What is the EU Digital Services Act (DSA)?

The DSA (Regulation (EU) 2022/2065) is an EU law that covers rules on illegal content, systemic risks, and platform accountability in the online environment.

It is a process-based law that sets standards for how platforms handle content moderation and risk management instead of specifying content results. The DSA uses an asymmetric structure by applying added obligations to larger services regarding fundamental rights, public security, and well-being.

The DSA covers many types of online intermediary services, and which rules apply depend on the service’s size and function – there isn’t a single standard for all. The law uses a tiered system.

Here’s what this looks like in practice:

• Intermediary services, such as hosting or network conduits, have a set of baseline requirements.
• Online platforms and marketplaces are assigned some additional obligations for user due process and transparency.
• Pour VLOPs and VLOSEs – Very Large Online Platforms and Search Engines with more than 45 million monthly EU users, after being designated, there are further specific requirements.

With this framework, regulatory measures are intended to scale according to influence or size, and most micro and small companies are exempt from many of the extended obligations.

The DSA outlines procedural responsibilities that online platforms must follow. These platforms need to provide accessible notice-and-action tools, maintain processes for addressing complaints, give users information on moderation approaches, and process reports from trusted flaggers in line with set timelines.

Key requirements include:

• User-accessible notice-and-action systems (Article 16).
• Internal operations for managing and evaluating complaints (Article 20).
• Explanations regarding moderation outcomes, as well as information about content-related terms and management.
• On-schedule handling of notices received from trusted flaggers (Article 22).
• Procedures applied to the handling of illegal content.

For platforms classified as VLOPs or VLOSEs – services with more than 45 million users in the EU and a formal designation from the European Commission – a stringent set of obligations is in place, and they must comply within four months of designation.

The main requirements for these services are as follows:

• Each year, they must carry out reviews to identify and consider risks related to illegal content, fundamental rights, the integrity of elections, gender-based violence, and child safety.
• After assessing risks, the platforms introduce measures designed to address their findings as stipulated by regulation.
• These platforms also undergo independent audits that look at how they fulfill regulatory criteria.
• They are expected to periodically publish information on their operational practices and policies, particularly in areas involving regulatory oversight.
• Under defined rules, research professionals can access and review designated datasets provided by the platforms.

Regulatory supervision for these services is conducted directly by the European Commission.

Under the DSA, platforms provide notice-and-action systems and process reports from authorized flaggers about content identified as illegal, while ensuring user protection through procedural rights, transparency, and measures against unreasonable removals.

Established procedures lay out how flagged items are managed, and users receive basic explanations regarding moderation outcomes. Notices submitted by trusted flaggers recognized by Digital Services are prioritized. The law is designed to weigh the effective removal of illegal content against risks to fundamental rights such as freedom of expression and access to information.

The DSA introduces guidelines for platforms, intended to clarify certain moderation and advertising procedures. Platforms are required to explain their moderation processes, provide regular transparency reports, and reveal information about how their recommendation systems operate.

For VLOPs, these DSA requirements include additional details:

• Ad disclosures contain information on who funded the advertisement and the criteria used for targeting.
• Personalized advertising, when it uses sensitive categories of data or involves minors, is restricted.

Responsibility for applying the DSA sits with both national Digital Services Coordinators, which are selected by each country, and the European Commission for VLOPs and VLOSEs. Each Member State designates its own authority; for instance, Ireland has named Coimisiún na Meán as its Digital Services Coordinator.

Penalties are intended to be effective, proportionate, and dissuasive, and Member States set their own specific penalty rules.

The DSA sets out procedures and expectations for user security, data handling, and business practices across the EU, while raising compliance costs – especially for very large platforms.

For users:

• Responsibilities related to safety are modified based on changes in platform procedures.
• Updates about content management and moderation are provided in company documentation or reports.
• Steps for users to submit issues or complaints are more specifically described in platform materials.

Pour les entreprises :

• Requirements are adjusted in an effort to align digital operations from one EU member state to another.
• Compliance demands vary according to business size; very large platforms may see higher operational costs and administrative burdens.
• Companies might need to review obligations as their scale changes, with some streamlined options available to smaller enterprises.

For digital innovation:

• A somewhat steadier environment as harmful practices decrease and market confidence develops, though compliance pressures remain.
• Companies looking to expand or enter the field will need to incorporate new compliance elements into planning.

The DSA operates alongside the Digital Markets Act (DMA) and the GDPR, creating a framework where each law focuses on a separate set of issues.

There are certain topics where legal requirements from these regulations intersect, including rules around data access, information transparency, and targeted advertising. For example, the DSA contains restrictions on the use of personal data for advertising purposes, particularly data collected from minors or relating to special categories. When platforms transfer data to comply with the DSA, the principles of the GDPR, such as data minimization, continue to apply. Because of these overlaps, companies need to evaluate how their activities align with each regulation so that compliance with one does not create issues under another.

The DSA entered into force on 16 November 2022 and became generally applicable to all online intermediary services on 17 February 2024, with VLOPs and VLOSEs complying earlier.