DSA (Digital Services Act) Guide: how to achieve compliance?

What is the DSA?

The DSA modernises the liability framework for digital services in the EU. It maintains the longstanding principle of liability exemption for hosting providers as long as they are unaware of the unlawful nature of content, but adds positive obligations of due diligence, transparency and user protection.

It establishes a supervisory system with Digital Services Coordinators in each Member State (Arcom in France) and direct European oversight of very large platforms deemed systemic.

Its objective: a safer digital space where what is illegal offline is also illegal online, without turning platforms into judges of content.

The obligation pyramid

The DSA stacks obligations by category: each tier adds its requirements on top of those from the tier below. Identifying where your service sits is therefore the first step.

Micro and small enterprises are exempt from several platform-specific obligations.

Who is affected?

The scope is broad and extends well beyond large platforms. Many SMEs operating a marketplace or online service are affected, even if they are exempt from the most burdensome obligations.

• Intermediary services (conduit, caching, hosting): basic obligations.
• Online platforms (marketplaces, social networks): reporting, trader traceability, advertising transparency.
• Very large platforms and search engines (more than 45 million users in the EU): systemic risk assessment, audits, enhanced measures.
• Non-EU actors offering services within the Union: subject to the DSA and required to designate a legal representative.

What are the concrete obligations?

Here are the most common obligations for a standard-sized online platform.

• Designate a point of contact and, for non-EU actors, a legal representative.
• Implement a notice-and-action mechanism for illegal content.
• Provide reasoning for moderation decisions and offer internal and out-of-court redress.
• Ensure transparency of recommender systems and advertising.
• Prohibit targeted advertising based on sensitive data and advertising targeting minors.
• Publish transparency reports on content moderation.
• For marketplaces: trace and verify the identity of professional traders.

What penalties apply in the event of non-compliance?

The DSA provides for dissuasive sanctions, particularly severe for large platforms, with direct supervision by the European Commission for systemic players.

How to achieve compliance: the 7-step roadmap

Step 1 — Qualify your service

Determine your category (intermediary, hosting provider, platform, marketplace) and your size. This qualification determines the exact scope of your obligations and any potential micro/small enterprise exemption.

Count your monthly active users in the EU: this figure can trigger classification as a very large platform.

• Precisely identify the nature of your service.
• Count your active users in the EU.
• Check the micro/small enterprise exemption.

Step 2 — Set up contact points

Designate a single point of contact for authorities and another for users, as well as a legal representative if you are established outside the EU.

These entry points must be easily accessible and operational.

• Designate contact points for authorities and users.
• Appoint a legal representative if established outside the EU.
• Publish this information in an accessible manner.

Step 3 — Deploy the notice-and-action mechanism

Create a clear illegal content notification system ("notice and action") and a documented handling process with reasonable timeframes.

Provide for priority handling of reports from "trusted flaggers".

• Offer a clear and accessible reporting form.
• Document the process and handling timeframes.
• Prioritise reports from trusted flaggers.

Step 4 — Structure moderation and redress

Provide reasons for your moderation decisions, inform the users concerned, and offer an internal complaint mechanism as well as out-of-court dispute resolution.

The transparency of decisions is just as important as the decision itself.

• Justify and notify each moderation decision.
• Put in place an internal redress mechanism.
• Provide for out-of-court dispute resolution.

Step 5 — Ensure transparency

Document how your recommender systems operate, ensure advertising transparency (who is paying, why this targeting), and publish the required transparency reports.

These obligations strengthen user trust and compliance with authorities.

• Explain the criteria used by your recommender systems.
• Make advertising transparent and traceable.
• Publish the required transparency reports.

Step 6 — Regulate advertising and protect minors

Remove targeted advertising based on sensitive data and advertising targeting minors, and strengthen the protection of minor users (protective default settings, no targeting).

This area directly intersects with GDPR: secure your legal bases and consent mechanisms.

• Prohibit advertising targeting based on sensitive data and minors.
• Strengthen default protections for minors.
• Align these measures with GDPR.

Step 7 — Manage systemic risks (large platforms)

For VLOPs/VLOSEs, conduct the annual assessment of systemic risks (disinformation, infringement of rights, effects on minors), implement mitigation measures, and commission independent audits.

These significant obligations apply only to designated systemic actors.

• Annually assess systemic risks.
• Implement mitigation measures.
• Commission independent audits.

Common mistakes to avoid

• Believing the DSA only concerns digital giants: many platforms and marketplaces are in scope.
• Overlooking seller traceability on marketplaces ('know your business customer').
• Underestimating the interplay with GDPR on targeted advertising and user data.
• Failing to publish the required transparency reports.
• Making the reporting mechanism difficult to access or opaque.
• Not appointing a legal representative when established outside the EU.