# Digital Services Act — Regulation (EU) 2022/2065

Status as at 2026-08-05.

A Regulation. Directly applicable and identical everywhere. National law supplies only the Digital Services Coordinator, the penalty framework and the certification of out-of-court dispute settlement bodies. Applicable in full since **17.02.2024** (Art 93(2)); a subset — Arts 24(2), (3), (6), 33(3)–(6), 37(7), 40(13), 43 and Sections 4, 5 and 6 of Chapter IV — since 16.11.2022.

**The digital omnibus does not touch the DSA.** COM(2025) 837 amends the GDPR, ePrivacy, NIS2, CER, the Data Act and others, and repeals P2B and the Data Governance Act. Regulation (EU) 2022/2065 appears nowhere in it.

## The tiers are cumulative

| Chapter III section | Applies to | Articles |
|---|---|---|
| Section 1 | **all** intermediary services (mere conduit, caching, hosting) | 11, 12, 13, 14, 15 |
| Section 2 | hosting services, including online platforms | 16, 17, 18 |
| Section 3 | online platforms | 19–28 |
| Section 4 | platforms allowing consumers to conclude **distance contracts with traders** | 29–32 |
| Section 5 | VLOPs and VLOSEs — 45 million average monthly active EU recipients **and** a Commission designation decision (Art 33) | 33–43 |

A hobby forum is a hosting service and an online platform. It is never a VLOP. Most compliance advice written for VLOPs is irrelevant to it, and most compliance advice that stops at "the DSA only applies to big tech" is wrong: Section 1 and Section 2 bind a one-person hoster.

## Three separate micro/small exemptions — not one

1. **Art 19(1)**: Chapter III **Section 3** (Arts 20–28) does not apply to online platforms that qualify as **micro or small enterprises** under Recommendation 2003/361/EC — **except Art 24(3)**, the duty to report active-recipient numbers to the Digital Services Coordinator or the Commission on request. The exemption continues for **12 months after losing that status** under Art 4(2) of the Annex to the Recommendation, unless the platform has been designated a VLOP. Art 19(2): Section 3 applies to designated VLOPs regardless of size.
2. **Art 29**: Chapter III **Section 4** (Arts 30–32, trader traceability and marketplace duties) does not apply to micro or small marketplaces. No Art 24(3)-style carve-out. **This is the exemption most small shops actually rely on and it is separate from Art 19.**
3. **Art 15(2)**: the annual transparency report under Art 15(1) does not apply to micro or small intermediary providers that are not VLOPs.

Thresholds (Annex to Recommendation 2003/361/EC, Art 2): micro = fewer than 10 persons and turnover and/or balance sheet total not exceeding EUR 2 million; small = fewer than 50 persons and not exceeding EUR 10 million. **Art 4(2) of the Annex**: the status is lost only if the ceilings are exceeded over **two consecutive accounting periods** — that is what the DSA's 12-month grace hangs off. Partner and linked enterprises count under Arts 3 and 6 of the Annex; a small subsidiary of a large group does not qualify.

**Sections 1 and 2 have no size exemption at all.**

## Section 1 — binds everyone

- **Art 11** — a single point of contact for member state authorities, the Commission and the Board, allowing direct electronic communication. Published and kept up to date. Art 11(3): state the usable languages, including at least one official language of the member state of main establishment.
- **Art 12** — a **separate** single point of contact for recipients of the service, allowing direct and rapid communication by easy-to-use electronic means, **"which shall not solely rely on automated tools"**. A support bot with no human path fails this.
- **Art 13** — providers **not established in the Union** that offer services in the Union must designate a **legal representative** in a member state where they offer services, notified to that member state's Digital Services Coordinator, and made publicly available. 13(3): the representative can be held liable for non-compliance. 13(5): designating one does not by itself constitute an establishment in the Union.
- **Art 14** — terms and conditions must state any restrictions imposed on information provided by recipients, including **content-moderation policies, algorithmic decision-making and human review**, and the rules of procedure of the internal complaint-handling system. Clear, plain, intelligible, user-friendly and unambiguous, publicly available in an **easily accessible and machine-readable format**. 14(2): notify significant changes. 14(3): where the service is primarily directed at minors or predominantly used by them, explain the conditions and restrictions **in a way minors can understand**. 14(4): apply and enforce restrictions in a **diligent, objective and proportionate manner**, with due regard to fundamental rights including freedom of expression and media pluralism.
- **Art 15** — annual machine-readable transparency report on content moderation. Disapplied for micro and small non-VLOP providers by Art 15(2).

**Commission Implementing Regulation (EU) 2024/2835 of 04.11.2024** lays down mandatory CSV/XLSX templates in Annex I for the Art 15, 24 and 42 reports. Reporting period 1 January to 31 December; VLOPs and VLOSEs every six months; publication **within two months** of the period end; templates **mandatory since 01.07.2025**; reports retained and publicly available for **at least five years**.

