--- title: "Digital Services Act" description: "The EU's most ambitious attempt to hold platforms accountable for what their systems do — what it requires, how it is being enforced, and the politics around it." url: https://attentionmachine.org/en/laws/dsa/ lang: en updated: 2026-10-25 license: "CC BY-NC-SA 4.0 (https://creativecommons.org/licenses/by-nc-sa/4.0/)" --- # Digital Services Act For two decades, platforms were responsible for little more than removing illegal content once told about it[^src-regulation-2022]. The DSA changes that. Whether it is enforced is a different question. ## What the DSA addresses GDPR protects personal data. Section 230 provides immunity for content. Neither addresses the core question: what responsibility do platforms bear for the effects of their own algorithmic systems? A platform recommending extremist content through its algorithm is not publishing that content — it is amplifying it. The EU Digital Services Act[^src-european-commission], signed on 19 October 2022 and applicable from February 2024[^src-regulation-2022], is the first major legislation to address this. ## What it requires Very large online platforms — those with more than 45 million monthly active users[^src-regulation-2022] in the EU — must assess and mitigate systemic risks to civic discourse, election integrity, and public health. They must provide transparency about recommendation algorithms, maintain public advertising repositories, give independent researchers genuine data access, undergo algorithmic audits, and take reasonable steps to prevent misuse for disinformation. Fines can reach 6% of global annual turnover[^src-regulation-2022] — for Meta, whose revenue in 2025 was $201 billion[^src-meta-platforms-2026], about $12 billion. > **Very large online platform (VLOP)** > > The DSA's tier for platforms with more than 45 million monthly active users in the EU — roughly a tenth of the population. VLOPs carry the heaviest obligations precisely because their scale makes their design choices a matter of public consequence rather than private business. The Commission, not national regulators, supervises them directly. > > **Sources** > > - [European Commission — Digital Services Act package](https://digital-strategy.ec.europa.eu/en/policies/digital-services-act-package). > - [Regulation (EU) 2022/2065 (Digital Services Act)](https://eur-lex.europa.eu/eli/reg/2022/2065/oj), recital 76 and Article 33(1). > **Systemic risk** > > The DSA's central innovation: instead of policing individual posts, it makes the largest platforms responsible for the _society-level_ effects of their systems — harm to elections, civic discourse, public health, fundamental rights. They must assess these risks and mitigate them. It shifts the legal question from "is this post illegal?" to "does the design of this system cause foreseeable harm at scale?" > > **Sources** > > - [European Commission — Digital Services Act package](https://digital-strategy.ec.europa.eu/en/policies/digital-services-act-package). ## First enforcement In December 2025, the Commission issued a €120 million fine to X[^src-european-commission-2025] (formerly Twitter) for breaching DSA transparency obligations: deceptive design of the verification badge, failures in the advertising repository, and limitations on researcher data access. X and Elon Musk have asked the EU General Court to annul the decision[^src-general-court-2025] (February 2026); the case is pending. A NATO StratCom study[^src-nato-2025] of harmful content posted by Polish and Lithuanian Facebook accounts before and after the DSA took effect found an overall rise of 45% in harmful posts (up in the Polish accounts, down in the Lithuanian ones) — two countries and one platform, so a signal rather than a verdict that compliance on paper and behaviour in practice can diverge. ## The politics around it At the Paris AI Action Summit in February 2025, US Vice President Vance criticised the DSA and the GDPR[^src-j-d-vance-2025] as over-regulatory. A White House memorandum[^src-white-house-2025] the same month promised tariffs and other retaliation against countries whose regulations or fines are judged to burden US technology companies. The pressure does not run in one direction. The Dutch media regulator Commissariaat voor de Media[^src-commissariaat-media-2026], in its May 2026 report concluding that feeds are "demonstrably risky for our democracy," called