Overview of Regulation (EU) 2022/2065: The Digital Services Act (DSA)
The Digital Services Act (DSA) is a regulatory framework established by the European Union to govern digital services, ensuring accountability, transparency, and safety for users across online platforms. Enforced since November 16, 2022, the DSA replaces and updates the Electronic Commerce Directive 2000, harmonizing fragmented national laws such as Germany’s NetzDG, Austria’s Kommunikationsplattformen-Gesetz, and France’s Loi Avia. Its scope extends to all digital intermediaries—including social media platforms, online marketplaces, app stores, search engines, and hosting services—regardless of their geographic location, provided they serve users in the EU.
The DSA introduces a tiered regulatory approach based on platform size and risk levels. Basic obligations apply to all digital services, while enhanced duties target online platforms, and the most stringent requirements apply to Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) with over 45 million monthly active users in the EU.
The regulation was proposed by Ursula von der Leyen during her 2019 campaign for the European Commission presidency and was developed alongside the Digital Markets Act (DMA). It was formally submitted to the European Parliament and Council on December 15, 2020, following a public consultation and impact assessment conducted between July and September 2020. The DSA’s legislative process was led by Margrethe Vestager and Thierry Breton, with Christel Schaldemose serving as the European Parliament’s rapporteur.
Core Obligations and Transparency Requirements
The DSA imposes several key obligations on digital platforms to enhance transparency, accountability, and user protection. One of its central provisions is the requirement for platforms to disclose how their recommender and moderation algorithms function. This includes explaining the logic behind content removal decisions, advertiser targeting mechanisms, and the operation of algorithmic systems. The European Centre for Algorithmic Transparency was established to assist in enforcing these transparency rules, while the European Commission hosts a DSA Transparency Database where platforms must submit explanations for moderation actions.
Article 40 of the DSA mandates that platforms grant data access to independent researchers and non-profit organizations to identify and assess systemic risks, such as those posed by generative AI and deepfakes. As of October 29, 2025, the delegated act outlining procedures for data access has been implemented, allowing researchers to apply for access. Compliance with these requests is monitored by the Data Access Collaboratory, a collaborative project involving the European New School of Digital Studies and the Weizenbaum Institute in Germany.
Platforms must also adhere to a ‘notice-and-action’ framework, ensuring that content moderation decisions respect fundamental rights and provide users with redress mechanisms. This includes allowing users to appeal content removal decisions through internal complaint systems or external out-of-court dispute settlement (ODS) bodies. As of 2024, nine ODS entities are certified in the EU, including ADROIT and Appeals Centre Europe, which review decisions from platforms like Facebook, Instagram, TikTok, and YouTube without charging users for basic services.
Risk Management, Enforcement, and Protections for Minors
The DSA requires platforms to implement comprehensive risk management systems, particularly for Very Large Online Platforms (VLOPs) and VLOSEs. These systems must identify, assess, and mitigate risks such as disinformation, illegal content, and harms arising from generative AI technologies. Non-compliance with these requirements can result in fines of up to 6% of a company’s global annual turnover, with additional daily penalties of up to 5% of average daily turnover for persistent violations.
In cases of severe harm—such as threats to users’ safety or life—the Commission may request the temporary suspension of a platform’s services. The regulation also introduces specific protections for minors, requiring platforms accessible to children to ensure high levels of privacy, safety, and security. Guidelines adopted in 2025 by the European Commission outline measures such as age verification, privacy-by-default settings, and tools to mitigate exposure to harmful content.
The DSA’s provisions for minors are further reinforced by the proposed EU Kids Act, expected to introduce additional safeguards such as mandatory age verification for new accounts and enhanced parental control tools.
Scope, Compliance, and Global Impact
The DSA applies to all digital intermediaries operating in the EU, including those based outside the union. This extraterritorial reach ensures that global platforms—such as Facebook, Twitter, TikTok, and YouTube—must comply with EU regulations if they serve EU users. The regulation’s graduated obligations mean that smaller platforms face lighter burdens, while VLOPs and VLOSEs must undergo rigorous audits and transparency measures. This approach aims to foster a single market for digital services while maintaining proportionality in regulatory demands.
Compliance with the DSA is overseen by the European Commission, which collaborates with national authorities to enforce the rules. The regulation’s enforcement framework includes periodic audits, reporting requirements, and penalties for non-compliance, ensuring that platforms adhere to their obligations. The DSA’s impact extends beyond the EU, as its stringent requirements may influence global standards for digital service regulation, particularly in areas like algorithmic transparency and content moderation.
The DSA’s focus on systemic risk assessment and mitigation—including risks from generative AI and deepfakes—positions it as a forward-looking regulation. By mandating transparency in algorithmic decision-making and granting independent researchers access to platform data, the DSA aims to create a more accountable digital ecosystem. Its provisions for user redress, dispute resolution, and minor protections further solidify its role in shaping a safer and more transparent online environment.
Required actions
- Explain the main parameters of recommender systems and offer at least one option not based on profiling (very large platforms) - Assess and mitigate systemic risks yearly, including risks from generative AI features and manipulated media, and submit to independent audit - Publish transparency reports on automated content moderation, including accuracy and error rates - Label deepfakes and give researchers access to platform data