DSA (Digital Services Act) in Practice: What It Requires You to Moderate in Europe

The EU Digital Services Act (DSA) went fully into force in February 2024 and reshaped content moderation obligations for any platform serving users in the European Union, regardless of where the company is headquartered. Most of the public commentary has been about "Very Large Online Platforms" (VLOPs) like X, Meta, TikTok. But the DSA applies to much smaller platforms too, and getting the basics right is not optional.

This post translates the DSA into what you, as an engineering or product team, actually need to do.

Who does the DSA apply to?

The DSA stacks obligations by platform size:

• Any intermediary service (hosting, caching, mere conduit): baseline transparency and point-of-contact obligations.
• Hosting services: notice-and-action mechanisms, reasoned statements for content removal.
• Online platforms (user-generated content): internal complaint-handling, trusted flaggers, transparency reporting, ad transparency.
• VLOPs / VLOSEs (>45M EU monthly users): systemic risk assessments, independent audits, crisis response.

If your platform has a comment section, user profiles, chat, reviews, or uploads, even if you are a startup, you are at minimum an "online platform" under the DSA.

The concrete obligations for most platforms

1. Point of contact (Article 11/12)

A published email or endpoint where authorities and users can contact you about illegal content. "Send a tweet to our PR account" is not compliant. You need a publicly listed, monitored channel.

2. Terms of service clarity (Article 14)

Your terms must describe, in plain language, your content policies, the moderation measures you apply, and what enforcement actions you may take. Burying this in a 40-page legalese PDF is no longer good enough.

3. Notice-and-action mechanism (Article 16)

Any user must be able to report allegedly illegal content through a "user-friendly" interface. You have to act on notices "in a timely, diligent, non-arbitrary and objective manner". The interface must collect enough information to evaluate the claim.

4. Statement of reasons (Article 17)

When you remove content, restrict visibility, or suspend accounts, you must send the affected user a clear explanation. This includes:

• The action taken.
• The facts and circumstances relied upon.
• The reason (illegal content? terms-of-service violation?).
• Whether automation was used.
• The redress options available to the user.

"Your post was removed for violating community guidelines" is the kind of vague statement that does not satisfy this. You must be specific about what was violated and why.

5. Internal complaint-handling system (Article 20)

Users must be able to appeal moderation decisions. Appeals must be handled by humans (no pure-AI appeals). You must act within a "reasonable time frame".

6. Transparency reports (Article 15/24)

At minimum once per year (twice for larger platforms), publish a report with:

• Number of government orders received and acted on.
• Number of notices received under the notice-and-action mechanism.
• Your own moderation activity (own-initiative actions), broken down by category.
• Use of automated tools: accuracy, error rate, safeguards.
• Staff numbers, languages covered, training provided.

7. Trusted flaggers (Article 22)

Notices from designated "trusted flaggers" must be processed with priority. You do not designate them, national authorities do. But you need a pathway to handle their reports fast.

8. Protection of minors (Article 28)

If minors can access your platform, you must put "appropriate and proportionate measures" in place. The DSA does not prescribe specific age verification, but it does prohibit profiling-based ads to minors and expects active safety measures.

What "good enough" moderation looks like under the DSA

The DSA does not mandate specific tools or thresholds. It mandates diligent moderation with documented policies and auditable decisions. Practical implications:

• Every moderation decision must be logged with category, reason, confidence, and whether a human was involved.
• Every user-facing enforcement action must have a reasoned statement sent to the user.
• Your terms must list your moderation categories and actions.
• Your notice-and-action form must collect the information needed to act.
• You must have capacity to respond to notices and appeals within reasonable timeframes.

Penalties

The DSA allows fines of up to 6% of global annual turnover. For SMEs that sounds theoretical; for VLOPs it is existential. But enforcement to date has also shown that national regulators use proportional penalties: smaller platforms get warnings and compliance orders before fines. The real risk for smaller platforms is not the fine, it is the cost of catching up after the first enforcement letter.

A minimal DSA-compliant moderation stack

1. AI-based moderation that emits categorised, confidence-scored decisions.
2. A log of every moderated item with decision, category, confidence, timestamp, and whether a human reviewed.
3. A user notification system that sends reasoned statements on every enforcement action.
4. A notice-and-action form accessible to non-users (visitors reporting illegal content).
5. An appeals endpoint handled by humans, with SLA tracking.
6. A public transparency report pipeline that aggregates the logs quarterly.

The DSA is often described as heavy. It is heavy if you bolt it on after the fact. Designed in from the start, it maps almost 1:1 to what a competent trust & safety operation would build anyway.