Digital Services Act: Obligations for Platforms, Marketplaces and Hosts

The Digital Services Act (DSA) is the European Union's main law for online intermediaries: services that transmit, cache or host information provided by users, including social media, marketplaces, app stores, forums, cloud hosting and many SaaS products with user content. It keeps the long-standing principle that intermediaries are not liable for user content they do not know about, but adds due diligence duties that scale with the type and size of the service.

The DSA has applied to all intermediaries since 17 February 2024, and to very large online platforms and search engines since 2023. In December 2025, the European Commission issued its first non-compliance decision, fining X 120 million euros. This guide explains the tiers, the obligations at each level, special rules for marketplaces, minors and advertising, enforcement and fines, and how product teams can build compliance into their platforms.

What is the Digital Services Act?

The DSA, Regulation (EU) 2022/2065, updates and replaces the liability rules of the 2000 e-Commerce Directive and adds a harmonised set of obligations for intermediaries across the EU. It sits alongside the Digital Markets Act, which targets gatekeepers' competitive practices. Its goals are a safer online environment, protection of fundamental rights including freedom of expression, and transparency and accountability for platforms.

Who must comply? The tiers

Tier	Examples	Obligations
Intermediary services	Internet access, DNS, messaging transport, CDNs (mere conduit and caching)	Baseline duties for all.
Hosting services	Cloud hosting, file sharing, SaaS storing user content	Baseline plus notice and action and statements of reasons.
Online platforms	Social networks, forums, marketplaces, app stores, sharing platforms	Hosting duties plus complaint handling, dispute settlement, trusted flaggers, dark pattern ban, ad and recommender transparency, minor protection, marketplace rules.
Very large online platforms and search engines	Services with 45 million or more average monthly active EU users, designated by the Commission	All of the above plus systemic risk assessment and mitigation, independent audits, data access for researchers, crisis response and additional transparency.

Micro and small enterprises are exempt from most online platform obligations unless designated as very large. The DSA applies to providers outside the EU if they have a substantial connection to the EU, such as a significant number of EU users or targeting of EU member states, and such providers must appoint a legal representative in the EU.

Is it mandatory or voluntary?

Mandatory for covered services. There is no certification, but very large platforms must undergo annual independent audits.

What counts as illegal content?

The DSA does not define what is illegal; that comes from EU and national law. Illegal content can include hate speech, terrorist content, child sexual abuse material, intellectual property infringement, illegal products, scams, unlawful discrimination and defamation, depending on the law of the member state concerned. Content can also be lawful but against a platform's own terms, such as spam or nudity rules, and the DSA requires those terms to be clear and applied diligently, objectively and proportionately. Platforms therefore need moderation processes that distinguish legal grounds from contractual grounds and record which one applies in each decision.

Liability exemptions

Intermediaries keep conditional exemptions from liability: mere conduit and caching services are not liable for transmitted information if they meet conditions; hosting services are not liable for stored content if they do not have actual knowledge of illegal content and act expeditiously to remove it once they do. The DSA adds a "good Samaritan" clause: carrying out voluntary own-initiative investigations to detect illegal content does not, by itself, remove the exemption. There is no general obligation to monitor content.

Obligations for all intermediaries

• Single points of contact for authorities and for users.
• A legal representative in the EU for providers established outside it.
• Clear terms and conditions describing content restrictions, moderation policies and tools, including algorithmic decision-making and human review.
• Annual transparency reports on content moderation, with small and micro enterprises exempted unless very large.
• Compliance with orders from authorities to act against illegal content or provide information.

Additional obligations for hosting services

• Notice and action: easy electronic mechanisms for anyone to notify illegal content, with timely, diligent and objective processing.
• Statements of reasons: clear explanations to users whose content is removed or restricted, or whose accounts are suspended, including the facts, legal or contractual ground, and redress options. Platforms submit statements to the Commission's transparency database.
• Notification of suspected criminal offences involving threats to life or safety to law enforcement.

