🇪🇺Digital Services Act

← Back to laws in European Union

The Digital Services Act regulates online intermediaries, platforms and systemic online risks

The Digital Services Act is the EU's horizontal framework for intermediary services in the online environment. It applies to services such as internet access, caching, hosting, online platforms, online marketplaces, social networks, app stores and very large online platforms or search engines that reach users in the Union. Its focus is not limited to personal data protection. It is about safer digital services, illegal content governance, transparency, user rights, trader traceability, advertising transparency, platform accountability and systemic risk management.

For privacy and data governance teams, the Act matters because many of its obligations overlap with content moderation data, recommender systems, advertising systems, minors' protection, user complaints, transparency reporting, researcher access, regulatory data access and the governance of very large platforms. It sits alongside the GDPR and the ePrivacy framework rather than replacing them.

Who the Act applies to

The Digital Services Act applies to providers of intermediary services that offer services in the Union, whether or not they are established in the Union, where there is a substantial connection to the Union. The obligations are layered. A basic set applies to all intermediary services, additional obligations apply to hosting providers, further obligations apply to online platforms, additional marketplace rules apply to online platforms allowing consumers to conclude distance contracts with traders, and the most demanding duties apply to very large online platforms and very large online search engines.

This tiered structure is important. A small hosting provider, a marketplace, a social media platform and a very large search engine do not have the same obligations. The compliance analysis should therefore begin by classifying the service correctly.

The liability framework is preserved but modernised

The Act preserves the familiar intermediary liability structure for mere conduit, caching and hosting services. The basic idea is that an intermediary should not automatically become liable for all information transmitted or stored through its service merely because it provides technical infrastructure. At the same time, hosting providers must act expeditiously when they obtain actual knowledge or awareness of illegal content.

The Act also confirms that providers should not be subject to a general obligation to monitor all information or actively seek illegal activity. This is important for freedom of expression, proportionality and technical feasibility. It does not prevent specific orders by competent authorities or voluntary good-faith efforts to detect and address illegal content.

Baseline duties for intermediary services

All intermediary services must provide clear contact points for authorities and recipients of the service. Providers not established in the Union but offering services in the Union may need to appoint a legal representative in the Union. Terms and conditions must explain restrictions on use of the service, including content moderation policies, procedures, tools, algorithmic decision-making and human review where relevant.

The Act requires terms to be written and applied in a way that is clear, plain, intelligible, user-friendly and non-arbitrary. Where a service is primarily directed at minors or predominantly used by them, the explanation of conditions and restrictions must be understandable to minors.

Notice-and-action for hosting services

Hosting providers must provide mechanisms that allow individuals or entities to notify them of specific items of information considered to be illegal content. These notice-and-action mechanisms should be easy to access, user-friendly and capable of allowing sufficiently precise and adequately substantiated notices.

When a hosting provider takes action because information is considered illegal or incompatible with its terms, it must provide a statement of reasons to the affected recipient. This includes decisions to remove content, disable access, restrict visibility, suspend or terminate service, or restrict monetisation. The Act therefore turns content moderation into a documented, reviewable process.

Online platforms need complaint and redress systems

Online platforms must provide internal complaint-handling systems for users affected by certain moderation decisions. Users should be able to challenge removals, disabling of access, restrictions on visibility, account suspensions, account terminations and monetisation restrictions. Platforms must also engage with certified out-of-court dispute settlement bodies in appropriate cases.

The Act also creates a trusted flagger system. Trusted flaggers are entities recognised for their expertise in identifying illegal content within a designated area. Their notices must be treated with priority, while platforms still need to process all notices in a timely, diligent and non-arbitrary manner.

Advertising transparency and recommender systems

Online platforms must ensure that recipients can identify when information is an advertisement, on whose behalf the advertisement is presented, and meaningful information about the main parameters used to determine the recipient to whom it is presented. The Act also restricts targeted advertising based on profiling using special categories of personal data.

Platforms using recommender systems must explain, in their terms and conditions, the main parameters used in those systems and any options for recipients to modify or influence those parameters. This affects feeds, search rankings, recommendations, marketplace ordering, content discovery and other ranking systems.

Protection of minors

Online platforms accessible to minors must put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security for minors. They must not present advertisements based on profiling using personal data of a recipient when they are aware with reasonable certainty that the recipient is a minor.

This obligation should be read together with the GDPR, the ePrivacy framework and child protection rules. The Act does not require platforms to collect unnecessary additional personal data merely to assess whether a user is a minor, but services used by minors still need a defensible safety-by-design approach.

Marketplace and trader traceability duties

Online platforms that allow consumers to conclude distance contracts with traders have additional obligations. They must collect and assess certain trader information before traders can offer products or services to consumers in the Union. This supports traceability, product safety, consumer protection and accountability for illegal products or services.

These platforms must also design their interfaces so that traders can provide required pre-contractual, compliance and product safety information. Where the platform becomes aware that an illegal product or service was offered through its service, it must inform affected consumers where it has their contact details, or make relevant information publicly available where individual notice is not possible.

Very large online platforms and search engines

The Act imposes the strongest obligations on very large online platforms and very large online search engines. These are services designated because they reach at least 45 million average monthly active recipients in the Union. Their obligations reflect their systemic importance for public debate, elections, consumer protection, public security, minors, health, fundamental rights and the information environment.

These providers must conduct systemic risk assessments, adopt reasonable and proportionate mitigation measures, undergo independent audits, provide enhanced transparency reports, maintain advertising repositories where applicable, provide data access to regulators and vetted researchers, establish an independent compliance function and pay supervisory fees.

Regulatory access to data and vetted researcher access

Very large online platforms and very large online search engines may be required to provide access to data necessary to monitor and assess compliance. This can include data linked to algorithmic systems, content moderation, recommender systems, advertising systems, risk assessments and systemic risks. The Act also creates a framework for vetted researchers to access data for research that contributes to identifying and understanding systemic risks in the Union.

For privacy teams, this creates a careful balancing exercise. Data access must support regulatory oversight and public-interest research while protecting personal data, trade secrets, confidential information and the rights of users. Privacy, security, legal and public policy teams should be involved before data-sharing systems are designed.

Governance and enforcement

Member States must designate Digital Services Coordinators to supervise and enforce the Act at national level. The European Commission has specific powers for very large online platforms and very large online search engines, especially for the additional systemic-risk obligations. The European Board for Digital Services supports coordination, cooperation and consistent application across the Union.

Member States must lay down penalties that are effective, proportionate and dissuasive. The maximum fine for failure to comply with an obligation under the Act may be up to 6% of the annual worldwide turnover of the provider concerned in the preceding financial year. The Act applies from 17 February 2024, with earlier application for certain provisions and designated very large online platforms and very large online search engines.

How the DSA connects with privacy compliance

The Digital Services Act does not replace the GDPR or the ePrivacy Directive. It expressly sits beside EU data protection and privacy law. Where DSA compliance involves personal data, such as moderation logs, user complaints, advertising parameters, recommender systems, minor-safety measures, law-enforcement escalation or researcher access, the GDPR analysis still has to be completed.

This makes the DSA a practical governance law for digital platforms. It requires legal teams, privacy teams, trust and safety teams, product teams, advertising teams, public policy teams and security teams to work from the same operating model.