European Union Digital Services Act: Rules, Duties, and Fines

The EU Digital Services Act (Regulation 2022/2065) is the European Union’s single rulebook for how online intermediaries, hosting providers, platforms, and search engines must operate when they serve users in the EU. It replaced the 2000 e-Commerce Directive and became fully applicable to all covered providers on February 17, 2024, with the strictest rules for the largest platforms taking effect several months earlier.¹ Obligations scale with a company’s size and reach, several manipulative design practices are banned outright, and fines can reach six percent of global annual turnover.

Who Has to Follow the Rules

The regulation applies to any company providing digital intermediary services to people in the EU, regardless of where the company itself is based. Duties are layered across four tiers, each inheriting the obligations of the tier above it.

Intermediary services, the broadest category, cover internet service providers, domain registrars, and other infrastructure that transmits or routes data. They carry basic transparency and cooperation duties.
Hosting services, including cloud providers and web hosts, add notice-and-action rules for illegal content.
Online platforms, meaning services that organize user-generated content or connect buyers with sellers, pick up rules on complaint handling, advertising transparency, and interface design.
Very Large Online Platforms and Very Large Online Search Engines (VLOPs and VLOSEs), designated by the European Commission when they reach at least 45 million monthly active users in the EU, face the heaviest set of obligations including systemic risk assessments, independent audits, and crisis response duties.²

Micro enterprises (fewer than 10 employees and under €2 million in annual turnover) and small enterprises (fewer than 50 employees and under €10 million) are exempt from most platform-specific obligations, such as running an internal complaint system or publishing transparency reports. A company that grows past those thresholds gets a 12-month grace period before the additional rules bite. The exemption disappears entirely, however, if the Commission designates the company as a VLOP.¹

Providers based outside the EU must appoint a legal representative in a member state where they operate. That representative can receive enforcement orders and be held liable for the company’s non-compliance. VLOPs and VLOSEs based outside the EU need a legal representative in every member state where they offer services. Appointing one does not, on its own, count as establishing a business presence for other legal purposes.¹

Reporting Illegal Content and Challenging Moderation

Every hosting service and platform must offer an easy-to-find notice-and-action system that lets anyone flag content they believe is illegal. When a report comes in, the provider has to confirm receipt and process the notice without undue delay, acting diligently, objectively, and non-arbitrarily. The regulation does not set a hard clock in hours or days; responses must be timely in light of the circumstances.¹

Reports from “trusted flaggers”—organizations certified by a national Digital Services Coordinator for expertise in a particular area of illegal content—jump the queue and get priority handling.

Statement of Reasons

Whenever a platform removes content, limits its visibility, suspends an account, or restricts a user’s ability to earn money from posts, it must send that user a clear statement of reasons. The statement has to explain the legal or policy basis for the decision and specifically disclose whether automated tools were involved in making it.³

Complaints and Out-of-Court Settlement

Users who disagree with a moderation decision can challenge it through the platform’s internal complaint system for at least six months after the decision. Complaints must be handled in a non-discriminatory, non-arbitrary way, and any decision must be reviewed under the supervision of qualified staff, not by an algorithm alone. If the platform reverses course, it must undo the original action without undue delay.¹

If the internal route fails, users can bring the dispute to a certified out-of-court settlement body. These are independent organizations certified by national Digital Services Coordinators for up to five years. They review the dispute and propose a resolution, though they cannot bind either side. The process is typically free or low-cost for users, and when the body rules in the user’s favor the platform pays the fees.⁴

Platforms must also publish annual transparency reports covering their moderation activities, including the number of notices received, average response times, and complaint outcomes.

Marketplace Rules for Third-Party Sellers

Platforms that let consumers buy from third-party traders face an extra layer of obligations aimed at keeping fraudulent sellers out. Before allowing a trader to list products for EU consumers, the marketplace must collect the trader’s name, address, phone number, email, a copy of an identification document, payment account details, and a self-certification that products comply with EU law. The marketplace then has to make reasonable efforts to verify this information using publicly available official databases or supporting documents.¹

If any of that information later turns out to be inaccurate or incomplete, the marketplace must ask the trader to fix it. A trader who does not correct the problem gets suspended from selling to EU consumers until it is resolved.

