{"id":116948,"date":"2026-08-05T17:07:18","date_gmt":"2026-08-05T15:07:18","guid":{"rendered":"https:\/\/www.hiig.de\/?p=116948"},"modified":"2026-08-05T17:25:55","modified_gmt":"2026-08-05T15:25:55","slug":"making-sense-of-the-digital-services-act","status":"publish","type":"post","link":"https:\/\/www.hiig.de\/en\/making-sense-of-the-digital-services-act\/","title":{"rendered":"Cards on the table: Making sense of the Digital Services Act"},"content":{"rendered":"\n

The largest providers of social media, like Meta, TikTok, or X, do not have their headquarters in the European Union, but if they want to offer their services over here, they have to play by the EU\u2019s rules. Most notably, the Digital Services Act (DSA), a regulation which became fully applicable two years ago, entails a catalogue of rules for companies that move, store, or display content online, connecting you with what or who you want to see on the Internet. This conduct lended them their label \u201cintermediary services\u201d. In a nutshell, those intermediary services, depending on their type and size, mainly have to provide a lot of information in transparency reports, assess and (at least attempt to) mitigate certain risks related to their services, and let researchers access their data to better understand the dynamics of their services. And if they fail to comply, fines can reach up to a hefty 6% of their global annual turnover. Admittedly, it took a while until the DSA came along. To reduce future reaction time and make adjustments after learning from the newly prescribed insights, it also includes a comprehensive review-and-reform mechanism, which is due next year. Looking back and forward, practical lessons have been just as plentiful as political challenges. This blogpost dives into some of the most relevant concepts of the DSA to familiarise you with the cards that have been played with varying success; and what that might teach us for the upcoming review process. Part 1 provides a reflective overview of concepts, while part 2 (to be published soon) focuses on more concrete developments and some (geo)political context affecting this ongoing development.<\/strong><\/p>\n\n\n\n

It is the early morning of 23 April 2022. An overworked coffee-machine drips into a cold pot, there are post-its all over a large conference table, and the last member of the European parliament rolls their sleeves back down after an exhausting 16 hours of trilogue negotiations over the final version of the DSA (Allen, 2022<\/a>). Globally, it is the first comprehensive piece of legislation on the digital platform landscape, and Europe\u2019s first new one since the e-Commerce Directive (ECD) of 2000. The ECD was made with the early years of the internet in mind, so mainly blogs and online shops. Even though the Internet started off with a utopian promise of a free and flourishing web society (Barlow, 1996<\/a>), the incentive structure for tech companies \u2013 fueled by the age-old advertisement-based business model that monetises attention (Pothmann, 2023<\/a>) \u2013 helped breed challenging discourse dynamics. Since back in 2000, the rise of social media, digital marketplaces, and chatbots enabled new dimensions of online communication, but also facilitated the dissemination of disinformation, illegal content, and hate speech (Turillazzi et al., 2022<\/a>). On top of this, with the advancement of opaque algorithmic tools used by those companies, it became increasingly hard to monitor them in regard to their negative effects on fundamental rights. This is where the ECD reached its limits, requiring the DSA as a novel approach to platform regulation. Not because it failed, but because the context it was meant to regulate changed. Importantly, the ECD is the European origin of the famous liability shield platforms enjoy: they are, in principle, not liable for the content users post (Cauffman & Goanta, 2021<\/a>). The DSA kept that promise (with some devils in the details), but made clear that this does not shield them from any responsibility. While this approach sounds similar to Section 230<\/a> of the US Communications Decency Act, which you might have heard in news on legal proceedings against social media platforms in the US, it is more narrow than that often generously interpreted liability shield.\u00a0<\/p>\n\n\n\n

Even though one could argue legislators slept on the need to act, the process from the initial proposal (December 2020) to final publishing (October 2022) was quite an impressive sprint for such a complex framework. Did that pressure create a diamond? Let\u2019s take a look at the mechanisms regulators enshrined into the DSA to respond to said changes.<\/p>\n\n\n\n

