Digital Services Act

Rules

New obligations on platform companies

The DSA is meant to "govern the content moderation practices of social media platforms" and address illegal content. It is organised in five chapters, with the most important chapters regulating the liability exemption of intermediaries (Chapter 2), the obligations on intermediaries (Chapter 3), and the cooperation and enforcement framework between the commission and national authorities (Chapter 4).

The DSA proposal maintains the current rule according to which companies that host others' data become liable when informed that this data is illegal. This so-called "conditional liability exemption" is fundamentally different from the broad immunities given to intermediaries under the equivalent rule ("Section 230 CDA") in the United States.

The DSA applies to intermediary service providers that offer their services to users based in the European Union, irrespective of whether the intermediary service provider is established in the European Union.

In addition to the liability exemptions, the DSA introduces a wide-ranging set of new obligations on platforms, including some that aim to disclose to regulators how their algorithms work, while other obligations aim to create transparency on how decisions to remove content are taken and on the way advertisers target users. The European Centre for Algorithmic Transparency was created by the European Commission to aid the enforcement of this. The European Commission also hosts a DSA Transparency Database for platforms to submit explanations for their moderation decisions as required under the Act.

Article 40 of the DSA requires platforms to grant data access to researchers and non-profit organisations in order to detect, identify and understand systemic risks in the European Union. As of 29 October 2025 the delegated act specifying procedures for data access came into force and researchers can now apply. Implementation of Article 40 and compliance with data access requests is being monitored by the Data Access Collaboratory, a joint project of the European New School of Digital Studies at the European University Viadrina and the Weizenbaum Institute in Germany.

A December 2020 Time article said that while many of its provisions only apply to platforms which have more than 45 million users in the European Union, the Act could have repercussions beyond Europe. Platforms including Facebook, Twitter, TikTok, and Google's subsidiary YouTube would meet that threshold and be subjected to the new obligations.

A 16 November 2021 Internet Policy Review listed some of the new obligations, including mandatory "notice-and-action" requirements – for example, respect for fundamental rights, mandatory redress for content removal decisions, and a comprehensive risk management and audit framework.

Companies that do not comply with the new obligations risk fines of up to 6% on their global annual turnover. In addition, the Commission can apply periodic penalties up to 5% of the average daily worldwide turnover for each day of delay in complying with remedies, interim measures, and commitments. As a last resort measure, if the infringement persists and causes serious harm to users and entails criminal offences involving threat to persons' life or safety, the Commission can request the temporary suspension of the service.

Protection of minors

The Digital Services Act requires online platforms accessible to minors to maintain a high level of privacy, safety, and security. In 2025, the European Commission adopted guidelines on the protection of minors under the DSA, which include recommendations on age verification, privacy by default, harmful content, and measures to mitigate risks to minors online. In September 2026, the European Commission was preparing the proposed EU Kids Act, which would introduce additional measures to protect children online. According to Reuters, the proposal would require social media and video-sharing platforms to verify users' ages when opening new accounts. Additionally, companies would be required to provide parental control tools and mechanisms for reporting harmful content. The details were still subject to change, and the draft would need to be negotiated with EU member states and the European Parliament before it could become law.

New rights for users

Users can contest moderation decisions by online platforms restricting their accounts or sanctioning their content in several ways. This right also applies to notices of illegal content that were rejected by the platform. According to the DSA, users may appeal through the internal complaint-handling system of platforms. Platforms are required to promptly review their decisions.

Out-of-court dispute settlement bodies

The DSA also gives users the right to turn to out-of-court dispute settlement (ODS) bodies, if they think a decision by an online platform was wrong. Users may select any entity that has been certified as a dispute settlement body in the EU for their type of dispute and request a review of a platform's content moderation decision. There are currently nine ODS entities certified in the EU. They operate on a cost-covering principle and generally do not charge any fees to consumers unless there is a clear indication of abuse. The first ODS body certified under the DSA in the European Union was ADROIT, a Maltese ODS serving users of all relevant platforms. Another relevant out-of-court dispute settlement body is Appeals Centre Europe (initially funded by Meta's Oversight Board Trust), which reviews decisions by Facebook, Instagram, Tiktok, Pinterest, Threads, Google Maps and YouTube at no cost for users.