Advertising and Interface Design

Dark Patterns

The DSA bans dark patterns, which it defines as design practices that distort or impair a user’s ability to make free and informed choices. Making cancellation harder than sign-up is a classic example. Burying a privacy-protective option behind extra clicks while making the data-sharing option a single bright button is another. Confusing layouts, deceptive wording, and manipulative visual cues that steer users away from choices they would otherwise make are all off-limits.¹

Targeted Advertising

Platforms cannot show profiling-based ads to users they know with reasonable certainty are minors. They also cannot target ads using sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health status, or sexual orientation. Every ad must be clearly marked as an ad, and the user must be able to see who paid for it and the main parameters used to target it.¹

Recommender Systems

Platforms must explain in plain language how their recommender systems work, including the main factors that determine what appears in a user’s feed. VLOPs and VLOSEs have to go further and offer at least one recommendation option that is not based on user profiling, so people can view content in a chronological or otherwise non-personalized order.⁵

Public Ad Repository

VLOPs and VLOSEs have to maintain a searchable public archive of every ad they display. Each entry must include the ad’s content, who paid for it, the period it ran, the targeting parameters, and the number of users it reached, broken down by member state where applicable. Ads stay in the archive for at least one year after they last ran.¹

Protection of Minors

Any platform accessible to minors, meaning users under 18, must put appropriate measures in place to ensure a high level of privacy, safety, and security for young users. A platform counts as accessible to minors if it targets them, is predominantly used by them, or if the provider is simply aware that some minors use the service. That last condition covers virtually every major social network and marketplace.¹

Platforms are not required to collect additional personal data to figure out which users are minors. The regulation recognizes that age verification itself creates privacy risks and balances child safety against data minimization.

Extra Duties on Very Large Platforms and Search Engines

VLOPs and VLOSEs must conduct a comprehensive risk assessment at least once per year, and again before launching any new feature likely to create significant risks. The assessment has to cover four categories: the spread of illegal content; risks to fundamental rights such as privacy, free expression, non-discrimination, and children’s rights; effects on civic discourse, elections, and public security; and harms to public health and wellbeing, including gender-based violence and mental health.¹

After identifying risks, these platforms must adopt reasonable and proportionate mitigation measures and submit to an independent annual audit paid for by the platform itself. Where the audit is not fully positive, the report must include specific recommendations and a timeline for fixing the problems.

Every VLOP and VLOSE must appoint a senior compliance officer independent from the operational functions of the business. The officer reports directly to the management body, has authority to raise systemic risk and compliance concerns, and cannot be removed without management board approval. Their name and contact details go to both the relevant national Digital Services Coordinator and the European Commission.¹

Vetted researchers studying systemic risks in the EU are entitled to data access from VLOPs and VLOSEs. A researcher qualifies by showing affiliation with a recognized research organization, independence from commercial interests, transparent funding, and adequate data security. Once a national Digital Services Coordinator approves the application, the platform must provide access through appropriate technical interfaces such as APIs. Platforms can push back where a request would create significant security vulnerabilities or expose trade secrets, but they must propose alternatives that deliver equivalent data.¹

In extraordinary situations such as a public health emergency or armed conflict, the European Commission can activate a crisis response mechanism on the recommendation of the European Board for Digital Services. Once activated, the Commission can require VLOPs and VLOSEs to assess whether their services are significantly contributing to the crisis, take steps to prevent or limit that contribution, and report back. Crisis measures are capped at three months. Platforms choose the specific steps, and the Commission can require revisions if the response falls short.

Enforcement, Fines, and Compensation

Enforcement runs on two tracks. Each member state designates a Digital Services Coordinator as the primary national authority for overseeing the DSA within its borders, and the coordinators work together through the European Board for Digital Services to keep enforcement consistent across the bloc.⁶ At EU level, the European Commission directly supervises VLOPs and VLOSEs.

The financial exposure is significant. The Commission can fine a VLOP or VLOSE up to six percent of total worldwide annual turnover for breaching the regulation’s substantive obligations, ignoring interim measures, or violating binding commitments. Supplying incorrect or misleading information to the Commission, or refusing to cooperate with an inspection, can draw a separate fine of up to one percent of annual income. For ongoing violations, periodic penalty payments accumulate until the company complies. Serious and repeated breaches can ultimately lead to a temporary suspension of the service within the EU.¹

Users and businesses that suffer actual damage because a provider violated its DSA obligations have the right to seek compensation in accordance with EU and national law. That covers harm from ignoring a valid notice about illegal content, wrongly removing lawful speech, or failing to put required safety measures in place.¹

1
EUR-Lex. Regulation (EU) 2022/2065 – Digital Services Act
2
European Commission. The Digital Services Act
3
DSA Transparency Database. Overview Documentation – DSA Transparency Database
4
European Commission. Out-of-Court Dispute Settlement Bodies Under the Digital Services Act
5
European Commission. DSA: Very Large Online Platforms and Search Engines
6
European Commission. Digital Services Coordinators