← Laws & Regulation

Digital Services Act

For two decades, platforms were responsible for little more than removing illegal content once told about it. The DSA changes that. Whether it is enforced is a different question.

How to read this page. Tap any underlined word to see the precise legal term and a short definition. Expand any "Deeper" box for the evidence and contested points. The main text works on its own — you can skip both and still get the whole argument.

What the DSA addresses

GDPR protects personal data. Section 230 provides immunity for content. Neither addresses the core question: what responsibility do platforms bear for the effects of their own algorithmic systems? A platform recommending extremist content through its algorithm is not publishing that content — it is amplifying it. The EU Digital Services Act, signed on 19 October 2022 and applicable from February 2024, is the first major legislation to address this.

What it requires

Very large online platforms — those with more than 45 million monthly active users in the EU — must assess and mitigate systemic risks to civic discourse, election integrity, and public health. They must provide transparency about recommendation algorithms, maintain public advertising repositories, give independent researchers genuine data access, undergo algorithmic audits, and take reasonable steps to prevent misuse for disinformation. Fines can reach 6% of global annual turnover — for Meta, whose revenue in 2025 was $201 billion, about $12 billion.

First enforcement

In December 2025, the Commission issued a €120 million fine to X (formerly Twitter) for breaching DSA transparency obligations: deceptive design of the verification badge, failures in the advertising repository, and limitations on researcher data access. X and Elon Musk have asked the EU General Court to annul the decision (February 2026); the case is pending. A NATO StratCom study of harmful content posted by Polish and Lithuanian Facebook accounts before and after the DSA took effect found an overall rise of 45% in harmful posts (up in the Polish accounts, down in the Lithuanian ones) — two countries and one platform, so a signal rather than a verdict that compliance on paper and behaviour in practice can diverge.

The politics around it

At the Paris AI Action Summit in February 2025, US Vice President Vance criticised the DSA and the GDPR as over-regulatory. A White House memorandum the same month promised tariffs and other retaliation against countries whose regulations or fines are judged to burden US technology companies.

The pressure does not run in one direction. The Dutch media regulator Commissariaat voor de Media, in its May 2026 report concluding that feeds are "demonstrably risky for our democracy," called specifically for better enforcement of existing European legislation — the DSA.

How we know — the gap between compliance on paper and behaviour in practice +

The DSA's novelty is also its difficulty: "mitigate systemic risk" is a duty about outcomes, which is harder to verify than a content rule. Early evidence is mixed. The €120 million X fine shows the transparency obligations have teeth. But a study comparing harmful content from Polish and Lithuanian Facebook accounts before and after the DSA took effect found an overall rise in harmful posts rather than a decline (two countries, one platform, so a signal rather than a verdict) — suggesting platforms can satisfy procedural requirements (reports filed, repositories maintained) without the underlying behaviour changing. Independent verification depends on the researcher-data-access provisions, which platforms have an incentive to grant as narrowly as possible.

Why this is contested ground. Whether the DSA works is not yet answerable — it is new, enforcement has barely begun, and it is simultaneously under political pressure from the US administration. We present it as the most ambitious attempt to date and an open question, not as a solved problem.

Online Safety Act →
AI Act →
Age Restrictions →