For the user, dispute settlement will usually be available free of charge or at a low cost. If the body settles the dispute in favour of the user, the online platform must bear all the fees. Users are advised to review information on applicable fees on the website of the respective body before lodging a request for dispute settlement. Dispute settlement bodies do not have the power to impose a binding settlement of the dispute on the parties, but platforms and users are required to engage with them in good faith.

Legislative history

The European Commission submitted the DSA alongside the Digital Markets Act (DMA) to the European Parliament and the Council on 15 December 2020. The DSA was prepared by von der Leyen Commission members Margrethe Vestager (Executive Vice President of the European Commission for A Europe Fit for the Digital Age) and Thierry Breton (European Commissioner for Internal Market).

The Digital Services Act builds in large parts on the non-binding Commission Recommendation (EU) 2018/314 of 1 March 2018 when it comes to illegal content on platforms. However, it goes further in addressing topics such as disinformation and other risks especially on very large online platforms. As part of the preparatory phase, the European Commission launched a public consultation on the package to gather evidence between July and September 2020. An impact assessment was published alongside the proposal on 15 December 2020 with the relevant evidence base.

The European Parliament appointed Danish Social Democrat Christel Schaldemose as rapporteur for the Digital Services Act. On 20 January 2022 the Parliament voted to introduce amendments in the DSA for tracking-free advertising and a ban on using a minor's data for targeted ads, as well as a new right for users to seek compensation for damages. In the wake of the Facebook Files revelations and a hearing by Facebook Whistleblower Frances Haugen in the European Parliament, the European Parliament also strengthened the rules on fighting disinformation and harmful content, as well as tougher auditing requirements.

The Council of the European Union adopted its position on 25 November 2021. The most significant changes introduced by the Member States were to entrust the European Commission with the enforcement of the new rules on VLOPs and VLOSEs, in the wake of allegations and complaints that the Irish Data Protection Commissioner was not effectively enforcing the EU's data protection rules against many platform companies domiciled in Ireland.

With Russia using social media platforms to spread misinformation about the 2022 Russian invasion of Ukraine, European policymakers felt a greater sense of urgency to move the legislation forward to ensure that major tech platforms were transparent and properly regulated, according to The Washington Post. On 22 April 2022, the European Parliament and the Council reached a deal on the Digital Services Act in Brussels following sixteen hours of negotiations.

On 5 July 2022, the European Parliament approved both the DSA and the DMA. The DSA received 539 votes in favour, 54 votes against, and 30 MEPs abstained. Following this, on 4 October 2022, the Council convening in the ECOFIN configuration voted unanimously to approve the DSA. The DSA was signed into law on 19 October 2022 and was published in the Official Journal of the European Union on 27 October 2022. It came into force on 16 November 2022. Most services were given 15 months to comply with its provisions (until 17 February 2024). However, VLOPs and VLOSEs, after their designation as such, had only four months to comply (until 23 August 2023).

Influence of the European Court of Human Rights

The DSA was passed alongside the Digital Markets Act and the Democracy Action Plan. The latter of these is focused on addressing the nuanced legal interpretation of free speech on digital platforms, a fundamental right that has been extensively guided by the European Court of Human Rights (ECtHR) and the European Convention on Human Rights. Accordingly, the Democracy Action Plan, and subsequently the DSA, were strongly influenced by the Delfi AS v. Estonia and Magyar Tartalomszolgáltatók Egyesülete and Index.hu Zrt v. Hungary ECtHR cases, which outlined a framework for assessing intermediary liability on digital platforms.

