EU Digital Services Act FAQ

The DSA applies to providers of intermediary services offered to recipients in the EU where there is a substantial connection to the Union. The core service categories are mere conduit, caching, and hosting services.

The duties then build by service type. Hosting services store information provided by users. Online platforms are a subset of hosting services that also disseminate that information to the public at a user's request, such as marketplaces, app stores, and social networks. A public-comments feature that is minor and purely ancillary to another service may fall outside the online-platform definition. Very large online platforms and very large online search engines have additional obligations only after Commission designation.

The DSA has applied generally since 17 February 2024. It does not replace sector-specific or subject-specific EU rules on matters such as copyright, consumer protection, product safety, audiovisual media, terrorist content, or personal data; those rules can still determine whether content, a product, or an activity is illegal.

The liability exemptions for mere conduit, caching, and hosting are conditional defenses for third-party information, not exemptions from every DSA duty. The DSA also bars a general monitoring or active fact-finding obligation, while allowing specific legal orders and voluntary good-faith investigations. Keep liability analysis, due-diligence obligations, and the legality of the underlying content as separate questions.

An online platform or online search engine reaches the DSA very-large-service threshold when it has average monthly active recipients in the EU equal to or higher than 45 million. The Commission designates qualifying services as very large online platforms or very large online search engines.

Once designated, the service has four months after notification of the designation decision to comply with the enhanced DSA duties. Providers covered by Article 24(2) publish average monthly active recipient numbers for each service at least every six months; Article 19 can exclude qualifying micro and small online-platform providers from that publication duty while retaining Article 24(3) authority requests.

Hosting providers must provide easy-to-access electronic notice-and-action mechanisms for information that a person or entity considers illegal content. A sufficiently precise and substantiated notice can give the provider actual knowledge or awareness for the specific item of information concerned.

An Article 16 notice alleges that specific information is illegal under applicable EU or Member State law. A report that alleges only a breach of platform terms is not, on that basis alone, an illegal-content notice, although the provider may still handle it under its terms and moderation process.

When a hosting provider removes, disables access to, demotes, demonetises, suspends, terminates, or otherwise restricts content, service access, payments, visibility, or accounts because of alleged illegality or terms-and-conditions incompatibility, it must give the affected recipient a clear and specific statement of reasons where Article 17 applies. Online platforms covered by Article 24(5) must also send those decisions and statements of reasons to the Commission's public, machine-readable DSA Transparency Database without personal data; Article 19 can exclude qualifying micro and small providers from that platform-section duty.

Online platforms that let consumers conclude distance contracts with traders have trader-traceability duties. Before allowing traders to offer products or services, they must collect specified trader information, make best efforts to assess whether it is complete, design the interface so traders can provide required product and compliance information, and take steps when they become aware of illegal products or services.

Online platforms using recommender systems must explain the main parameters used by those systems and any options for recipients to modify or influence them. VLOPs and VLOSEs that use recommender systems must also provide at least one option that is not based on profiling.

Recipients can contest qualifying online-platform moderation decisions through internal complaint-handling systems. They can also use certified out-of-court dispute settlement bodies for content moderation disputes, and they retain access to courts.

Designated VLOPs and VLOSEs must identify, analyse, and assess systemic risks linked to their service design, functioning, algorithmic systems, and use. The DSA names systemic-risk areas including illegal content, fundamental rights, civic discourse and electoral processes, public security, gender-based violence, public health, minors, and serious effects on physical and mental well-being.

Those very large services must put in place reasonable, proportionate, and effective mitigation measures, maintain an internal compliance function, undergo independent audits at least annually, provide data access where required, publish transparency reports at least every six months, and make public risk assessment, mitigation, audit, and audit implementation reports within the Article 42 framework.

For penalties, Member States must set effective, proportionate, and dissuasive penalties for providers within their competence. The DSA caps maximum fines for obligation failures at 6% of annual worldwide turnover, caps certain information or inspection failures at 1% of annual income or worldwide turnover, and caps periodic penalty payments at 5% of average daily worldwide turnover or income per day. The Commission has separate enforcement powers for designated VLOPs and VLOSEs.