How does the DSA work?<\/strong><\/h2>\n\n\n\n

The DSA aims to promote \u201ca safe, predictable and trusted online environment\u201d (see Article 1<\/a>). Although it builds on some fundamental principles of earlier digital law \u2013 like bolstering fundamental rights and technological innovation via common rules \u2013 it includes novel compliance duties and risk assessments, as well as responsibilising companies with a view on how they engage with content, customers, and the public sphere. Further, it should prevent companies from just moving their headquarters to the least regulated country, a strategy called regulatory arbitrage (Pollmann, 2019<\/a>) which can be observed in the context of EU directives, a regulatory instrument that depends on a member state\u2019s proper implementation, or, of course, the absence of any EU rules at all. By harmonising rules as much as practically feasible across EU member states through a regulation, such arbitrage can be averted (Rodr\u00edguez de las Heras Ballell, 2021<\/a>). Since getting a grip on the digital economy and leveling its playing field required more than just rules on services, the regulation came as a strategic package, also including the Digital Markets Act, adding to preexisting laws on consumer, product safety, copyright, privacy, and data protection (BEUC, 2021<\/a>; Cauffman & Goanta, 2021<\/a>).\u00a0<\/p>\n\n\n\n

Transparency at its heart<\/strong><\/h2>\n\n\n\n

So what were the new rules \u201cintermediary services\u201d had to play by? Obligations depended on the type and size of those service providers, but for the most prominent suspects (Instagram, TikTok, Google, etc.), which are elegantly labelled \u201cVLOPs\u201d (very large online platforms) and \u201cVLOSEs\u201d (very large online search engines), it included risk assessments, transparency reports, establishment of transparency databases on content moderation, external auditing, and data access for researchers. So, many vague terms that we will get to shortly. Viewed together, the DSA was by many called a \u201ctransparency machine\u201d (di Stefano & Vergnolle, 2025<\/a>). This nickname is not trivial, as it gets to the core of what this risk-based regulation can most pressingly achieve: insight into what actually happens (Schaal et al., 2026<\/a>; Watolla & Kettemann, 2024<\/a>). Only with said insight can we analyse problematic conduct and dynamics to then readjust where necessary, either via updates to the DSA itself or with additional acts on the horizon, like the Digital Fairness Act<\/a>. It should also be noted that, contrary to certain public claims, it maintains a modest approach to proactive content moderation, restating a commitment to freedom of expression, privacy, and personal data protection (BEU<\/a>C<\/a>, 2021<\/a>; Kettemann & Schulz, 2026<\/a>).<\/p>\n\n\n\n

Are good intentions enough?<\/strong><\/h2>\n\n\n\n

As part of their obligations, platforms have to assess so-called systemic risks that their recommender systems, content moderation systems, advertising systems, and other \u2018data-related practices\u2019 pose. Such risks include the dissemination of illegal content, as well as negative effects on fundamental rights, democratic processes, health, minors, and more (see Article 34<\/a>). Whether the system \u2018has to\u2019 cause or \u2018just\u2019 exacerbate a negative effect on the above, is not entirely clear yet (Miller & Hendrix, 2024<\/a>; Sullivan & Pielemeier, 2023<\/a>). If a risk is identified in that process, platforms in consequence have to put in place reasonable, proportionate, and effective measures to mitigate it (see Article 35<\/a>). While this does not mean the risk has to vanish, the company should demonstrate that it put in the work to minimise it, and not just sprinkle some glitter over it. Both the assessment and mitigation measures must then be reported on in regular intervals. To the platforms\u2019 credit, they reported, even if not in a very meaningful manner. Analyses like Albert\u2019s (2024<\/a>) \u2013 a legal scholar from the University of Amsterdam and associate researcher in the HIIG\u2019s DSA research network<\/a> project \u2013 address concerns over the reports\u2019 timing, completeness, format, and transparency. Consequently, it is difficult to assess whether any of their proposed mitigation measures are appropriate to address the reported risks, if the latter are unclear in the first place.\u00a0<\/p>\n\n\n\n

The need to play with open cards<\/strong><\/h2>\n\n\n\n

In regard to the separate transparency reports on internal processes and content statistics (see Articles 15<\/a>, 24<\/a>, and 42<\/a>), the results look similar: long, complicated reports that are hard to interpret (Johnson & Roy, 2025<\/a>), deviating from the goal of a better understanding by following a \u201ccosmetic\u201d approach to compliance (di Steffano & Vergnolle, 2025<\/a>; Landau, 2019<\/a>). For example, they crafted their own, inconsistent categories for different types of harmful content and often did not link the amount of such posts to the number of related takedowns (Ohnesorge, 2025<\/a>), making it difficult to assess the effectiveness of their content moderation practices. It does present a dilemma: provide too much guidance and platforms will deliver exactly what is asked for and nothing more, but provide too vague guidance and you cannot say they did not deliver. In a way, the EU and platforms can now commence couples\u2019 therapy, expressing to each other what they understand, when the other one says \u2018reasonable\u2019. Rather unromantically, the EC published an Excel-template<\/a> for transparency reports, which could result in box-ticking compliance, while at least allowing for some level of comparability.\u00a0<\/p>\n\n\n\n