In Delfi AS v. Estonia, the ECtHR applied proportionality analysis when considering whether the Estonian courts' decision to hold the online platform Delfi liable for hate speech posted by its users was a proportionate restriction on Delfi's right to freedom of expression. The court found that, given the serious nature of the hate speech, the Estonian courts' actions were justified to protect the rights of others. In other words, the ECtHR upheld the liability of online platforms for hate speech posted by their users, underlining that platforms could be expected to take proactive steps to control content when there is a clear risk of harm from unlawful comments. This case highlighted the responsibilities of platforms to prevent the spread of harmful content.

On the other hand, the MTE and Index.hu v. Hungary case illustrated the nuanced limits of freedom of speech on digital platforms. In its application of proportionality analysis, the ECtHR found that the Hungarian courts had failed to strike a fair balance between protecting reputation and ensuring freedom of expression. The Hungarian courts imposed strict liability on the platforms for user comments that were offensive but did not constitute hate speech, constituting a disproportionate interference in the platforms' right to freedom of expression. The ECtHR ruled that imposing strict liability on platforms for user comments, without consideration of the nature of the comments or the context in which they were made, could infringe on freedom of expression. This judgment emphasized the need for a balance between protecting reputation and upholding free speech on digital platforms.

These decisions by the ECtHR provided critical legal precedents that shaped the EU's decision-making process on the framework of the DSA. In particular, the DSA drew from the ECtHR's distinction between different types of illegal content, as well as its proportionality analysis in both cases, by incorporating nuanced rules on intermediary liability and ensuring that measures taken by platforms do not unreasonably restrict users' freedom of expression and information.

Enforcement

The DSA establishes a two-tiered "hybrid enforcement framework" where the rules are enforced both by the European Commission and the national authorities in each EU member state. The Commission is primarily responsible for the enforcement in relation to designated very large online platforms (VLOPs) and very large online search engines (VLOSEs), while the competent national authorities enforce the DSA rules on other intermediary service providers that have been established in their respective territories.

Each member state has to designate a Digital Services Coordinator (DSC), an independent authority that is principally responsible for the DSA enforcement in the member state, and they may also appoint additional national authorities to assist the DSCs in specific tasks. The DSA establishes a number of co-operation mechanisms between the DSCs, including joint investigations. The Commission, DSCs and other national compentent authorities form the European Board for Digital Services (EBDS) which is tasked to coordinate and support DSA enforcement work. However, the EBDS may not take binding decisions.

Similar hybrid enforcement frameworks have been created in other policy fields as well, notably in EU competition policy.

Designation of VLOPs and VLOSEs

Under the DSA the highest number of rules apply to very large online platforms (VLOPs) and very large online search engines (VLOSEs) that are defined respectively as online platforms and search engines with more than 45 million monthly active users in the European Union, corresponding to approximately 10% of the EU population. Platforms are obligated to publicly report the number of active users and to update them at least every six months. The VLOPs and VLOSEs are designated by the Commission on this basis.

On 25 April 2023, the European Commission designated the first 19 VLOPs and VLOSEs under the DSA. The first group of platforms was required to comply from 25 August 2023. Three further platforms, all of them providing adult content, were added on 20 December 2023. Online retailers Shein and Temu were designated as VLOPs in April and May 2024, respectively, while the adult content platform XNXX was added in July 2024.

In July 2023, Amazon and Zalando both initiated proceedings in the General Court challenging the Commission designations, claiming unequal treatment compared to other large retailers, and that their core business models are retail not distributing third party content/products. Zalando argued the criteria and methodology lacked transparency, for instance in how it counts active users, while Amazon said VLOP rules were disproportionate for its business model and asked to be exempted from transparency around targeted ads. The General Court dismissed both actions for annulment in late 2025. As of November 2025, Zalando has appealed the General Court judgement to the Court of Justice.

Enforcement actions on VLOPs and VLOSEs

When the European Commission suspects infringement of the DSA by a VLOP or VLOSE it may start an investigation. The Commission is empowered to send information requests, order access to data or algorithms, and to conduct inspections on the premises of the VLOP or VLOSE under investigation. The Commission is obligated to give the concerned VLOP or VLOSE the opportunity of being heard on their preliminary findings and on intended measures to be taken before the Commission may adopt any decision.

