1. What is the Digital Services Act and what it aims to achieve
The Digital Services Act (DSA) is Regulation (EU) 2022/2065, also known as the Digital Services Regulation. It establishes a common framework for intermediary services operating in the European Union and sets obligations for diligence, transparency, and accountability. Its objective is to foster a safer online environment and protect the fundamental rights of users, without turning regulation into an indiscriminate obligation to pre-review every publication.
The DSA is best understood as a rule on how online services are provided and governed, not as a single list of permitted content. Its rules cover intermediary services, hosting, and online platforms, with duties that increase according to the service's function and, in some cases, its scale. Therefore, it is not enough to ask if a company is a social network: it also matters whether it hosts user content, facilitates transactions, or acts as a search engine.
The regulation was approved in 2022, entered into force that same year, and became generally applicable on February 17, 2024. This difference between entry into force and application matters: the former indicates that the rule is part of the legal order; the latter, from when its provisions are generally required. Online platforms and search engines designated as very large had obligations earlier, from August 2023.
The DSA complements, but does not replace, other European rules. In particular, it should not be confused with the Digital Markets Act (DMA): the DSA addresses safety, transparency, and intermediary responsibilities; the DMA regulates certain practices of large platforms designated as gatekeepers. The same company may be subject to both for different reasons, but the gatekeeper label does not by itself determine its category under the DSA.
2. Which services it applies to and how they are classified
The scope includes services used to connect people with goods, services, or online content. Common examples include social networks, digital marketplaces, app stores, web hosting, and search engines. The legal classification depends on the specific function of the service: a hosting provider stores information provided by users; an online platform disseminates that information to the public; and an online marketplace allows consumers and sellers to conclude contracts at a distance.
The obligation is not limited to companies incorporated in the EU. The practical point is whether the service is offered to users in the Union, even if the provider is based elsewhere. In such cases, the DSA provides for contact and cooperation obligations with authorities, in addition to other applicable duties. For a company, the first check is therefore to delimit the services it offers in the EU and document the role each one plays.
The DSA distributes obligations in layers. There are basic duties for intermediary services and additional requirements for hosting, online platforms, marketplaces, very large platforms, and very large search engines. There is no general category of “medium platform” equivalent to the informal labels that sometimes appear in summaries: the relevant threshold for very large designation is more than 45 million active monthly recipients in the EU, subject to the criteria and procedures established by the regulation.
Small and micro-enterprises have exemptions from certain additional obligations, but this does not automatically exclude them from the entire DSA. The exemption depends on the service category and business size, and ceases to apply to certain duties when the platform is designated as very large. It is advisable to avoid the simplification “small, therefore unregulated”: the correct analysis is to identify the service, activity, size, and specific obligation.
3. Common obligations and duties by function
Basic duties of intermediaries
Among the general obligations are having a point of contact for authorities and, where appropriate, for users; explaining in their terms of service how they manage content restrictions; and publishing transparency reports with information on moderation. These duties turn decisions that could previously be opaque into processes that must be explainable and documentable.
Hosting services must offer mechanisms to notify allegedly illegal content. Upon receiving a sufficiently precise notification, the provider must process it diligently and communicate the decision in a motivated manner to the relevant party. Notifying does not equate to automatically proving an infringement: the obligation is to establish an accessible procedure and act diligently, not to remove any reported material without analysis.
Online platforms and marketplaces
Online platforms must offer internal complaint mechanisms for certain moderation decisions and facilitate options for out-of-court resolution. They also have obligations regarding advertising transparency and recommendation systems. In marketplaces, the DSA adds merchant traceability measures: the operator must collect and verify relevant information about sellers before allowing them to offer products or services to consumers, within the limits set by the rule.
For a digital store, this changes the operational management of sellers and notices: it is not enough to have a generic contact form. It must be able to identify the merchant, retain required information, and react to illegal products or services. In a social network, by contrast, the daily focus may be on content notification, motivation of decisions, and tools for complaining. Obligations overlap when a single service performs multiple functions.
Advertising, recommendations, and risks
The DSA requires that ads be identified as advertising and that it be indicated who presents them and, where appropriate, who finances them. Furthermore, it prohibits presenting advertising based on profiles using special categories of personal data and restricts targeted advertising to minors when the platform knows with reasonable certainty that the user is a minor. The regulation is not correctly summarized as a general prohibition of all personalized advertising: attention must be paid to the basis and specific conditions of segmentation.
Very large platforms and very large search engines must assess and mitigate systemic risks linked to their services. The assessment considers, among other aspects, the dissemination of illegal content, effects on fundamental rights, civic processes, and public safety. Independent audits and reinforced transparency obligations are also added. Not all platforms have to carry out that systemic assessment: it is a specific layer for services designated as very large.
