EU Digital Services Act Compliance Timeline & FAQ

Key dates

1. 2022-11-16
   DSA enters into force
   20 days after publication in the Official Journal.
   Key provisionsArt 93
2. 2023-02-17
   Platforms and search engines must publish average monthly EU user numbers
   The scoping step towards VLOP/VLOSE designation.
   Key provisionsArt 24(2)
3. 2023-04-25
   First 19 VLOPs and VLOSEs designated (45m+ users)
   Commission decision starts a four-month compliance clock.
   Key provisionsArt 33
4. 2023-08-25
   Full DSA obligations apply to the first VLOPs/VLOSEs
   First systemic risk assessments, crisis response, public ad repositories.
   Key provisionsArt 34·Art 35·Art 39
5. 2024-02-17
   Full application to all intermediary services; Member States designate their Digital Services Coordinators
   Out-of-court dispute settlement and trusted-flagger certification start.
   Key provisionsArt 49·Art 21·Art 22·Art 93
6. 2024-05-14
   Germany's DSA Implementation Act (DDG) enters into force; the Bundesnetzagentur becomes Germany's Digital Services Coordinator
   National layer: Telemedia Act repealed, NetzDG largely absorbed.
   Key provisionsArt 49
7. 2025-07-14
   Commission guidelines on the protection of minors under Article 28 (C(2025) 4764 final)
   Non-binding; risk review, age assurance, safe defaults for minors.
   Key provisionsArt 28
8. Ongoing
   Yearly transparency and moderation reporting; statements of reasons feed the public DSA Transparency Database
   Machine-readable, at least annually.
   Key provisionsArt 15·Art 17·Art 24

Frequently asked

Who does the DSA apply to?

All intermediary services offered in the EU: mere conduit, caching and hosting services, online platforms including marketplaces, and online search engines (Article 3). Providers established outside the EU are covered once they offer services to recipients in the EU and must designate an EU legal representative (Article 13). Micro and small enterprises are exempt from the heavier platform and marketplace obligations (Articles 19 and 29). Services with 45 million or more monthly EU users face the strictest tier once designated as VLOPs or VLOSEs (Article 33).

Does the DSA apply to providers outside the EU?

Yes, but only with a substantial connection to the EU: an establishment in a Member State, a significant number of EU recipients, or activities targeted at Member States, signalled for instance by a Member State's language or currency, the option to order into that country, or a national top-level domain (Article 2(1), Recital 8). Mere technical accessibility of a website from the EU is not enough. Non-EU providers in scope must appoint an EU legal representative, who can themselves be held liable for the provider's non-compliance (Article 13).

When is an online shop an online marketplace under the DSA?

Only if consumers can conclude distance contracts with third-party traders on it (Chapter III, Section 4, Articles 30 to 32). A shop selling exclusively its own products is not a marketplace, and neither is a social network where traders occasionally strike deals in chats or comments, unless the platform actively facilitates those transactions, for example through a built-in checkout. Search engines and non-platform intermediaries cannot be marketplaces at all.

What distinguishes a “hosting service” from an “online platform”?

Hosting means storing information provided by a user, a concept European regulators and courts read broadly, down to data linked to a user account. An online platform is a hosting service that additionally disseminates that information to the public, like a social network (Article 3(g), (i)). The line matters because each step up the ladder adds obligations, and one business can operate several differently classified services at once: a marketplace (online platform) with a seller analytics area (hosting only) is two services, not one.

What is the Digital Services Act?

An EU regulation (2022/2065) that sets due-diligence duties for online intermediaries, from internet access providers and cloud hosts to marketplaces, app stores and social networks. It standardises how illegal content is flagged and removed, makes moderation and advertising transparent, and puts the largest platforms under direct Commission supervision.

What is a VLOP or VLOSE, and how are users counted?

A very large online platform or search engine: one whose average monthly active EU users reach 45 million, roughly 10% of the EU population, designated as such by the Commission (Article 33). The count is not limited to registered users, anyone who engaged with the service counts, and is determined as an average over the past six months and published at least every six months (Article 24(2)).

Does the DSA define what is illegal online?

No. Illegal content is defined by other EU law (for example terrorist content or child sexual abuse material) or by national law (for example defamation). The DSA standardises the procedures: flagging, decisions, statements of reasons and redress. Content illegal only in one Member State is, as a rule, restricted only in that territory.

What are dark patterns, and are they banned?

Interface designs that deceive or manipulate users into decisions they would not otherwise take: nagging repeat prompts, hidden or misleading buttons, cancellation mazes. Article 25 prohibits online platforms from designing interfaces that materially distort users' ability to make free and informed decisions.

What is a trusted flagger?

