EU Digital Services Act
Two regimes in one instrument
The most common and most expensive misconception about the Digital Services Act (DSA) is that it is a large-platform regime. It is not. The DSA imposes a baseline stack of obligations on substantially every online intermediary serving EU users, and then layers a far more demanding set on the small number of services designated as very large online platforms (VLOPS) or very large online search engines (VLOSEs). The two layers are enforced by different regulators, on different timelines and with different consequences.
The baseline layer applies to almost everyone. Any intermediary service reaching EU users owes duties on points of contact, terms of service transparency and annual transparency reporting – and, if it is not established in the EU, it must appoint a legal representative who carries exposure. Hosting services owe notice and action, statements of reasons and criminal offence notification duties on top. Online platforms add internal complaints handling, out-of-court dispute settlement, trusted flaggers, measures against misuse, the dark patterns prohibition, advertising and recommender transparency, and minor protection duties, including the ban on profiling-based advertising to minors. Marketplaces add trader traceability, compliance by design and consumer information duties. Micro and small enterprises are relieved of parts of this, but the relief is narrower than most assume.
The VLOP/SEs layer is a different order of obligation. Designation at the 45 million average monthly active EU recipient threshold triggers systemic risk assessment and mitigation, crisis response mechanisms, annual independent audit, a nonprofiling recommender option, a public advertisement repository, data access for regulators and vetted researchers, an independent compliance function, enhanced six-monthly transparency reporting and a supervisory fee. These duties bite four months after designation, and designation itself is contestable.
The regulators differ. The commission supervises designated services directly on the VLOP-specific obligations. Everything else falls to the digital services coordinator (DSC) of the provider’s member state of establishment, under the country-of-origin principle.
National DSCs are becoming materially more active, their approaches diverge, and national implementation remains uneven enough that the commission has taken member states to task over it. A provider’s regulatory experience under the DSA depends heavily on where it is established.
The exposure does not differ as much as people expect. The 6% of global annual turnover ceiling is not a VLOP/VLOSE-only risk – member states are required to provide for penalties at that level too.
Where enforcement is concentrated
Systemic risk. The commission’s most consequential cases turn on whether a designated provider properly identified the systemic risks arising from its service and put proportionate mitigations in place. Findings have addressed addictive design, recommender systems, sale of illegal products and deployment of generative AI features into an existing platform without a fresh assessment of the risks that deployment creates.
Protection of minors.Following the commission’s Article 28 guidelines, minor safety and age assurance drive a substantial share of proceedings at both levels – default account settings, profile visibility, contact controls, exposure to harmful content and the design features that shape how long young users stay.
Design, not just disclosure. Recent decisions and preliminary findings require changes to interface design, default settings, recommender behaviour and onboarding flows. A DSA outcome is increasingly an engineering commitment rather than a document, with periodic penalty payments and interim measures available to accelerate it.
The practical consequence. How a provider engages determines the outcome as much as what it does. The commission has fined providers that contested findings through to a final decision and closed matters against providers that offered credible, binding commitments early. The same conduct has produced very different results depending on the posture taken in the first months. The same is true, in a less formalised way, of first contact with a national DSC