Digital & platforms
Digital Services Act
Published Reviewed
What is DSA?
The Digital Services Act regulates online intermediaries and platforms through duties covering content processes, user transparency, advertising and systemic risk management.
| Jurisdiction | European Union |
|---|---|
| Authority | Regulation (EU) 2022/2065 |
| Current status | Generally applicable since 17 February 2024 |
| Reviewed |
Why it matters operationally
The DSA rewrote the operating rules for anyone carrying or hosting third-party content in the EU — from bare hosting to marketplaces — with duties that scale by tier up to the systemic obligations on very large platforms. It applies regardless of where the provider is established, and its ceiling is serious: fines up to 6% of worldwide annual turnover. The everyday obligations are process obligations — notice-and-action, statements of reasons, complaint handling, ad transparency — which means they are either built into the product or they are missing.
Are you aware?
The dates that bind
Full application for every in-scope service
Since this date the DSA applies to all intermediary services offered in the EU, not only the very large platforms designated earlier — the core process duties are settled law.
The user-number clock
Online platforms must publish their average monthly active EU users at least every six months (Article 24) — the number that decides whether the very-large-platform regime, and Commission supervision, applies at 45 million.
The penalty ceiling matches the GDPR era
Non-compliance can draw fines up to 6% of worldwide annual turnover, with periodic penalties up to 5% of average daily turnover for continuing breaches.
Where to start
- 1
Classify your service honestly — mere conduit, caching, hosting, online platform, marketplace — because each tier switches on a distinct duty set.
- 2
Build the notice-and-action path with statements of reasons for every moderation decision, and an internal complaint system behind it.
- 3
If you carry advertising, make per-ad transparency (who paid, why targeted) visible in the product, and check your interfaces against the dark-pattern prohibition.
Authority links
Read the official sources
The official text is the authority. This guide is only a short orientation for operational planning.
Common questions
Frequently asked questions
Does the DSA apply to companies without an EU establishment?
Yes. It applies to intermediary services offered to recipients in the EU regardless of establishment; providers outside the EU must appoint an EU legal representative who can be held liable for non-compliance.
What are the tiers of obligation?
Cumulative layers: all intermediaries carry baseline duties (contact points, terms, transparency reporting); hosting adds notice-and-action; platforms add complaint systems, trusted flaggers, ad transparency and minor protections; marketplaces add trader traceability; platforms above 45 million EU users add systemic-risk assessments, audits and data access for researchers.
How does the DSA interact with the GDPR?
They run in parallel: the GDPR governs the personal data in your systems, the DSA governs the processes around third-party content and advertising. Ad-targeting restrictions overlap — the DSA bans targeting based on profiling of minors and on special-category data outright.
Side by side
Compared against
A quick self-check
Are you ready?
- Could a user find your single point of contact and your latest transparency report today?
- Does every content-moderation decision generate a statement of reasons — automatically?
- Do you know your current average monthly EU user number, and when you last published it?
Every question above has a written, evidence-backed answer in a well-run compliance record. If one made you pause, that pause is the gap.