Additional obligations for online platforms

• Internal complaint handling for moderation decisions, free of charge, for at least six months after the decision.
• Out-of-court dispute settlement through certified bodies.
• Trusted flaggers: priority handling of notices from designated entities.
• Measures against misuse, such as suspending users who frequently post manifestly illegal content.
• Dark patterns ban: interfaces must not deceive or manipulate users or impair their ability to make free and informed decisions.
• Advertising transparency: users must see that content is an ad, on whose behalf it is shown, who paid, and the main parameters used to target it; no targeted advertising based on special categories of personal data.
• Recommender system transparency: terms must explain the main parameters and any options to modify them.
• Protection of minors: appropriate measures for a high level of privacy, safety and security of minors, and no targeted advertising based on profiling when the platform is aware the user is a minor. The Commission published guidelines on protecting minors in 2025.

Online marketplaces

Platforms that allow consumers to conclude distance contracts with traders must collect and verify trader information before allowing them to sell (know your business customer), design interfaces so traders can provide required pre-contractual and product safety information, make reasonable efforts to check information and randomly check for illegal products, and inform consumers who bought illegal products when they become aware.

Very large online platforms and search engines

Services designated by the Commission as very large online platforms (VLOPs) or very large online search engines (VLOSEs) must assess systemic risks at least annually, such as dissemination of illegal content, negative effects on fundamental rights, civic discourse, elections, public health and minors, and adopt reasonable, proportionate and effective mitigation measures. They must undergo annual independent audits, provide at least one recommender option not based on profiling, maintain ad repositories, give vetted researchers access to data, appoint compliance officers, and pay a supervisory fee. The Commission supervises them directly.

Designing notice and action flows

A compliant reporting flow lets anyone, not just logged-in users, report content easily from where they see it. Notices should capture the reasons the content is illegal, its exact location such as a URL, the notifier's name and email (with exceptions for some offences), and a statement of good faith. The provider should confirm receipt, decide in a timely, diligent and objective manner, tell the notifier the outcome and the redress options, and record whether automated tools were used. Users whose content is affected receive a statement of reasons. Building these flows into a case management system with reason codes and audit trails makes transparency reporting and appeals straightforward.

Transparency reports

Intermediaries, other than micro and small enterprises, must publish reports at least annually, and online platforms at least every six months for some figures. Reports cover orders received from authorities, notices received and actions taken, own-initiative moderation, use of automated tools, complaints and their outcomes, and, for platforms, average monthly active users in the EU. The Commission has adopted templates to standardise reporting. Collecting the data automatically from moderation systems avoids a scramble at reporting time.

Enforcement and fines

Each member state designates a Digital Services Coordinator to supervise providers established there. The Commission has exclusive powers over VLOP and VLOSE obligations specific to them, and shares powers for other obligations. Fines can reach 6 percent of annual worldwide turnover for infringements, and 1 percent for supplying incorrect or misleading information; periodic penalty payments can reach 5 percent of average daily turnover. On 5 December 2025, the Commission adopted its first non-compliance decision, fining X 120 million euros over deceptive design of its verification checkmark, shortcomings in its advertising repository and failure to give researchers access to public data. X has appealed. Other investigations into large platforms continue.

How to comply, step by step

1. Classify your service: intermediary, hosting, online platform, marketplace, and whether you qualify as a micro or small enterprise.
2. Appoint points of contact and, if outside the EU, a legal representative.
3. Update terms and conditions to describe moderation clearly.
4. Build notice and action: reporting forms, triage queues, decisions and notifications.
5. Issue statements of reasons for moderation decisions and submit them to the transparency database if you are a platform.
6. Set up complaint handling and inform users of out-of-court options.
7. Review interfaces for dark patterns.
8. Add ad labels and targeting explanations, and stop sensitive-data and minor-profiling ads.
9. Implement trader verification if you run a marketplace.
10. Publish transparency reports on schedule.

Documentation you will need

• Service classification analysis.
• Terms and conditions and moderation policies.
• Notice handling logs and statements of reasons.
• Complaint records and outcomes.
• Transparency reports.
• Advertising and recommender documentation.
• Trader verification records for marketplaces.
• Risk assessments and audit reports for VLOPs.

