment structure, user calculation and exemption status. This article explains the framework; it is not a substitute for provision-by-provision legal advice.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The practical takeaway
For an ordinary online platform, the core job is to make illegal-content reporting possible, explain restrictions, publish the required moderation and user figures, label and contextualise advertising, avoid prohibited targeting and dark patterns, and add seller controls if it operates a marketplace. For a designated VLOP or VLOSE, those controls are only the baseline: the service must also manage systemic risks, undergo annual independent audits, support a non-profiled recommender choice, maintain an ad repository and provide specified data access. The DSA is therefore best implemented as a continuing governance and evidence process, not a one-time policy update.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