## Section 2 — hosting

- **Art 16 notice and action** — mechanisms allowing any individual or entity to notify allegedly illegal content, **electronic and easy to access**. Notices must be facilitated to contain a sufficiently substantiated explanation, a clear electronic location such as an exact URL, the notifier's name and email (except for certain offences), and a good-faith statement. **Art 16(3): a notice that allows a diligent provider to identify the illegality without a detailed legal examination confers actual knowledge or awareness for the purposes of Art 6** — i.e. it starts the liability clock. 16(4) confirm receipt; 16(5) notify the decision and the redress possibilities; 16(6) process notices in a timely, diligent, non-arbitrary and objective manner.
- **Art 17 statement of reasons** — owed to the affected recipient for any restriction on the ground that the information is illegal or incompatible with the terms: (a) restrictions on visibility, including removal, disabling access and demotion; (b) suspension, termination or other restriction of monetary payments; (c) suspension or termination of the service in whole or in part; (d) suspension or termination of the account. 17(2): only where the electronic contact details are known; does **not** apply to deceptive high-volume commercial content. 17(3)(a)–(f): mandatory content, including whether automated means were used and the redress routes. 17(5): does not apply to Art 9 orders. Art 24(5): online platforms must submit these statements to the Commission's public DSA Transparency Database.
- **Art 18** — notify law enforcement of information giving rise to a suspicion of a criminal offence involving a threat to life or safety.

## Section 3 — online platforms

- **Art 20 internal complaint-handling** — free, electronic, accessible for **at least six months** after the decision. Decisions taken under the supervision of appropriately qualified staff and **not solely on the basis of automated means** (20(6)).
- **Art 21 out-of-court dispute settlement** — before bodies certified by a Digital Services Coordinator for up to five renewable years. **Decisions are not binding** (21(2)). Decision within **90 days**, extendable once to a maximum of **180**. 21(5): if the recipient wins, the platform bears the body's fees and the recipient's reasonable expenses; if the platform wins, the recipient owes nothing unless it acted in manifest bad faith. Free or nominal fee for recipients.
- **Art 22 trusted flaggers** — status awarded by the Digital Services Coordinator of the applicant's member state. Their notices get priority and a decision without undue delay.
- **Art 23 measures against misuse** — after a **prior warning**, suspend recipients that frequently provide manifestly illegal content (23(1)) and notifiers or complainants that frequently submit manifestly unfounded notices or complaints (23(2)). Assessment criteria in 23(3). **23(4): the misuse policy must be set out in the terms and conditions, with examples and the suspension duration.**
- **Art 24** — platform additions to the Art 15 report (disputes referred to out-of-court bodies, Art 23 suspensions); 24(2) publish **average monthly active recipients in the Union at least every six months**; 24(3) report those numbers on request; 24(5) push Art 17 statements to the Transparency Database.
- **Art 25 dark patterns**, verbatim: "Providers of online platforms shall not design, organise or operate their online interfaces in a way that deceives or manipulates the recipients of their service or in a way that otherwise materially distorts or impairs the ability of the recipients of their service to make free and informed decisions." **25(2): the prohibition does not apply to practices covered by Directive 2005/29/EC or Regulation (EU) 2016/679.**

  Art 25 is a **residual gap-filler**, not the primary dark-pattern rule. A misleading cookie banner is a GDPR/ePrivacy matter; a misleading price display is a UCPD matter. Citing Art 25 at either is wrong. 25(3): the Commission may issue guidelines, naming three examples — giving more prominence to certain choices, repeatedly requesting a choice already made through interfering pop-ups, and making termination harder than subscription.
- **Art 26 advertising transparency** — for each advertisement, in real time, in a clear, concise and unambiguous manner: that it is an advertisement; on whose behalf it is presented; who paid for it if different; and meaningful information about the **main parameters used to determine the recipient to whom it is presented** and, where applicable, how to change them. 26(2): a functionality for recipients to declare that content they provide is a commercial communication — the influencer-disclosure hook. **26(3): no advertisements based on profiling within Art 4(4) GDPR using special categories of personal data under Art 9(1) GDPR.**
- **Art 27 recommender systems** — set out in the terms, in plain and intelligible language, the main parameters and any options to modify or influence them.
- **Art 28 minors** — 28(1) appropriate and proportionate measures for a high level of privacy, safety and security of minors on platforms **accessible to minors**. **28(2): no advertisements based on profiling using the recipient's personal data where the provider is aware with reasonable certainty that the recipient is a minor.** **28(3): this creates no obligation to process additional personal data to assess whether a recipient is a minor** — there is no age-verification mandate in the DSA.

  **Commission guidelines under Art 28(4) are final and published**: Communication, "Guidelines on measures to ensure a high level of privacy, safety and security for minors online, pursuant to Article 28(4) of Regulation (EU) 2022/2065", C/2025/5519, OJ C series, **10.10.2025**. Non-binding and risk-based. Because Art 28 sits in Section 3, they do not reach micro or small platforms.