Timeline and cost considerations

For a small or medium platform, the main work is building reporting, moderation, statements of reasons and appeal flows, updating terms, and reviewing interfaces, which typically takes a few weeks to a few months. Marketplaces add trader verification, which may require integrating identity and business verification services. Very large platforms face far larger costs for risk assessments, audits and data access. Ongoing costs include moderation staffing, tooling and reporting. Because the DSA already applies, gaps should be addressed now rather than planned for later.

Cloud and infrastructure providers

Cloud hosting and infrastructure providers are hosting services when they store customer content, but their position differs from consumer platforms: they usually cannot see or moderate individual items, and removing content may mean suspending a customer's whole service. The DSA's notice and action duties still apply, so providers need a process to receive notices, assess them proportionately, contact their customers and act where content is manifestly illegal. Clear acceptable use policies and customer escalation processes help.

Common mistakes

• Assuming B2B SaaS is out of scope when it hosts user content.
• Removing content without statements of reasons.
• Burying reporting tools deep in menus.
• Manipulative consent or cancellation flows that count as dark patterns.
• No EU legal representative for non-EU providers.
• Weak trader checks on marketplaces.

Best practices, tools and technologies

• Use a moderation case management system with timers, reason codes and audit logs.
• Template statements of reasons mapped to legal and contractual grounds.
• Integrate with the DSA transparency database API.
• Run dark pattern reviews in design.
• Automate transparency report data collection.
• Use identity and business verification services for marketplace sellers.

We build reporting flows, moderation queues, appeal processes, trader verification and transparency reporting into platforms through our online marketplace and web application development work.

How the DSA relates to other laws

Law	Relationship
GDPR	Applies to personal data processed in moderation, ads and recommender systems.
ePrivacy Directive	Cookie and tracking consent rules that interact with ad targeting.
Digital Markets Act	Competition-focused rules for gatekeepers.
India IT Rules 2021	India's intermediary due diligence regime, a useful comparison.
EU AI Act	Rules for AI systems, including transparency for some generated content.

Real-world example

An Indian-built B2C marketplace for handmade goods expands to EU buyers. As an online platform and marketplace, but not a micro enterprise, it appoints an EU legal representative, adds an illegal content reporting form on every listing, sends statements of reasons when listings are removed, offers an internal appeal process, verifies sellers' identity and business details before they can list, labels sponsored listings with targeting information, removes a countdown timer that pressured buyers, and publishes an annual transparency report.

Next steps

1. Classify your service tier.
2. Appoint contacts and an EU representative.
3. Build notice, action and appeals.
4. Fix ads, recommenders and interfaces.
5. Publish transparency reports.

Frequently asked questions

What is the Digital Services Act?

An EU regulation setting liability rules and due diligence obligations for online intermediaries, from hosting to very large platforms.

When did the DSA start to apply?

To very large platforms and search engines from 2023, and to all intermediaries from 17 February 2024.

Does the DSA apply to non-EU companies?

Yes, if they offer services to EU users with a substantial connection to the EU; they must appoint an EU legal representative.

Does the DSA apply to SaaS products?

If they store information provided by users, they are hosting services with notice and action and statements of reasons duties.

What is a statement of reasons?

An explanation given to a user when their content is removed or restricted, stating the facts, grounds and redress options.

Are small companies exempt?

Micro and small enterprises are exempt from most online platform obligations, but not from baseline and hosting duties.

What is a VLOP?

A very large online platform with 45 million or more average monthly active users in the EU, designated by the Commission.

What are the maximum fines?

Up to 6 percent of annual worldwide turnover.

Has anyone been fined under the DSA?

Yes. In December 2025, the Commission fined X 120 million euros; X has appealed.

Does the DSA ban targeted advertising?

No, but platforms cannot target ads using special categories of personal data or profile minors for ads.

Do cloud hosting providers have DSA duties?

Yes, as hosting services they need notice and action processes, though they often act through their customers rather than moderating individual items.