DSA
Digital Services Act, Regulation (EU) 2022/2065
Content moderation, transparency, a ban on ads targeted using sensitive data or at minors based on profiling, and risk assessments for very large platforms.
The law in brief
The Digital Services Act sets rules for online intermediaries serving the EU: how they handle illegal content, how transparent they are about moderation and advertising, and how they protect users, especially minors. Duties scale with the service: all intermediaries have baseline duties, hosting services and online platforms have more, and very large online platforms and search engines carry systemic risk duties.
For privacy practitioners, its advertising rules matter most: no ads based on profiling that uses sensitive data, no profiling-based ads to minors, and no deceptive interface design on platforms.
Who it applies to
- Intermediary services offered to recipients in the EU, wherever the provider is established: mere conduit, caching and hosting services.
- Online platforms, such as marketplaces, social networks and app stores, which store and disseminate information to the public.
- Very large online platforms and very large online search engines, with 45 million or more average monthly active users in the EU, designated by the Commission.
- Micro and small enterprises are exempt from many online platform obligations unless designated as very large.
What it requires
Notice and action
Hosting services must provide easy electronic mechanisms to notify illegal content, act on notices diligently, and give a statement of reasons when they restrict content or accounts.
No deceptive design
Online platforms must not design, organize or operate their interfaces in a way that deceives, manipulates or materially distorts users' ability to make free and informed decisions.
Ad transparency and no sensitive-data profiling
Label ads, show on whose behalf they are presented and the main targeting parameters, and do not present ads based on profiling using special categories of personal data.
Protection of minors
Put appropriate and proportionate measures in place for a high level of privacy, safety and security for minors, and do not present ads based on profiling when you are reasonably certain the user is a minor.
Systemic risk for very large platforms
Very large platforms and search engines must assess and mitigate systemic risks each year, including to fundamental rights and minors, and undergo independent audits.
People's rights
Users can notify illegal content, receive a statement of reasons when their content or account is restricted, use an internal complaint system and out-of-court dispute settlement, see why they are shown an ad, and, on very large platforms, choose a recommender system not based on profiling.
Enforcement and penalties
Fines of up to 6% of worldwide annual turnover for failing to comply, and up to 1% for supplying incorrect information or failing to submit to inspection, with periodic penalty payments (Arts. 52 and 74). The Commission enforces for very large platforms and search engines; national digital services coordinators enforce for others.
What to do first
- Classify your service: intermediary, hosting, online platform, or very large.
- Set up notice and action and statements of reasons for content decisions.
- Check ad targeting: no profiling using special categories of personal data, and none aimed at users you know are minors.
- Remove dark patterns from platform interfaces.
- Publish transparency reports on moderation as your category requires.
- For marketplaces, verify traders before they can sell.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Recent developments
-
European Commission sends formal notice to Bulgaria for non‑compliance with the Digital Services Act
The action highlights EU enforcement of the Digital Services Act and its impact on national enforcement frameworks and platform liability. The Commission issued a formal notice (INFR(2024)2241) to Bulgaria for failing to fully comply with the DSA, specifically for not designating and empowering the required Digital Services Coordinators. Bulgaria has two months to respond before the Commission may issue an additional reasoned opinion. The Commission also noted that Bulgaria's sanction regime does not fully respect the DSA's maximum fine limits or proportionality requirements.
Source: European Commission digital strategy news. DSA in the regulations library.
-
Commission designates ChatGPT, Reddit, Roblox as VLOPs/VLOSE under the Digital Services Act
The designations trigger new DSA compliance duties for major online services, affecting their risk‑management and user‑protection obligations. The European Commission has designated ChatGPT as a Very Large Online Search Engine and Reddit and Roblox as Very Large Online Platforms under the DSA, citing each service’s reach of at least 45 million EU monthly users. The designated services must comply within four months (by January 2027) with additional DSA obligations, including risk assessment and mitigation of systemic risks to minors, well‑being, fundamental rights, and public security.
