What the EU Digital Services Act Changes Online

The Digital Services Act does not make platforms liable for every bad post a user uploads. It sets rules for how online intermediaries in the EU handle illegal content, advertising, complaints, transparency, and systemic risks.

The DSA entered into force in November 2022. Its obligations started applying in stages and, from 17 February 2024, applied broadly across the EU. This is a high-level overview, not legal advice; the exact duties depend on the service and can be clarified by later guidance and enforcement.

The rules scale with the service

The DSA covers intermediary services such as internet access, hosting, marketplaces, app stores, social networks, and content-sharing platforms. A company does not escape the rules simply because it is based outside the EU if it offers its service to people in the EU.

Obligations are layered. A simple intermediary has fewer duties than an online platform. Very Large Online Platforms and Very Large Online Search Engines—services designated at the EU threshold of at least 45 million average monthly recipients—face the most extensive oversight.

Micro and small businesses are exempt from some platform obligations, although not every part of the law. “We are small” is therefore not a complete compliance assessment.

Content moderation needs a process

Hosting services need a way for people to report allegedly illegal content. Platforms must explain certain moderation decisions and provide routes for complaints. The DSA also adds transparency reporting around moderation and the use of automated systems.

It does not define one universal category of illegal content. Whether something is illegal comes from EU or national law; the DSA mainly defines how services respond.

That distinction matters. The law is often summarised as a content-removal act, but notice, explanation, redress, and due process are a large part of the machinery.

Advertising becomes less opaque

People should be able to recognise an advert, identify who paid for it, and understand the main parameters used to decide why they saw it. The DSA prohibits targeted advertising based on profiling with special-category personal data and restricts profiling-based advertising to minors.

Online platforms must also explain the main parameters of recommender systems. Very large platforms need to offer at least one recommender option that is not based on profiling.

Dark patterns—interfaces designed to trick or manipulate decisions—are also restricted where the practice is covered by the DSA rather than another consumer or data-protection law.

Marketplaces have extra work

Online marketplaces need information that helps identify traders before those traders can sell to EU consumers. Their interfaces should also make it possible for traders to provide required product and safety information.

If a marketplace learns that an illegal product or service was sold through it, further notification duties may apply. This turns “know your business customer” from a nice trust feature into part of the compliance system.

Very large services must examine systemic risks

Designated VLOPs and VLOSEs must assess and mitigate risks connected with illegal content, fundamental rights, elections, public security, gender-based violence, minors, and physical or mental well-being. They also face independent audits, data-access obligations, and closer supervision by the European Commission.

Penalties can reach 6% of worldwide annual turnover for non-compliance. National Digital Services Coordinators enforce much of the framework, while the Commission has a direct role for the largest designated services.

A sensible starting checklist

If a service may be covered, I would start with four questions:

1. What kind of intermediary is it under the DSA?
2. Which exemptions and additional layers apply at its size?
3. Can users report decisions, understand them, and challenge them?
4. Can the company produce evidence for its moderation, advertising, trader, and risk processes?

The DSA is too broad for a generic checklist to replace legal analysis. Its practical direction is clearer: platforms need to explain more of what they do, give users more routes to challenge decisions, and accept more responsibility as their reach and risk grow.