Running a platform or marketplace under the DSA: duties by size

The legal framework

The Digital Services Act (DSA) is Regulation (EU) 2022/2065. It entered into force on 16 November 2022 and has applied since 17 February 2024. Its due-diligence duties sit in Chapter III, Articles 11 to 48, and they are stacked like layers. Every intermediary has the first layer; each type of service adds the next. Your first job is to find the layer you are in.

Who is caught

The DSA applies to intermediary services offered to recipients established or located in the EU, wherever the provider sits (Article 2(1)). Article 3 defines three kinds: mere conduit (transmission or network access, such as an internet access provider), caching, and hosting (storing information at a user's request, such as a cloud storage service or a web host). An online platform is a hosting service that also disseminates the information to the public, unless that is a minor, purely ancillary feature of another service. A classifieds site or a video-sharing site is a platform. An online search engine is a separate category.

A service that is not an intermediary, such as a webshop selling only its own products, is outside the DSA altogether (Article 2(2)).

Layer 1: every intermediary (Articles 11 to 15)

• Points of contact. One electronic contact point for authorities, the Commission and the Board (Article 11), and one for users that does not rely solely on automated tools (Article 12).
• Legal representative. A provider without an EU establishment that offers services in the EU must appoint one in writing in a Member State where it operates. The representative can be held liable for non-compliance (Article 13).
• Terms and conditions. They must describe any restrictions on what users may post, including content moderation policies, algorithmic decision-making, human review and the complaint procedure, in clear and plain language. Significant changes must be notified, and restrictions applied diligently, objectively and proportionately (Article 14).
• Transparency report. At least once a year, a public, machine-readable report on content moderation (Article 15). Micro and small enterprises are exempt from this report unless they are a very large online platform (Article 15(2)).

Every intermediary must also act on orders from national authorities to act against illegal content or to provide information about specific users (Articles 9 and 10).

Layer 2: hosting services (Articles 16 to 18)

All hosting services, whatever their size, must run a notice and action mechanism (Article 16), give affected users a statement of reasons when they remove, restrict or demonetise content or close an account (Article 17), and promptly inform the authorities of information giving rise to a suspicion of a criminal offence that threatens someone's life or safety (Article 18). How these rules look from the side of a rights holder is set out in our article on the DSA as a brand-protection tool.

Layer 3: online platforms (Articles 19 to 28)

Article 19 is the size test. This whole section does not apply to platforms that qualify as micro or small enterprises under Recommendation 2003/361/EC. Under that Recommendation, a small enterprise has fewer than 50 staff and an annual turnover or balance sheet total of no more than EUR 10 million, and linked and partner enterprises count towards the figures. A platform that grows out of that status keeps the exclusion for 12 months. Two limits: Article 24(3), the duty to give user numbers to the regulator on request, always applies, and a platform designated as very large gets no exclusion at all.

Above that size, a platform must:

• run a free internal complaint system for at least six months after each moderation decision, with decisions taken under the supervision of qualified staff and not solely by automated means (Article 20);
• inform users about out-of-court dispute settlement and engage in good faith with a certified body; if the user wins, the platform pays the fees (Article 21);
• give priority to notices from trusted flaggers (Article 22);
• suspend, after a warning, users who frequently post manifestly illegal content and notifiers who frequently send manifestly unfounded notices, with the policy set out in the terms (Article 23);
• add disputes and suspensions to its transparency report, publish its average monthly active recipients in the EU at least every six months, and send its statements of reasons to the Commission's public database (Article 24);
• not design its interface to deceive or manipulate users (Article 25), a rule that gives way where the Unfair Commercial Practices Directive or the GDPR already applies;
• label each advertisement, show on whose behalf it runs and who paid for it, explain the main targeting parameters, and never target ads by profiling based on special categories of personal data (Article 26);
• explain the main parameters of its recommender systems in its terms (Article 27);
• if accessible to minors, take appropriate and proportionate measures for their privacy, safety and security, and stop profiling-based ads to users it knows with reasonable certainty to be minors (Article 28).

Layer 4: marketplaces (Articles 29 to 32)

Online platforms that allow consumers to conclude distance contracts with traders carry extra duties, again with an exclusion for micro and small enterprises (Article 29). They must collect and verify trader identity data before a trader may sell to EU consumers, and show part of it on the listing (Article 30). Their interface must let traders give the pre-contractual, compliance and product safety information that Union law requires, and they must run random checks against official databases of illegal products (Article 31). When they learn that an illegal product was sold, they must tell the buyers of the past six months (Article 32).