As of November 2025, the European Commission has started 14 investigations into DSA compliance of VLOPS or VLOSEs. The platforms under ongoing or finished investigations by the Commission include AliExpress, Facebook, Instagram, Temu, TikTok, and X, as well as a number of pornographic platforms.

On 5 August 2024, the Commission accepted commitments by ByteDance to permanently withdraw TikTok Lite from the EU markets. The platform alternative included a "task and reward" feature letting users earn points by using the app, where the points could be exchanged for Amazon vouchers. The Commission's concern was that the feature could be addictive for minors, negative affecting their mental health. Formally, the commitments do not mean that TikTok would have been found to have breached the DSA but in case ByteDance fails to comply with them the company could be quickly sanctioned.

On 5 December 2025, the Commission issued its first non-complience decision and fine under the DSA. The Commission found that X had breached DSA's rules on deceptive design prohibition, ad transparency, and researcher data access, leading to a fine of €120 million ($140 million) and an order to end the infringements within certain time periods. The decision was based on three findings of infringements by the Commission:

1. X Premium's blue checkmarks for "verified accounts" constituted a "deceptive design" as in reality X did not meaningfully verify the account holders;
2. X's advertisement repository was missing key information, such as contents, topics and payers of advertisements, and accessing it involved excessive delays; and
3. X imposed unnecessary barriers for researchers to access the platform's public data.

According to Euronews, the total fine of €120 million consisted of €45 million for the first finding, €35 million for the second, and €40 for the third. X may appeal the decision before the EU General Court.

Reactions

Reactions to the Digital Services Act have been mixed, with several academics, journalists, and human rights organizations welcoming an effort to regulate platforms and create consumer protections for its users. Others do not see the laws as going far enough, while the companies regulated by the laws and right-wing and libertarian politicians and journalists criticize the extent of its regulation. Prior to its implementation, some academics have expressed concerns that the Digital Services Act might be too rigid and prescribed, excessively focused on individual content decisions or vague risk assessments. The European Federation of Journalists asked EU legislators to further increase the transparency of platforms' recommendation systems via the DSA. Mike Masnick criticised the act for not including provisions that would have required a court order for the removal of illegal content.

The DSA was welcomed by some EU media. In January 2022, the editorial board of The Washington Post stated that the U.S. could learn from these rules, while Frances Haugen stated that it could set a "gold standard" of regulation worldwide. Tech journalist Casey Newton has argued that the DSA will shape US tech policy. Mike Masnick of Techdirt praised the DSA for ensuring the right to pay for digital services anonymously.

Civil Society organisations such as Electronic Frontier Foundation have called for stronger privacy protections. Human Rights Watch has welcomed the transparency and user remedies but called for an end to abusive surveillance and profiling. Amnesty International has welcomed many aspects of the proposal in terms of fundamental rights balance, but also asked for further restrictions on advertising. Advocacy organisation Avaaz has compared the Digital Services Act to the Paris Agreement for climate change.

Following the 2023 Hamas-led attack on Israel, Thierry Breton wrote public letters to X, Meta Platforms, TikTok, and YouTube on how their platforms complied with the DSA regarding content related to the conflict and upcoming elections. The Atlantic Council's Digital Forensic Research Lab reported that Breton's letters did not follow DSA processes, and digital rights group Access Now criticised Breton's letters for drawing a "false equivalence" between illegal content and disinformation.

Tech companies have frequently criticized the Digital Services Act (DSA) for what they consider to be burdensome regulations and lack of clarity. They have also faced accusations of lobbying to weaken some of the DSA's more stringent provisions, particularly those related to bans on targeted advertising. Notably, Google CEO Sundar Pichai issued a high-profile apology to EU Commissioner Thierry Breton after a leaked internal document revealed Google's 60-day strategy to lobby against the DSA, including efforts to enlist U.S. allies to oppose Breton's regulatory push.

