How the EU's Digital Services Act polices the biggest online platforms

The Digital Services Act (DSA) is the European Union's rulebook for online services that people in the EU use every day, including marketplaces, social networks, app stores and travel and accommodation platforms. Its strictest duties fall on platforms and search engines with more than 45 million monthly users in the EU, which the European Commission designates and supervises directly. Those services must assess and reduce the risks they create, and the Commission can fine them up to 6% of their global annual turnover. The DSA has applied in general since February 17, 2024.

Who is covered

Every online service operating in the EU must comply, but the obligations scale with a service's role, size and impact, and micro and small companies have lighter requirements. The DSA replaces 27 different regulations with one framework, the Commission says.

The top tier is made up of very large online platforms (VLOPs) and very large online search engines (VLOSEs). The Commission has designated 25 VLOPs and 3 VLOSEs. A designated service must meet the extra obligations four months after it is notified of its designation. National authorities, called Digital Services Coordinators, supervise the other platforms established in their countries, and the Commission handles the additional duties of the largest ones.

What the biggest platforms must do

Very large platforms must identify and analyze widespread risks and then put measures in place to reduce them. The Commission lists four kinds of risk:

• The spread of illegal content, as defined in national or EU law
• Threats to fundamental rights, such as freedom of expression
• Threats to media freedom and pluralism, public security and electoral processes
• Gender-based violence, public health, the protection of minors, and physical and mental wellbeing

Users also get specific rights. Platforms must explain why they remove or suspend content and let users appeal, including to out-of-court dispute settlement bodies. They may not show targeted ads to children or target ads using sensitive data such as sexual orientation, religion or race, and deceptive designs known as dark patterns are banned. Marketplaces must verify and display sellers' contact details. On platforms with more than 45 million monthly EU users, people can choose feeds that are not personalized, and those platforms must keep ad information in a public repository.

How enforcement works

The Commission's enforcement follows a set sequence, each step with its own sanctions:

1. Monitoring and requests for information. A platform that gives an incorrect, misleading or incomplete reply can be fined up to 1% of its worldwide annual turnover.
2. Formal proceedings. The Commission can order access to a platform's data and algorithms, interview people with their consent and inspect premises.
3. Preliminary findings. The platform has the right to be heard before any final decision.
4. A non-compliance decision. Fines cannot exceed 6% of global annual turnover. The Commission can order fixes, set a period of enhanced supervision, and impose periodic penalties of up to 5% of average daily worldwide turnover for each day of delay. Decisions can be appealed to the EU courts.
5. A last resort. If an infringement persists, causes serious harm and involves criminal offenses that threaten people's life or safety, the Commission can ask for a temporary suspension of the service, which must be ordered by a judge in the country where the provider is established.

The Commission can also adopt interim measures before a final decision when there is an urgent risk of serious damage to users, such as changes to recommender systems or increased monitoring of certain keywords. Opening an investigation does not mean a platform has broken the law, the Commission notes.

A worked example: Temu

Temu, run in the EU by Whaleco Technology Limited, reports 75 million average monthly active users in the EU. The Commission designated it a very large online platform on May 31, 2024, opened formal proceedings on October 31, 2024, and issued preliminary findings on July 28, 2025.

On May 28, 2026, the Commission fined Temu €200 million for not diligently identifying, analyzing and assessing the systemic risks posed by illegal products sold on its platform. It found that Temu's 2024 risk assessment relied on general information about e-commerce rather than evidence about Temu's own service, badly underestimated how likely EU shoppers are to come across illegal items, and did not properly assess how its recommender systems and influencer promotion programs could spread them. In a mystery shopping exercise carried out for the investigation, chargers chosen for testing failed basic safety checks at a very high rate.

On October 26, 2026, the Commission accepted Temu's action plan. Temu will carry out a risk analysis specific to its platform, using reliable metrics to judge whether its safeguards work. It will assess the limits of its content moderation, whether its recommender systems amplify illegal goods, and how sellers exploit its features to spread potentially illegal listings. The plan sets out five measures in all. Temu has four months to deliver an interim risk assessment covering a six-month period that runs to November 30, 2026.

What comes next

On October 21, 2026, the Commission opened formal proceedings against Booking.com. It will assess whether the platform diligently assessed and mitigated the risks of fraudulent listings and phishing scams, and whether it failed to label paid-for boosted listings clearly as ads. The Commission is also consulting banks, platforms and others on a possible voluntary code of conduct on online fraud and scams. The DSA works alongside a separate law, the Digital Markets Act, which sets rules for the gatekeeper platforms that sit between businesses and consumers.