EU Digital Services Act

Overview

The EU Digital Services Act (DSA), Regulation (EU) 2022/2065, modernizes the rules governing online intermediaries and platforms in the European Union. It became fully applicable in February 2024, with earlier obligations for the largest platforms. The DSA replaces parts of the e-Commerce Directive and introduces a layered set of obligations aimed at making the online environment safer, more transparent, and more accountable, while preserving fundamental rights.

The DSA follows a tiered model: baseline duties for all intermediaries, additional duties for hosting services and online platforms, and the most extensive duties for very large online platforms (VLOPs) and very large online search engines (VLOSEs) with over forty-five million EU users.

Who It Applies To

The DSA applies to providers of intermediary services offered to users in the EU, regardless of where the provider is established. This includes internet access providers, hosting services, online marketplaces, social networks, and search engines. The heaviest obligations fall on designated VLOPs and VLOSEs.

Key Requirements

All intermediaries must have points of contact and transparent terms. Hosting services must offer notice-and-action mechanisms for illegal content and give statements of reasons for content decisions. Online platforms must provide internal complaint handling, work with trusted flaggers, ensure marketplace traceability of traders, and ban certain manipulative design and targeted advertising practices. VLOPs and VLOSEs must conduct annual systemic-risk assessments, adopt mitigation measures, undergo independent audits, provide data access to researchers, and meet enhanced transparency requirements.

Penalties for Non-Compliance

Fines can reach up to six percent of a provider's global annual turnover, with periodic penalties for continued non-compliance. The European Commission supervises VLOPs and VLOSEs directly, while national Digital Services Coordinators oversee other providers. Severe or repeated violations can lead to temporary restrictions on the service.

How to Comply

Providers should implement notice-and-action and complaint-handling systems, publish transparency reports, and provide clear statements of reasons. Marketplaces should verify trader information. VLOPs and VLOSEs must build systemic-risk assessment, mitigation, auditing, and researcher-access programs. Coordinate with GDPR for any personal-data processing involved in these obligations.