Key Takeaways
- Broad scope: The DSA became fully applicable on 17 February 2024 to all online intermediary services providers falling within its scope.
- Service types covered: The DSA covers "mere conduit" services, "caching" services and "hosting" services (including online platforms and online marketplaces) as well as online search engines.
- Geographic reach: The extraterritorial application of the DSA means that it also applies to non-EU organisations that target the EU market or that have a significant number of EU users.
- VLOP/VLOSE threshold: Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) are digital services that reach more than 45 million average monthly active users in the European Union.
- Exemptions: Small companies and micro enterprises (with fewer than 50 employees and less than €10 million in annual sales) are exempt from complying with some of the DSA's obligations.
Introduction
Determining whether the DSA applies to your platform is no longer optional—it's a fundamental compliance requirement. Since February 2024, all online intermediary services operating in the EU must assess their DSA obligations, which vary dramatically based on service type, user volume, and company size. The question of "does the DSA apply to my platform?" affects everything from your compliance budget to your liability exposure. This guide walks through the key criteria that determine applicability, helping you classify your service and understand your obligations.
Understanding the DSA's Scope: Which Services Are Covered?
The DSA applies a funnel-like approach to regulation. The DSA applies in a funnel-like manner with certain obligations applying to all intermediary services providers (ISPs) and certain other cumulative obligations arising depending on the specific intermediary services being provided and the number of recipients of those services.
The Core Definition: Intermediary Services
At its core, the DSA regulates "intermediary services"—but this definition is broader than many operators realize. The definition of intermediary services is quite broad and catches from internet provision services to online platforms.
The DSA addresses "intermediary services" and thus has a broad scope of application. It covers "mere conduit" services, "caching" services and "hosting" services (including online platforms and online marketplaces) as well as online search engines.
Three Main Categories of Intermediary Services
Understanding which category your service falls into is the first step in determining your DSA obligations:
- Mere conduit services: Services of mere conduit transmit information provided by recipients into a communication network or open access to such a network without being connected to the transmitted information. Examples include internet exchange nodes, wireless access points, and VPNs.
- Caching services: These temporarily store content to optimize delivery without active involvement in managing that content.
- Hosting services: Hosting services must establish a mechanism to enable third parties to notify the presence of allegedly illegal content. This category encompasses social networks, marketplaces, content-sharing platforms, and cloud computing providers.
Geographic Applicability: Does It Matter Where You're Established?
One critical misunderstanding: you don't need to be based in the EU for the DSA to apply. The remainder of the DSA, which entered into force on 17 February, contains broader rules that are applicable to all "online intermediary services providers" defined as providers of "mere conduit", "caching" or "hosting services", whether or not they are established in Europe.
DSA applies regardless of the establishment or location of the business. If you offer your services within the EU, DSA applies. This extraterritorial reach means that US platforms, Asia-based services, and other non-EU operators must comply with DSA rules if they serve EU users.
B2B Platforms: A Common Misconception
Many B2B platform operators believe they're outside DSA scope because they don't directly serve consumers. This assumption is incorrect.
Many B2B platform operators assume they're safely outside DSA territory because they don't deal with consumers. This assumption misses how broadly the DSA defines its scope. The regulation covers intermediary services offered to recipients of the service in the EU, with recipients of the service including "business users, consumers and other users". Therefore, in addition to B2C platforms, pure B2B platforms are also covered by the DSA.
Whether your platform connects businesses with goods, services, or content, if it operates in the EU, DSA obligations apply. The level of those obligations depends on your user volume and company size, but the applicability is universal across both B2C and B2B models.
The VLOP/VLOSE Threshold: The Critical 45 Million User Mark
For most compliance discussions, the 45 million threshold becomes the pivotal point. The DSA classifies platforms or search engines that have more than 45 million users per month in the EU as very large online platforms (VLOPs) or very large online search engines (VLOSEs).
How Designation Works
The European Commission designates these platforms based on user numbers that providers must report every six months. Once the Commission designates a platform as a VLOP or search engine as a VLOSE, the service has four months to comply with the Digital Services Act requirements.
This timeline is important: designation doesn't give you the full implementation grace period that smaller operators enjoyed. Once the Commission designates a platform as a VLOP or a search engine as a VLOSE, the designated online service has 4 months to comply with the DSA. The designation triggers specific rules that tackle the particular risks such large services pose to Europeans and society when it comes to illegal content, and their impact on fundamental rights, public security, and wellbeing.
What Happens If You Fall Below the Threshold?
The Commission will revoke its decision if the platform or search engine does not reach the threshold of 45 million monthly users anymore during one full year. However, don't assume you can artificially deflate user numbers—platforms must publish transparent methodologies for calculating their monthly active users, with updates every six months.
Micro and Small Enterprise Exemptions: When You Might Get Relief
The DSA includes proportionality mechanisms for smaller operators, though these exemptions come with important caveats.
