EU European Tech Regulation

EU Digital Services Act

The European Commission has stopped writing rules and started redesigning products. We advise clients on both.

Cooley advises dozens of technology companies on the EU Digital Services Act (DSA), including a range of designated very large online platforms (VLOPs) and very large online search engines (VLOSEs) This includes services under active European Commission investigations. We also act for services that sit below the designation threshold and answer instead to national digital services coordinators (DSCs), where we have experience across multiple member states. We help clients build compliance programmes that survive scrutiny, and we defend them when that scrutiny arrives.

Why Cooley

We act for the companies the regime was written about.

Depth across designated platforms means we know how the Commission approaches these issues in practice, not only how the recitals read.
We work at both layers.

Advising VLOP/SEs and non-designated services alike means we understand where the Commission and the DSCs converge and where they diverge – and we can tell a growing client what changes when designation arrives, before it does.
We are technology lawyers first.

Our clients build the products under scrutiny. We understand recommender systems, moderation pipelines, age assurance stacks and generative AI features well enough to give advice that engineering teams can implement – which matters when the remedy is a design change.
Compliance and defence in one team.

The lawyers who help design a compliance programme are the ones who defend it. That continuity matters when a regulator asks why a decision was made two years ago.
One regime among many.

Sitting within Cooley’s European tech regulation practice, we advise on the DSA alongside the UK Online Safety Act, General Data Protection Regulation (GDPR), AI Act, Digital Markets Act, and consumer protection law – so clients get a coherent strategy rather than parallel and sometimes contradictory advice.

Our Experience

Dozens of technology companies have instructed Cooley on DSA matters.

A range of designated VLOPs and VLOSEs – across social, search, marketplace and content-sharing models – including services under active commission investigation, where we act for providers from first request for information onwards.
Services below the designation threshold – where we advise on the baseline obligations and the very different regulatory dynamic of national supervision.
DSCs across multiple member states – where we have experience of how national regulators are interpreting and enforcing the regime, and of the divergences between them.
The full range of obligations – systemic risk assessment and mitigation, protection of minors, notice and action and redress, advertising and recommender transparency, and marketplace trader duties.
The full spectrum of clients – from global platforms with hundreds of millions of EU users to venture-backed companies encountering their first substantive regulatory obligation.

We also advise on what comes next: the Digital Omnibus proposals and their implications for supervision of AI features within designated services, the developing practice of national DSCs, and the interaction among the DSA and the UK Online Safety Act, the AI Act and equivalent regimes emerging in other markets.

How we help

For all regulated services
- Scoping and classification: Whether the DSA applies and at which layer – intermediary, hosting, online platform, marketplace or search. We advise on the micro and small enterprise exemptions and what happens as they fall away, on member state of establishment and its regulatory consequences, and on legal representative appointment and the exposure that role carries.
- Content moderation, notice and action, and redress: Notice and action mechanisms, statements of reasons and transparency database reporting, internal complaint handling, out-of-court dispute settlement bodies, trusted flaggers, measures against misuse, and the terms of service drafting and enforcement practice that underpins all of it.
- Advertising, recommenders and interface design: Advertising transparency, the profiling advertising prohibitions, recommender system transparency and the dark patterns prohibition – an area where regulators have shown they will treat interface design as a compliance question rather than a marketing one.
- Protection of minors: Age assurance design and vendor selection, default settings for minor accounts, contact and visibility restrictions, and the profiling advertising ban. We reconcile these with the GDPR and national minor protection laws in Germany, France, Italy and Spain rather than treating each as a separate workstream.
- Marketplace and trader obligations: Trader traceability and know-your-business customer duties, compliance by design, illegal product risk mitigation, and the interaction between the DSA and EU product safety, consumer protection and customs regimes.
For VLOPs and VLOSEs
- Designation: User number methodology and reporting, engagement with the commission on threshold questions, and the grounds on which a designation decision can be contested.
- Systemic risk assessment and mitigation: Article 34 assessments built to withstand commission scrutiny and the Article 35 mitigations that follow – including the ad hoc assessments required before launching features that materially change a risk profile, now a live issue for anyone deploying generative AI into an existing service.
- Audit, compliance function and governance: Preparing for and responding to independent audits, standing up the compliance function, and building the internal governance and documentation trail the commission expects to find.
- Transparency infrastructure: Advertisement repositories, the nonprofiling recommender option, enhanced transparency reporting, and data access for regulators and vetted researchers, including the confidentiality and trade secret questions that access requests raise.

Across both layers

Regulatory engagement.

We manage the relationship with the Commission and with national Digital Services Coordinators: responding to requests for information, preparing for supervisory meetings, negotiating commitments, and handling the confidentiality, legal privilege and trade secret questions that arise when a regulator asks for internal documents, models or data.
Investigations, enforcement defence and appeals.

We act for providers in formal proceedings – from first request for information through preliminary findings, access to file, written observations, commitments and non-compliance decisions – and in national DSC enforcement. We advise on interim measures and periodic penalty payment exposure and on parallel proceedings across regulators and jurisdictions.
Product and design counselling.