specifically for better enforcement of existing European legislation — the DSA. **How we know — the gap between compliance on paper and behaviour in practice** The DSA's novelty is also its difficulty: "mitigate systemic risk" is a duty about outcomes, which is harder to verify than a content rule. Early evidence is mixed. The €120 million X fine[^src-european-commission-2025] shows the transparency obligations have teeth. But a study[^src-nato-2025] comparing harmful content from Polish and Lithuanian Facebook accounts before and after the DSA took effect found an overall rise in harmful posts rather than a decline (two countries, one platform, so a signal rather than a verdict) — suggesting platforms can satisfy procedural requirements (reports filed, repositories maintained) without the underlying behaviour changing. Independent verification depends on the researcher-data-access provisions, which platforms have an incentive to grant as narrowly as possible. **Why this is contested ground.** Whether the DSA works is not yet answerable — it is new, enforcement has barely begun, and it is simultaneously under political pressure from the US administration. We present it as the most ambitious attempt to date and an open question, not as a solved problem. ## Sources [^src-european-commission]: [European Commission](https://digital-strategy.ec.europa.eu/en/policies/digital-services-act-package) — Digital Services Act package. [^src-commissariaat-media-2026]: [Commissariaat voor de Media](https://www.cvdm.nl/nieuws/nieuw-rapport-commissariaat-naar-democratisch-gezonde-feeds/), [_Naar democratisch gezonde feeds_](https://www.cvdm.nl/documents/3858/Naar_democratisch_gezonde_feeds.pdf) (May 2026). [^src-european-commission-2025]: European Commission (December 2025), [_Commission fines X €120 million under the Digital Services Act_](https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2934). [^src-general-court-2025]: General Court of the EU, [Case T-114/26](https://curia.europa.eu/juris/liste.jsf?num=T-114/26) (with T-120/26 and T-121/26), actions by X and Elon Musk against the Commission's decision of 5 December 2025, lodged 16 February 2026. [^src-nato-2025]: NATO Strategic Communications Centre of Excellence (May 2025), [_Impact of the Digital Services Act: a Facebook case study_](https://stratcomcoe.org/publications/download/Impact-of-the-Digital-Services-Act-DIGITAL.pdf) — Polish and Lithuanian accounts, 2023 versus 2024. [^src-white-house-2025]: The White House (21 February 2025), [_Defending American Companies and Innovators From Overseas Extortion and Unfair Fines and Penalties_](https://www.whitehouse.gov/presidential-actions/2025/02/defending-american-companies-and-innovators-from-overseas-extortion-and-unfair-fines-and-penalties/) — presidential memorandum. [^src-j-d-vance-2025]: J.D. Vance (11 February 2025), [_Remarks by the Vice President at the Artificial Intelligence Action Summit in Paris, France_](https://www.presidency.ucsb.edu/documents/remarks-the-vice-president-the-artificial-intelligence-action-summit-paris-france) — The American Presidency Project: the DSA's "massive regulations … about taking down content", the GDPR's "endless legal compliance costs". [^src-meta-platforms-2026]: Meta Platforms (28 January 2026), [_Meta Reports Fourth Quarter and Full Year 2025 Results_](https://www.sec.gov/Archives/edgar/data/1326801/000162828026003832/meta-12312025xexhibit991.htm) — revenue of $200.97 billion for 2025, as filed with the US Securities and Exchange Commission. [^src-centre-future]: [Centre for Future Generations](https://cfg.eu/enforcement-initiative/) — DSA Enforcement Tracker. [^src-regulation-2022]: [Regulation (EU) 2022/2065 (Digital Services Act)](https://eur-lex.europa.eu/eli/reg/2022/2065/oj) of 19 October 2022, signed at Strasbourg that day, OJ L 277, 27.10.2022 — Articles 34 and 38, systemic-risk assessment of algorithmic systems and the non-profiling recommender option; Article 93, in force on the twentieth day after publication and applicable from 17 February 2024. [Online Safety Act →](https://attentionmachine.org/en/laws/online-safety-act/)\ [AI Act →](https://attentionmachine.org/en/laws/ai-act/)\ [Age Restrictions →](https://attentionmachine.org/en/laws/age-restrictions/) --- Some content on this site was created with the assistance of AI tools and may contain errors. [How we use AI →](https://attentionmachine.org/en/about/how-we-use-ai/)