TLDR:
The Digital Services Act (DSA) is EU regulation (Regulation 2022/2065, fully applicable from February 2024) governing online intermediaries—from web hosts to large social platforms and search engines. The DSA creates a tiered set of obligations around content moderation, transparency, user protection, and platform accountability, with strictest requirements for Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs).
Tiered Obligations
Obligations scale with platform size and risk: intermediary services have basic transparency and notice obligations; hosting services have additional notice-and-action mechanisms; online platforms add complaint handling and trusted flagger systems; VLOPs and VLOSEs (designated by reaching 45M EU users) face the strictest obligations—including systemic risk assessments, independent audits, transparent recommender system controls, additional access rights for researchers and competent authorities, crisis response mechanisms, and detailed transparency reports.
Major Designated VLOPs/VLOSEs
The European Commission has designated 20+ VLOPs/VLOSEs including AliExpress, Amazon Store, Apple App Store, Booking.com, Facebook, Google Play, Google Search, Instagram, LinkedIn, Pornhub, Snapchat, TikTok, X (Twitter), Wikipedia, YouTube, and Zalando. These platforms have been subject to formal Commission proceedings for various alleged violations since DSA full application, including significant cases against X for content moderation failures.
Compliance for Smaller Platforms
Even small online platforms face DSA obligations: terms of service transparency, notice-and-action mechanisms for illegal content, complaint handling, user-facing transparency about content removal, and protection of minors. Specific obligations include reporting illegal content to authorities under certain conditions and clear, accessible legal representation in the EU. Penalties scale up to 6% of annual global turnover. For founders building EU-facing platforms, DSA compliance should be designed from product inception rather than retrofitted, especially around content moderation systems and user notification flows.