Many hands make light work?<\/strong><\/h2>\n\n\n\n

But what if, for instance, VLOPs do not manage to take “reasonable, proportionate, and effective\u201d measures to mitigate risks (see Article 35<\/a>)? In that case, the EU means business by imposing fines of up to six percent of the service provider\u2019s annual global revenue. Put into perspective, this could amount to more than five billion USD for Instagram alone (based on a projection for 2025<\/a>). Or they just altogether cut the service in the entire Union. \u2018They\u2019, in that sense, is a distributed enforcement structure between the European Commission (EC), a new European Board of Digital Services (EBDS), and so-called Digital Services Coordinators (DSCs) in each member state. For smaller platforms below 45 million users, the national DSCs wear the overseeing hat. But for our VLOPs and VLOSEs, the EC bravely took on the supervision. All of them are requested to proceed with utmost transparency, publishing updates on proceedings, which is great for us as observers. Yet this could also make enforcement difficult, as responsibilities are fragmented and the most important leverage lies within the EC, an actor under geopolitical pressure.<\/p>\n\n\n\n

So, how did it go so far?<\/strong><\/h2>\n\n\n\n

In an ideal world, a new law gets passed, addressees perfectly comply with it, and the law’s intended purpose is achieved overnight. Realistically, there are reasons laws are necessary, including powerful economic incentives that propel creativity on how to meet legal requirements at the lowest possible end. Add (geo)political differences in governing transnational platforms to the mix, and the picture immediately looks more complicated. Nevertheless, challenging enforcement should never result in regulators\u2019 resignation. And apparently, it does not, as evident in the first fines imposed on X, at 120 million Euros (European Commission, 2025<\/a>), on Temu, at 200 million Euros (European Commission, 2026<\/a>), and AliExpress, at 550 million Euros (European Commission, 2026<\/a>) \u2013 with many more proceedings in the pipeline. While this sounds astronomical, the stakes are equally enormous, considering the EU\u2019s own analysis that identified key risks related to mental health, protection of minors, generative AI, and intellectual property (European Commission, 2025<\/a>). In the second part of this blogpost (to be published soon), we will take a closer look at current proceedings and some of the political contexts these are intermeshed in.\u00a0 Who will come out on top in this cat and mouse game?<\/p>\n\n\n\n

References<\/strong><\/h2>\n\n\n\n

Albert, J. (2024, December 9). DSA risk assessment reports: A guide to the first rollout and what\u2019s next. DSA Observatory<\/em>. https:\/\/dsa-observatory.eu\/2024\/12\/09\/dsa-risk-assessment-reports-are-in-a-guide-to-the-first-rollout-and-whats-next\/<\/a><\/p>\n\n\n\n

Allen, A. (2022, April 26). <\/em>The Digital Services Act: Political Agreement Reached, Long Road Ahead Awaits. Center for Democracy & Technology<\/em>. https:\/\/cdt.org\/insights\/the-digital-services-act-political-agreement-reached-long-road-ahead-awaits\/<\/a><\/p>\n\n\n\n

Barlow, J. P. (1996, February 8). A declaration of the independence of cyberspace. Electronic Frontier Foundation<\/em>. https:\/\/www.eff.org\/cyberspace-independence<\/a><\/p>\n\n\n\n

BEUC (2021). The Digital Services Act proposal<\/em> [Position paper]. Bureau Europ\u00e9en des Unions de Consommateurs AISBL. https:\/\/www.beuc.eu\/sites\/default\/files\/publications\/beuc-x-2021-032_the_digital_services_act_proposal.pdf<\/a><\/p>\n\n\n\n

Bovermann, M. (2025, December 18). The limits of symbolic regulation: Why the EU should not enforce the DSA (right now). Verfassungsblog<\/em>. https:\/\/verfassungsblog.de\/the-limits-of-symbolic-regulation<\/a><\/p>\n\n\n\n

Cauffman, C., & Goanta, C. (2021). A new order: The Digital Services Act and consumer protection. European Journal of Risk Regulation<\/em>, 12<\/em>(4), 758\u2013774.<\/p>\n\n\n\n

di Stefano, S., & Vergnolle, S. (2025, December 5). Hack the DSA:\u00a0Four actionable ways to improve DSA reporting. Verfassungsblog. https:\/\/verfassungsblog.de\/dsa-transparency-eu-moderation\/<\/a><\/p>\n\n\n\n