Which Obligations Are You Exempt From?
Small companies and micro enterprises (with fewer than 50 employees and less than €10 million in annual sales) are exempt from complying with some of the DSA's obligations. These include obligations for providers of online platforms as well as transparency reporting obligations of providers of intermediary services.
However, baseline obligations in Sections 1-2 (points of contact, terms of service basics, notice and action mechanisms) apply universally regardless of size, ensuring fundamental accountability standards apply to all providers. So even if you're a micro-enterprise, you still must designate a legal representative, maintain terms of service, and establish contact points for authorities.
The VLOP Exception: Size Doesn't Matter
Here's the critical caveat: The exemption does not apply if companies – despite their small size – qualify as VLOPs or VLOSEs. A small team operating a platform that reaches 45+ million EU users cannot claim micro-enterprise exemptions from VLOP-level obligations. Size is irrelevant at the VLOP threshold.
Non-EU Companies: Special Considerations
If you're outside the EU but serve EU users, you face a unique set of requirements. While the DSA may, at first blush, seem to cover only Big Tech, many ordinary and smaller online services, including apps and websites that facilitate the sharing of user generated content, may come under the definition of intermediary services.
You'll need to designate a legal representative in the EU to act as your formal contact point with regulators. The DSA representative can be held liable for non-compliance with the regulation and, therefore, is not a role to be taken lightly. The cost of such representation can be a burden for smaller companies. Fortunately, it is possible that a legal representative is appointed, in accordance with national law, by more than one provider of intermediary services.
Determining Your Actual User Count: The Methodology Challenge
Reporting your monthly active user (MAU) count correctly is crucial because it determines your classification. Providers of online services have to update the published information on their MAR numbers once every six months from now on.
The methodology you use must be transparent, documented, and defensible to regulators. It's not sufficient to guess based on general traffic—you need to establish clear, auditable processes for counting EU-based monthly active users specifically.
Related Compliance Topics
Once you've established that the DSA applies to your platform, your next steps depend on your classification. For VLOPs and VLOSEs, you'll need to understand obligations around recommender system transparency, independent audits, and systemic risk assessments. All platforms must comply with transparency reporting and statements of reasons requirements. Larger platforms may need to facilitate researcher data access. For practical insights into enforcement, review recent case studies in fines and penalties to understand the financial stakes. To understand the broader regulatory context, see our comprehensive guide to the DSA's definition, scope, and objectives. For the latest articles across all DSA topics, check out the blog.
Frequently Asked Questions
Does the DSA apply if I only serve a specific country, not all of Europe?
Yes. The DSA applies to any intermediary service offering services within EU territory, regardless of whether you serve all member states or just one. If users in any EU country can access your service, you must comply.
My platform is small but growing rapidly. Should I prepare for VLOP status now?
Yes. If you're approaching the 45 million threshold, start evaluating and preparing your compliance infrastructure now. The four-month grace period after Commission designation isn't much time for the comprehensive changes required. Proactive preparation prevents costly emergency implementation efforts.
Can I claim micro-enterprise exemption if my team is small but my user base is huge?
No. If you reach 45 million EU monthly users, you're classified as a VLOP or VLOSE regardless of your employee count or annual revenue. The 45 million threshold overrides all micro-enterprise exemptions.
How do I calculate my monthly active users correctly for DSA purposes?
You must establish a documented, transparent methodology that counts unique EU-based users with activity during a calendar month. Work with your analytics and legal teams to ensure consistency and auditability. Many platforms publish their methodology alongside their user count declarations.
Do I need compliance if I have an EU representative but no physical presence in Europe?
Yes. Your place of establishment doesn't matter. If you offer services accessible to EU users, you must comply. The EU representative is required, but their presence doesn't exempt you from substantive DSA obligations—it just ensures there's a named party responsible for compliance.
What's the difference between a VLOP and a VLOSE?
Both require 45+ million EU monthly users. VLOPs are very large online platforms (social networks, marketplaces, content-sharing services). VLOSEs are very large online search engines. Some platforms may qualify as both if they operate integrated search functionality. The obligations differ slightly based on each category's specific risks.
Conclusion
Determining whether the DSA applies to your platform is the essential first step toward compliance. The answer for most operators is straightforward: if you operate an intermediary service accessible to EU users, the DSA applies. Your classification—whether as a general hosting provider, platform operator, search engine, micro-enterprise, or VLOP/VLOSE—determines the scope of your obligations, but not whether you have obligations at all.
Start by documenting your service type and current EU user volume. If you're growing or approaching the 45 million threshold, begin building your compliance infrastructure now. The regulatory landscape is clear, enforcement is active, and penalties can reach up to 6% of global annual turnover. Getting this assessment right isn't optional—it's a fundamental business requirement for any platform serving European users.