Regulation 2022/2065, the Digital Services Act (DSA), applies directly throughout the EU and imposes new duties on every provider of intermediary services online. If you run a platform, online store, hosting service, comment-enabled blog or another online service, check what you need to implement, the risks of failing to act and the possible penalties.
In this article, you will learn:
- What is the Digital Services Act (DSA)?
- What and whom does it cover?
- How does it relate to the GDPR?
- What duties does the DSA impose?
- What penalties may apply for failing to comply?
What is the Digital Services Act?
The Digital Services Act (DSA) is an EU regulation known as the constitution of the internet. It applies directly in every EU Member State and does not require separate implementation like, for example, the Omnibus Directive.
The DSA introduces new duties for entities providing intermediary services to users in the European Union.
Important note about Polish law
Although the DSA applies directly, Poland had to take additional legislative steps:
- Poland’s law implementing the DSA was passed in 2024.
- Poland’s Digital Services Coordinator is the President of the Office of Electronic Communications (UKE).
What does the DSA cover?
The DSA regulates intermediary services and online platforms, an area where new opportunities come with risks such as illegal content, disinformation and a lack of transparency toward users.
The duties under the DSA are proportionate to the scale and type of each provider’s activity.
Types of intermediary services covered by the DSA
- Mere conduit: transmitting information or providing access to a telecommunications network.
- Examples: virtual private networks (VPNs), internet exchange points and domain registries.
- Caching: transmitting information while automatically and temporarily storing data between transmission steps to make subsequent transmission more efficient at the request of other recipients.
- Examples: content delivery networks (CDNs).
- Hosting: storing information provided by a service recipient at their request.
- Examples: cloud-computing services, an online store with user reviews, discussion forums and blogs that allow comments.
Entities covered by the DSA
The DSA applies to:
- online marketplaces;
- social media platforms;
- content-sharing platforms;
- very large online platforms (VLOPs), such as Amazon, Facebook, Zalando and X;
- very large online search engines (VLOSEs), such as Google and Bing.
Who does the DSA apply to?
The DSA applies to all providers of intermediary services offered to service recipients in the European Union, regardless of where the provider is established.
If you are not established in the EU but provide intermediary services there, the DSA still applies to you.
Duties under the DSA
The scope of your duties depends on two factors:
- The type of intermediary service you provide: mere conduit, caching, hosting or a platform.
- The scale of your activity: the larger it is, the more requirements apply.
Duties increase in stages, from basic requirements shared by all providers to additional requirements for online platforms, especially VLOPs and VLOSEs.
When are you not an online platform?
The DSA provides an exclusion. You are not considered an online platform if the public dissemination of content is:
- only a minor and ancillary feature of your main service;
- inseparably linked to another service;
- objectively impossible to use separately for technical reasons;
- not used as a way to circumvent the DSA rules for platforms.
Example: a comment section on an online newspaper is ancillary to the main service, publishing news, so the newspaper does not become an online platform.
Note: storing comments on a social network is an online platform service, even if the comments are ancillary to posts.
What does this mean in practice?
If you run a blog that allows users to comment, you are a hosting provider under the DSA and must meet the duties assigned to that category.
Check which duties apply to your activity:
The DSA and the GDPR
The DSA complements the GDPR rules on protecting users’ data on online platforms.
The key prohibition is that online platform providers must not serve advertisements based on profiling that uses special categories of personal data under the GDPR, such as:
- sexual orientation;
- ethnic origin;
- religious beliefs.
If you run an advertising platform, check whether your ad-targeting model complies with both the DSA and the GDPR.
Penalties for DSA violations
Where can violations be reported?
- Users may complain to the Digital Services Coordinator in the relevant Member State.
- In Poland, the coordinator is the President of the Office of Electronic Communications (UKE).
- Appeals against UKE decisions go to the Court of Competition and Consumer Protection.
Financial penalties
| Type of violation | Penalty |
|---|---|
| Failure to comply with the DSA | up to 6% of annual worldwide turnover |
| Providing incorrect, incomplete or misleading information, failing to respond or correct it, or failing to submit to an inspection | up to 1% of annual worldwide turnover |
The financial risk is real and proportionate to the scale of your business. If you provide intermediary services, do not put off a DSA compliance review.
Frequently asked questions
What exactly is the DSA, and does it apply to companies outside the EU that serve users in the Union? The DSA, EU Regulation 2022/2065, is known as the constitution of the internet. It imposes duties on providers of intermediary services online, from hosting and marketplaces to very large search engines. It applies directly throughout the EU, without separate national implementation. If you provide intermediary services to users in the European Union, the DSA applies regardless of where you are established.
How can I tell whether my online service is hosting or an online platform under the DSA? Hosting under the DSA means storing information provided by a user at their request. It includes cloud services, discussion forums, blogs with comments and stores with reviews. Your service is considered an online platform unless public dissemination of users’ content is only a minor ancillary feature of your main service, inseparably linked to it and objectively impossible to use separately for technical reasons. The classification affects your duties: online platforms have more requirements than hosting providers.
Is an online store with customer reviews or a blog with comments covered by the DSA? Yes. An online store with user reviews and a blog that allows comments are hosting services under the DSA because they store content provided by users at their request. They must meet the duties assigned to hosting providers.
What duties does the DSA impose, and what determines how many requirements apply to my company? The scope depends on two factors: the type of intermediary service you provide, whether mere conduit, caching, hosting or a platform, and the scale of your activity. Duties increase in stages, from basic requirements shared by all providers to additional requirements for online platforms, especially VLOPs and VLOSEs. Failure to comply may result in a penalty of up to 6% of annual worldwide turnover, so it is worth identifying your category and reviewing compliance.
How does the DSA relate to the GDPR, especially for profiling-based advertising? The DSA complements the GDPR rules for protecting user data on online platforms. Online platform providers must not serve ads based on profiling that uses special categories of personal data under the GDPR, such as sexual orientation, ethnic origin or religious beliefs. If you run an advertising platform, check whether your targeting model complies with both the DSA and the GDPR.