An entity with proven expertise in detecting illegal content, independent from platforms, awarded the status by the Digital Services Coordinator of its Member State. Platforms must treat notices from trusted flaggers with priority and decide on them without undue delay (Article 22).

When did the DSA start applying?

It entered into force on 16 November 2022. User-number publication duties applied from 17 February 2023, the first designated VLOPs/VLOSEs had to comply from late August 2023, and the DSA has applied in full to all intermediary services since 17 February 2024 (Article 93).

When were the first VLOPs designated, and what did that trigger?

On 25 April 2023, the Commission designated the first 19 services. Designation starts a four-month compliance clock (Article 33(6)), so the strictest tier (systemic risk assessments, mitigation, crisis response, ad repositories, independent audits) applied to that first group from late August 2023. Further designations have followed since.

Are intermediaries liable for content their users post?

Not automatically. The DSA carries over the e-Commerce Directive's safe harbours: mere-conduit and caching providers are shielded when they stay passive (Articles 4 and 5), and hosting providers are shielded unless they have actual knowledge of illegal content and fail to act expeditiously to remove it (Article 6). General awareness that a service could be misused does not create knowledge, and there is no general monitoring obligation (Article 8). Voluntary own-initiative moderation does not forfeit the shield (Article 7, the codified Good Samaritan principle). Marketplaces lose the shield where a listing misleads consumers into thinking the platform itself is the seller (Article 6(3)).

What must a platform do when content is flagged?

Provide an easy-to-use notice mechanism, process reports in a timely and diligent manner, inform both the notifier and the uploader of the decision (Article 16), and issue a statement of reasons for any restriction (Article 17). Online platforms must additionally submit these statements, stripped of personal data, to the public DSA Transparency Database (Article 24(5)).

What can users do against a moderation decision?

Complain free of charge through the platform's internal complaint system (Article 20), escalate to a certified out-of-court dispute settlement body at the platform's expense (Article 21), or go to court; the internal step is not mandatory before the others. If the platform fails to give reasons or ignores complaints, the national Digital Services Coordinator can be contacted (Article 53).

What special duties do online marketplaces have?

Four beyond the platform tier: verify and record trader identities before they can sell (Article 30); design the interface so traders can meet their own EU-law information duties (Article 31); make reasonable efforts to randomly check offers against official databases of illegal products (Article 31(3)); and, on learning that an illegal product was sold, notify all consumers who bought it in the preceding six months, or publish the warning where they cannot be reached (Article 32). Commission enforcement against marketplace VLOPs has focused on exactly these duties.

How does the DSA protect minors?

Article 28 obliges providers of online platforms accessible to minors to ensure a high level of privacy, safety and security for them, and bans advertising based on profiling where the provider is reasonably certain the user is a minor, without requiring platforms to collect extra age data. The Commission's July 2025 guidelines (C(2025) 4764 final) spell out what that means: an age limit in the terms and conditions alone does not take a platform out of scope; providers should run periodic risk reviews at least annually; age assurance ranges from self-declaration through age estimation to full verification, chosen proportionately, with the assessment published; and defaults for minors should be safe: private accounts and push notifications off.

How is targeted advertising restricted?

Ads must be clearly labelled with who paid for them and why the user sees them (Article 26). Targeting based on sensitive data such as religion, sexual orientation or ethnicity is banned (Article 26(3)), as is any ad profiling of minors (Article 28(2)). VLOPs/VLOSEs must additionally keep a public repository of the ads served on their services (Article 39).

Who enforces the DSA, and what are the penalties?

The Commission supervises VLOPs and VLOSEs directly, with fines of up to 6% of global annual turnover (Article 74) and periodic penalty payments of up to 5% of average daily worldwide turnover (Article 76). All other services are supervised by the Digital Services Coordinator of the Member State where they are established (Article 49), with national penalties capped at the same 6% and 5% (Article 52); Finland's Traficom is one example. Complaints about a provider in another Member State are forwarded to the competent authority.

Who enforces the DSA in Germany, and what can national fines reach?

The Bundesnetzagentur acts as Germany's Digital Services Coordinator through its Koordinierungsstelle für Digitale Dienste, flanked by specialised authorities: the BzKJ for the protection of minors, the BfDI for the ban on ad profiling with special-category data, and the BKA as central reporting office for suspected criminal content. Under the German DDG, fines for providers established in Germany (other than VLOPs/VLOSEs, which the Commission supervises) reach up to EUR 100,000 or, for certain information and transparency breaches, 1% of worldwide annual turnover, and up to EUR 300,000 or 6% for core violations such as a missing notice-and-action system or absent statements of reasons; periodic penalties can reach 5% of average daily turnover, and negligence suffices.