Privacy Laws
EU Digital Services Act (Regulation 2022/2065)
The EU framework for online intermediaries, including conditional liability exemptions, notice and action duties, and restrictions on targeted advertising to minors.
What it regulates
The DSA regulates intermediary services — anything that transmits information supplied by a recipient, or that hosts or caches that information. That covers hosting, online platforms, online marketplaces, search engines, and very large platforms and search engines subject to a separate tier of obligations.
It is a liability and process regulation. It is not a data protection instrument: the GDPR governs the processing of personal data, the DSA governs what an intermediary must do about content and about the operation of the service.
The structural change
The previous framework distinguished, on the basis of caching, between a mere conduit and a host. The DSA keeps a light tier of obligations for intermediaries that host content created by recipients, and adds to it:
- a notice-and-action procedure for content that appears to be illegal, replacing the previous idea of a general monitoring obligation
- a conditional exemption from liability for intermediaries who act within the specified conditions
- transparency obligations for content moderation decisions, recommender systems, and advertising
- a tiered structure in which very large platforms and search engines carry additional duties around systemic risks, independent audits, and data access for researchers
Provisions worth knowing
| Article | Subject |
|---|---|
| 2 | Scope and material scope |
| 3 | Definitions, including “platform” and “micro or small enterprise” |
| 4 | Conditions for the intermediary liability exemptions |
| 6 | Notice-and-action and out-of-court dispute settlement |
| 8 | Statements of reasons for content moderation |
| 15 | Transparency reporting on moderation |
| 24 | Obligations for platforms |
| 26 | Advertising transparency and restrictions on profiling-based advertising |
| 28 | Protection of minors, including a ban on profiling-based advertising to minors |
| 33 | Single point of contact for illegal content |
| 35 | Transparency on algorithms and ranking |
| 37 | Designation of very large online platforms and search engines |
| 40 | Data access for vetted researchers |
| 74 | Fines, up to 6% of worldwide annual turnover |
Criticism and open questions
The DSA has been contested on several grounds: the extension of the “over 45 million recipients” threshold to micro and small enterprises for some duties, the political composition of the enforcement boards, and whether obligations on recommender systems are operable without disclosing the systems themselves. These are matters of political judgement recorded in the legislative debate, not settled legal questions, and this entry does not take a position on them.
Sources
- Regulation (EU) 2022/2065 on EUR-Lex — the authoritative text.
- CELEX 32022R2065 — consolidated versions and corrigenda.
Claim labels
FACT
The Regulation was adopted on 19 October 2022 and entered into force on 16 November 2022.
FACT
It applies in full from 17 February 2024, with some provisions applying earlier.
FACT
Article 4(2) prohibits the presentation of advertising on the platform based on profiling as defined in Regulation 2016/679 when the user is known with reasonable certainty to be a minor.
FACT
Article 6 establishes a notice-and-action mechanism: providers must inform recipients of decisions restricting access and give access to an out-of-court dispute settlement body.
FACT
Article 33 and Article 34 require the handling of illegal content through a single point of contact, and Article 35 requires transparency reporting.
FACT
Article 37 and Articles 40 onwards establish additional obligations for providers of very large online platforms and very large search engines, including systemic risk assessment and independent audit.
FACT
Article 35 requires transparency information on a quarterly basis for recipients of ranking systems.
Sources
Last link check: 2026-09-27. A link check confirms reachability, not that every claim has been independently reviewed.