Johnson, A., & Roy, P. (2025). EU should improve transparency in the Digital Services Act<\/em>. Information Technology & Innovation Foundation. https:\/\/itif.org\/publications\/2025\/10\/20\/eu-should-improve-transparency-in-the-digital-services-act\/<\/a><\/p>\n\n\n\n

Kettemann, M. C., & Schulz, W. (2026, July 7). Between accusations of censorship and platform power: What the Digital Services Act actually regulates. Digital Society Blog<\/em>. https:\/\/www.hiig.de\/en\/between-accusations-of-censorship-and-platform-power\/<\/a><\/p>\n\n\n\n

Landau, I. (2019). Human rights due diligence and the risk of cosmetic compliance. Melbourne Journal of International Law<\/em>, 20<\/em>, 1\u201327.<\/p>\n\n\n\n

Leerssen, P. (2023, January 30). Counting the days: What to expect from risk assessements and audits under the DSA \u2013 and when? DSA Observatory<\/em>. https:\/\/dsa-observatory.eu\/2023\/01\/30\/counting-the-days-what-to-expect-from-risk-assessments-and-audits-under-the-dsa-and-when\/<\/a><\/p>\n\n\n\n

Lievens, E., Shala, V., & Verdoodt, V. (2026, March 2). Just one more video\u2026 Down the (legal) rabbit hole of TikTok\u2019s addictive design. Verfassungsblog<\/em>. https:\/\/verfassungsblog.de\/tiktok-dsa\/<\/a><\/p>\n\n\n\n

Miller, G., & Hendrix, J. (2024, October 6). Assessing systemic risk under the Digital Services Act. Tech Policy Press<\/em>. https:\/\/www.techpolicy.press\/assessing-systemic-risk-under-the-digital-services-act\/<\/a><\/p>\n\n\n\n

Ohnesorge, J. (2025, September 25). Counting without accountability? An analysis of the DSA\u2019s transparency reports. Digital Society Blog<\/em>. https:\/\/www.hiig.de\/en\/analysis-of-the-dsas-transparency-reports\/<\/a><\/p>\n\n\n\n

Ollig, C. (2025). Report on the Academic Round Table, 30 April 2024, New York City: Freedom of Online Communication Across Transatlantic Borders. GRUR International<\/em>, 74<\/em>(1), 57\u201360.<\/p>\n\n\n\n

Pingen, A. (2025). Overview of the latest developments on the DSA: May \u2013 Mid-October 2025. Eucrim<\/em>, 2<\/em>, 120\u2013122.<\/p>\n\n\n\n

Pollmann, E. (2019). Tech, regulatory arbitrage, and limits. European Business Organization Law Review<\/em>, 20<\/em>, 567\u2013590.<\/p>\n\n\n\n

Pothmann, D. (2023, August 16). The consent fallacy. Digital Society Blog<\/em>. https:\/\/www.hiig.de\/en\/the-consent-fallacy\/<\/a><\/p>\n\n\n\n

Rodr\u00edguez de las Heras Ballell, T. (2021). The background of the Digital Services Act: Looking towards a platform economy. ERA Forum<\/em>, 22<\/em>, 75\u201386.<\/p>\n\n\n\n

Schaal, J., Lenner, M., & Akinyemi, T. (2026, February 20). Searching for answers: Why the EU Commission should designate chatbots as search engines under the DSA. Verfassungsblog<\/em>. https:\/\/verfassungsblog.de\/searching-for-answers\/<\/a><\/p>\n\n\n\n

Sullivan, D., & Pielemeier, J. (2023, July 19). Unpacking \u201cSystemic Risk\u201d under the EU\u2019s Digital Services Act. Tech Policy Press<\/em>. https:\/\/www.techpolicy.press\/unpacking-systemic-risk-under-the-eus-digital-service-act\/<\/a><\/p>\n\n\n\n

Turillazzi, A., Taddeo, M., & Floridi, L. (2022). The Digital Services Act: An analysis of its ethical, legal, and social implications. Law, Innovation Technology<\/em>, 15<\/em>(1), 83\u2013106.<\/p>\n\n\n\n

Watolla, A.-K., & Kettemann, M. C. (2024, July 18). Navigating platform power: From European elections to the regulatory future. Digital Society Blog<\/em>. https:\/\/www.hiig.de\/en\/dsa-navigating-platform-power\/<\/a><\/p>\n