US politicians charged that the legislation unfairly targets US-based companies and, in 2025, several officials in the Trump administration, most notably JD Vance, began alleging the DSA was being used for "censoring free speech and targeting political opponents". His statements were contested by, among others, Michael McFaul, formerly U.S. ambassador to Russia, who told Politico Vance's remarks were "insulting" and "just empirically not true". Another critic of Vance's speech was the German Defense Minister at that time, Boris Pistorius, who called Vance's remarks about Europe "not acceptable". Libertarian professor Marcello Ferrada de Noli expressed concern that the DSA could enable censorship if regulations permit the classification of journalistic or dissident critiques of European Union leadership as hate speech.

On 23 December 2025, United States secretary of state Marco Rubio sanctioned former commissioner Thierry Breton, who led the drafting of the legislative proposal. Despite the fact that Breton left his office in September 2024, Breton's U.S. assets are frozen, and he is persona non grata in the United States, thus forbidden to enter the territories of the United States by the Trump administration, "over what it said was 'censorship' and coercion of US social media platforms". The Guardian reported that "the sanctions are being seen as the latest attack on European regulations that target hate speech and misinformation".

In January 2026, Polish president Karol Nawrocki refused to sign, thus effectively vetoing, a bill that would designate a responsible authority for DSA enforcement in Poland. Nawrocki said regarding his decision, "The most effective way to take away freedom is not by banning speech, but by imposing a single, officially accepted version of reality", and that "Orwell’s Ministry of Truth is a warning symbol."

In February 2026 Finnish parliamentarian Päivi Räsänen condemned the act as "European style censorship", where "anyone, anywhere could find themselves silenced for peacefully expressing their faith or opinion."

Politico reported in February 2026 that as a result of outside pressures, DSA workshops have become closed-door events at the request of companies. Prabhat Agarwal, the official heading the European Commission's DSA enforcement team, described their work as "more adversarial" than before and stated his team had begun using disappearing messages on Signal.

Impacts

Feature and content removal

After the first round of the 2024 Romanian presidential election was invalidated due to reports allegedly showing Russian involvement on TikTok in favor of Călin Georgescu, an investigation was conducted to determine whether TikTok had breached the DSA.

In August 2024, TikTok agreed to withdraw its TikTok Lite rewards feature after it was investigated under the DSA due to concerns about its "addictive effect", especially for children.

A 2024 study of deleted Facebook and YouTube comments by the Future of Free Speech think tank at Vanderbilt University suggested that "platforms, pages, or channels may be over-removing content to avoid regulatory penalties" under the DSA.

Outside the EU

The Washington Post wrote in 2023 that tech companies may apply features instituted to comply with the DSA to countries outside of the EU, and that researchers have argued that the DSA could provide a framework for the United States to impose stricter regulations on tech companies. The Economist wrote in 2023 that the Brussels effect, whereby social media platforms implement EU regulations globally to save costs, "is far from guaranteed" with the DSA due to tech companies being unwilling to "[lose] sovereignty over their digital territories everywhere".

Among legal academics, Dawn Nunziato of the George Washington University argued in 2022 that the DSA "will further instantiate the Brussels effect, whereby EU regulators wield powerful influence on how social media platforms moderate content on the global scale". Suzanne Vergnolle of the Conservatoire national des arts et métiers stated her belief in 2023 that the DSA would have a Brussels effect similar to that of the General Data Protection Regulation, but that "it's going to take years". Martin Husovec of the London School of Economics and Jennifer Urban of the University of California, Berkeley wrote in 2024 that "the chances of spontaneous voluntary implementation beyond the EU's borders for four key parts of the DSA – content moderation procedures, transparency and governance obligations, and risk management rules – seem modest."

Similar legislation

The 2023 Brazilian Fake News Bill, a proposed new social media regulation framework introduced in the National Congress, heavily referenced the DSA and contained similar provisions. Switzerland initiated the process to pass a law similar to the DSA called Neues Gesetz über Kommunikationsplattformen und Suchmaschinen (New law regarding Communication Platforms and Search Engines); a public consultation was conducted from October 2025 to February 2026.