## Section 4 — marketplaces (subject to the Art 29 exemption)

- **Art 30 trader traceability.** Before allowing a trader to use the platform to promote or offer products or services to consumers in the Union, obtain: (a) name, address, telephone number and email; (b) a copy of the identification document or another electronic identification under Regulation (EU) 910/2014; (c) **payment account details**; (d) the trade register in which the trader is registered and its registration number; (e) a self-certification of compliance with applicable Union law. 30(2): best efforts to assess reliability using freely accessible official online databases or supporting documents. Traders already active on 17.02.2024 had a **12-month cure period**, then suspension became mandatory. 30(3): suspend where the information is inaccurate and not remedied. 30(5): store securely and **delete six months after the end of the contractual relationship**. **30(7): publish points (a), (d) and (e) on the interface where the product or service is presented.**
- **Art 31 compliance by design** — the interface must **enable** traders to provide pre-contractual information, compliance information and product-safety information, expressly including the economic operator's name, address, telephone number and email under Art 3(13) of Regulation (EU) 2019/1020; product identification; the trader's sign or trademark; and labelling or marking. 31(3): best efforts to check before listing, plus **random checks** afterwards against official machine-readable databases.
- **Art 32 right to information** — on becoming aware that an illegal product or service was offered, inform consumers who purchased it in the preceding **six months**, where their contact details are held, of the illegality, the trader's identity and the means of redress; otherwise publish the information on the interface.

## VLOP-only (Section 5)

Arts 33–43: systemic risk assessment and mitigation, crisis mechanism, independent audits, recommender options without profiling, ad repositories, **Art 40 data access** for the Digital Services Coordinator of establishment, the Commission and vetted researchers, compliance function, **Art 42** semi-annual transparency reporting with per-language moderation resources and monthly per-member-state recipient numbers, and the supervisory fee. Art 44 standards are voluntary.

If a project is not designated by Commission decision, none of this applies. Do not draft it in.

## Template — DSA disclosures

```html
<!-- DRAFT – NOT LEGALLY APPROVED -->
<h2>Digital Services Act information</h2>

<h3>Points of contact</h3>
<p>
  For authorities, the Commission and the European Board for Digital Services
  (Art 11): [[EMAIL]]. Languages: [[LANGUAGES, incl. an official language of
  the member state of main establishment]].
</p>
<p>
  For recipients of the service (Art 12): [[EMAIL / FORM]]. This channel is
  monitored by staff, not only by automated tools.
</p>
<p>
  [[Non-EU providers: Legal representative under Art 13:
  NAME, ADDRESS, MEMBER STATE, EMAIL.]]
</p>

<h3>Reporting illegal content</h3>
<p>
  Anyone can report content they consider illegal via [[URL / EMAIL]].
  Please include the exact URL, an explanation of why the content is illegal,
  your name and email address, and a statement that your notice is made in good
  faith. We confirm receipt and inform you of our decision and of the redress
  routes available (Arts 16, 17).
</p>

<h3>Content moderation and complaints</h3>
<p>
  Our moderation rules, the use of automated tools and human review, and the
  rules of procedure of our internal complaint system are set out in
  <a href="[[TERMS URL]]">our terms</a> (Art 14).
  [[Platforms not micro/small: You can contest a decision free of charge for at
  least six months (Art 20), and refer the dispute to a certified out-of-court
  dispute settlement body (Art 21).]]
</p>
```

## Checkpoints

- [ ] Tier established in writing: intermediary / hosting / online platform / marketplace / VLOP
- [ ] Micro or small status assessed against Recommendation 2003/361/EC including partner and linked enterprises, and the correct exemption identified — **Art 19, Art 29 and Art 15(2) are three different reliefs**
- [ ] Two distinct points of contact published: authorities (Art 11) and recipients (Art 12)
- [ ] Recipient contact channel does not rely solely on automated tools (Art 12)
- [ ] Non-EU provider has a designated legal representative, publicly named (Art 13)
- [ ] Terms state restrictions, moderation policy, use of algorithmic decision-making and human review, and the complaint procedure, in a machine-readable format (Art 14)
- [ ] Minor-directed services explain the terms in a way minors can understand (Art 14(3))
- [ ] Notice-and-action mechanism live, electronic, with receipt confirmation (Art 16)
- [ ] Statement of reasons issued for every restriction, and pushed to the Transparency Database where a platform (Art 17, Art 24(5))
- [ ] Misuse policy with examples and suspension durations in the terms (Art 23(4))
- [ ] Ads labelled per Art 26; no profiling-based ads using Art 9(1) GDPR data; no profiling-based ads to known minors (Art 26(3), Art 28(2))
- [ ] Recommender parameters disclosed (Art 27)
- [ ] Marketplace: full Art 30(1) trader dataset collected, verified, and (a), (d), (e) published on the offer page (Art 30(7))
- [ ] Trader data deleted six months after the relationship ends (Art 30(5))
- [ ] Dark-pattern findings routed to the right instrument — UCPD or GDPR first, Art 25 only for the residue (Art 25(2))
- [ ] Transparency report published on the Implementing Regulation (EU) 2024/2835 template where Art 15 applies
- [ ] No VLOP obligations drafted in for a non-designated service
- [ ] All `[[…]]` placeholders resolved or reported as open