Source: European Commission digital strategy news. DSA in the regulations library.
-
EDPB adopts guidelines on GDPR fines and DSA interaction (17 Sep 2026)
The new EDPB guidance clarifies how authorities should levy fines and align DSA obligations with GDPR rules, impacting controllers, processors and digital platforms across the EU. On 17 September 2026 the European Data Protection Board adopted guidelines on the use of administrative fines by data protection authorities and finalised guidance on the interaction between the Digital Services Act (DSA) and the GDPR. The guidelines outline a five‑step method for assessing fines and describe corrective measures such as warnings, injunctions and service limitations. A public consultation on the guidelines runs until 13 November 2026.
Source: CNIL (France) and 1 more. DSA in the regulations library.
-
EU Commission hosts fifth roundtable on Digital Services Act implementation
The event signals ongoing EU regulator engagement with stakeholders to shape DSA enforcement and address AI and child‑safety risks online. On 23 September 2026 the European Commission held an online roundtable with about 60 civil society organisations and researchers to discuss the implementation of the Digital Services Act. The discussion focused on systemic risks, mitigation measures, protection of minors, online marketplaces and AI‑related risks, and referenced the proposal for an EU KIDS Act. The Commission also presented key steps of the DSA enforcement process and ways for civil society to contribute.
Source: European Commission digital strategy news. DSA in the regulations library.
-
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
The KIDS Act aims to create EU‑wide, age‑based safeguards and design obligations to protect children’s privacy and safety online. On September 17, 2026 the European Commission published a proposal for a new EU KIDS Act that would ban users under 15 from creating accounts on certain social networking and video‑sharing services, with limited exceptions. The draft regulation requires third‑party EU age‑verification solutions and obliges covered providers to embed child‑safety measures and submit compliance plans, especially for VLOPs. A supervisory fee capped at 0.03% of worldwide annual net income would be levied on large platforms and certain AI providers.
Penalty: supervisory fee for in-scope VLOPs as well as certain providers of AI companions, general conversational chatbots, and video gaming platforms, capped at 0.03% of worldwide annual net income.
Source: Covington Inside Privacy and 1 more. DSA in the regulations library.
-
EU Commission to propose EU-wide minimum age for social media, linked to Digital Fairness Act
The upcoming proposal could set EU‑wide age limits for minors on social platforms, reshaping platform design and advertising practices. The European Commission will release a legislative proposal by the end of 2026 establishing an EU-wide minimum age for social media, building on the Special Panel's age‑tiered framework. The proposal may be incorporated into the Digital Fairness Act, which would address personalized ads, influencer marketing, age‑assurance measures and default safety settings for children. Enforcement would likely involve consumer‑protection authorities alongside the Digital Services Act.
Source: Covington Inside Privacy. DSA in the regulations library.
-
EU Commission designates ChatGPT as VLOSE and Reddit, Roblox as VLOPs under DSA
The designations subject the three platforms to heightened DSA compliance requirements, impacting their data handling and AI governance practices. On August 31, 2026, the European Commission announced that it had designated ChatGPT as a Very Large Online Search Engine (VLOSE) and Reddit and Roblox as Very Large Online Platforms (VLOPs) under the Digital Services Act. The designations trigger the additional obligations set out in the DSA for very large services.
Effective: 31 August 2026.
Source: Hunton Privacy & Cybersecurity Law Blog. DSA in the regulations library.
-
French Constitutional Council strikes down law banning under‑15s from social media
The ruling halts a major child‑protection measure, affecting age‑verification requirements and privacy protections for minors on social platforms. On 14 August 2026 the French Constitutional Council invalidated Article 1 of the Act that would have barred minors under 15 from accessing online social media. The Council found the ban disproportionate, lacking individual assessment, and missing privacy safeguards for age‑verification. As a result the provision cannot be promulgated and will not enter into force.
Source: Covington Inside Privacy. DSA in the regulations library.
Sources
- Regulation (EU) 2022/2065 EUR-Lex · Official text or regulator