The DSA maintains the principle that no general obligation to monitor all information transmitted or stored is imposed on intermediaries. This does not exempt them from acting upon knowledge of illegality or from complying with specific procedures. The practical distinction is between general prior surveillance—which is not required as a universal rule—and duties of response, transparency, and mitigation that do apply according to the service.
4. Practical comparison by scale and service type
The table summarizes examples of obligations; it does not replace legal classification nor intends to enumerate every article. “Small”, “medium”, and “large” are not three general levels with automatic packages: what is decisive is the functional category of the service, applicable exemptions, and, for the strictest layer, the formal designation of very large size. The indicated obligations are based on the layers described by the DSA.
| Service or scale | Example of relevant duty | What the organization must check |
|---|---|---|
| Intermediary, regardless of size | Point of contact, transparent terms, and transparency reports | What services it provides and what moderation decisions it makes |
| Hosting | Mechanism for notifying allegedly illegal content and diligent processing | Accessibility of the channel, case registration, and motivation of the decision |
| Online platform | Internal complaints, information on ads, and recommendation systems | Whether it stores content and disseminates it to the public |
| Online marketplace | Collection and verification of merchant information | Seller identity, traceability, and response to illegal offers |
| Very large platform or search engine | Assessment and mitigation of systemic risks, audit, and reinforced transparency | Official designation and scope of the service's risks |
An example helps read the table. A company offering hosting for posts may have to have a notification channel, even if its service is not a social network. If it also organizes those posts in a space accessible to the public and meets the definition of an online platform, obligations specific to that function are added. Classification is done by activity, not by the commercial label the company chooses.
A platform that exceeds 45 million active monthly recipients in the EU should not automatically self-declare as very large based on an informal calculation. The European Commission designates services that meet the regulation's criteria and publishes those designations. The figure guides the legal threshold, but the status and its reinforced obligations depend on the designation provided for by the rule.
5. What changes for users, businesses, and authorities
For users, the most visible effect is that certain decisions on content or accounts must be accompanied by an explanation and can be challenged through the provided mechanisms. There are also ways to notify allegedly illegal content and, in very large platforms, options related to non-personalized recommendations. The DSA expands tools and transparency; it does not guarantee that every complaint succeeds nor turns every moderation decision into a judicial resolution.
An example: if a platform restricts a post, the affected person can consult the motivation and, where appropriate, use the internal complaint mechanism. If they believe another account's material is illegal, they can use the notification channel. These are different processes: challenging one's own decision is not the same as reporting someone else's content, and neither eliminates the possibility of resorting to other applicable legal avenues.
For a business, practical application begins with a service inventory, an obligations matrix, and internal responsible parties. Depending on the activity, it may be necessary to establish flows for moderation, complaint handling, advertising transparency, merchant verification, or risk assessment. The useful decision is not to hire a generic compliance tool without diagnosis, but to first identify which obligations are activated and what operational evidence will demonstrate that they are met.
National authorities supervise most services under the coordination of the European system, while the Commission has specific competences, particularly regarding very large platforms and search engines. The design seeks cross-border cooperation because a service can operate in numerous States at the same time. For businesses, this means that inquiries and requirements should not be treated as isolated incidents: it is advisable to maintain consistent documentation on decisions, notices, and measures adopted.
The regulation provides for fines for non-compliance that can reach up to 6% of the provider's annual worldwide turnover, with conditions and procedures defined in the rule. It is not an automatic sanction nor a uniform rate for any error. The gravity, nature of the non-compliance, and the supervision process matter; therefore, presenting the maximum percentage without context would exaggerate what it means in a specific situation.
6. How to conduct an initial assessment and where to consult
An initial review can be organized as a decision flow, useful for legal, product, and operations teams:
- Identify the service offered to EU users and describe its actual functions.
- Classify the function: intermediation, hosting, online platform, marketplace, or search engine, among other relevant categories.
- Check size and exemptions, including whether there is an official very large designation.
- Map applicable obligations and assign responsible parties, procedures, records, and complaint channels.
- Review and update the analysis when the service, scale, or regulatory decisions change.
In a company that sells products through its own marketplace, the first step is not to assume that “it is just e-commerce”. It must determine if the service also allows third-party merchants to offer products and conclude contracts with consumers; if so, traceability duties may be relevant. An application that allows publishing content can also be hosting, even if its commercial name does not contain the word platform.
The main regulatory source is Regulation (EU) 2022/2065 published in the Official Journal of the European Union. The European Commission offers explanations on the scope, user rights, and general functioning of the DSA. For a compliance decision, it is preferable to refer to the regulation text and official guidelines, because promotional summaries may simplify categories or mix DSA rules with those of the DMA, data protection, or other rules.
The DSA is, in summary, a tiered framework for making intermediary responsibilities verifiable: what service is offered, how content is treated, what information is delivered, and what risks are assessed. The practical reading consists of classifying the activity before applying a list of obligations. This avoids both underestimating the duties of a small service and attributing to all platforms the requirements reserved for very large ones.