Layer 5: very large platforms and search engines (Articles 33 to 43)

The top layer applies to online platforms and search engines with at least 45 million average monthly active recipients in the EU that the Commission has designated (Article 33). The duties start four months after the provider is notified of the designation. They include an annual assessment of systemic risks and measures to mitigate them (Articles 34 and 35), a crisis response mechanism (Article 36), an annual independent audit at the provider's own expense (Article 37), a recommender option not based on profiling (Article 38), a public advertising repository (Article 39), data access for regulators and vetted researchers (Article 40), an independent compliance function (Article 41), reports every six months (Article 42) and an annual supervisory fee (Article 43). Their terms also need a concise summary and must be published in the official languages of every Member State where they operate (Article 14(5) and (6)).

Standards, codes and crisis protocols (Articles 44 to 48)

The Commission supports voluntary standards, for example for the electronic submission of notices (Article 44), and encourages voluntary codes of conduct, including on online advertising and accessibility (Article 45 to 47), and crisis protocols for extraordinary situations affecting public security or public health (Article 48). These are voluntary instruments, but following them can help show diligence.

Enforcement

Each Member State appoints a Digital Services Coordinator (Article 49) and sets penalties, with fines capped at 6 % of annual worldwide turnover (Article 52). For very large platforms and search engines, the Commission can impose fines of up to 6 % of worldwide turnover itself (Article 74).

In practice

Example: a B2B file-sharing service

A Belgian SaaS company lets business customers store and share project files with selected partners. That is hosting, but the files are not disseminated to the public, so it is not an online platform. Its DSA list is short: two contact points, terms that explain what content is not allowed and how it is moderated, a notice mechanism, statements of reasons and the Article 18 duty. If it is a small enterprise, it can skip the annual transparency report.

Example: a growing marketplace

A Ghent start-up runs a marketplace where independent makers sell furniture to consumers. With twelve staff and EUR 3 million turnover, it is a small enterprise, so Articles 20 to 32 do not yet apply (except Article 24(3)). Notice and action and statements of reasons do apply. After a few years of growth it no longer qualifies as small. From the moment it loses that status, it has 12 months to have the complaint system, trusted flagger handling, misuse policy, advertising labels and the full trader checks of Article 30 in place. Building the trader onboarding flow early is cheaper than retrofitting it for thousands of existing sellers.

Steps for a platform operator

1. Qualify the service. Hosting or not, public dissemination or not, distance contracts with traders or not. Write the reasoning down.
2. Check your size. Count staff, turnover and balance sheet with linked and partner enterprises, and watch for the 12-month window after you outgrow the exclusion.
3. Rewrite the terms. Add the Article 14 content: moderation policy, use of automated tools, human review, complaint rules and, for platforms, the misuse policy of Article 23(4) and the recommender parameters of Article 27.
4. Build the workflows. Notice intake, decisions, statements of reasons, complaints and (for platforms) the out-of-court route. Log everything: the same data feeds your transparency reports.
5. Publish user numbers. Online platforms outside the exclusion publish their average monthly active recipients every six months; all platforms must provide them on request.
6. Check your seller contracts. Marketplace terms should oblige traders to provide accurate Article 30 data and keep it current, and should reflect the suspension rules.

Frequently asked questions

Does a small platform have to do anything at all?

Yes. The exclusions in Articles 19 and 29 cover the platform and marketplace sections only. Layers 1 and 2 (contact points, terms, notice and action, statements of reasons, criminal offence reporting) apply to every provider. Small providers are spared only the annual transparency report.

Is a comment section on my website an online platform?

Not if it is a minor and purely ancillary feature of the main service that cannot be used without it, as long as the integration is not a way around the Regulation (Article 3(i)). A forum that is the main attraction of the site is a platform.

We are not established in the EU. Does the DSA apply?

If you offer services to users in the EU and have a substantial connection to the Union, for instance a significant number of users in a Member State or activities targeted at one, yes. You will then need a legal representative in the EU under Article 13.

When does the very large platform regime start?

Only after the Commission designates the service, based on the user numbers it publishes or other information, and four months after the provider is notified. The 45 million figure can be adjusted when the EU population changes (Article 33(2)).

How this connects

For most platforms the DSA comes down to well-drafted terms and a working notice and complaint process. We draft and review platform terms, seller agreements and moderation policies as part of our commercial contracts work, using our Document Studio. If you sit on the other side of the notice, see brand monitoring and online enforcement and our takedown workflow. Two related topics are covered elsewhere in this series: children online, in our article on the KIDS Act proposal and age verification, and interface design, in our article on the Digital Fairness Act.

At a glance

• Provisions cited: Regulation (EU) 2022/2065, Articles 2, 3, 9 to 49, 52, 74 and 93; Recommendation 2003/361/EC, Annex, Article 2.
• Key dates: in force 16-11-2022; applies 17-02-2024; very large platform duties four months after notification of the designation.
• In this series: the DSA as a brand-protection tool; the DMA for business users; children online: the KIDS Act proposal and age verification; the Digital Fairness Act in depth.
• Related reading: how brand monitoring works.