Professor Steve Peers, Royal Holloway University of London
Photo credit: Animated Heaven, via Wikimedia Commons
Introduction
The EU’s Digital Services Act (DSA) sets out rules for regulating online platforms and search engines. The following sets out a summary of what the Act does, and links to key resources. It draws upon (and updates) a blog post on the Commission’s first non-compliance decision under the Act. This post will be updated. (First update: 18 October 2026; new developments since February 2026 are in bold and underline)
Overview of the Digital Services Act
The DSA contains rules that govern online platforms generally, regardless of size, but its most prominent rules concern a special regulatory regime for the biggest platforms, defined as ‘very large online platforms’ (VLOPs) and ‘very large online search engines’ (VLOSEs), which subjects them to greater regulation. The Act gives the EU Commission power to designate such platforms and search engines (on the basis that 10% of the EU population visit them monthly) and to enforce the provisions of the DSA against them. Other online platforms or search engines are subject to fewer obligations under the DSA, and enforcement of these rules is carried out by Member States' authorities.
The Commission’s list of designated VLOPs and VLOSEs includes US companies (including Meta, X, Google, LinkedIn), and also Chinese companies (AliExpress, TikTok, Temu, Shein), EU companies (Booking.com, Zalando, and two porn sites), and a Canadian site, Pornhub. Overall, nearly half of the companies designated as operating VLOPs and VLOSEs are non-American (although some of the American companies operate more than one platform). The list was most recently updated in August 2026, to add ChatGPT as a VLOSE, and Roblox and Reddit as VLOPs.
For VLOPs, enforcement of the DSA involves a number of measures, including requests for information, a start of an investigation into possible breach of the Act, a preliminary finding of a breach, and a final decision finding a breach – which can result in a fine (of up to 6% of worldwide annual turnover) and orders to change practices. A VLOP or VLOSE can also agree avoid a fine by agreeing binding commitments to change its practices with the Commission (in effect, a settlement) before it reaches a final decision. If a finding of breach is not complied with, the Commission can impose very high fines – up to 5% of worldwide annual turnover per day.
The Act imposes a very high threshold before a ban can be imposed against a platform – essentially a refusal to remove illegal content, with additional safeguards including involvement of a court.
The case law has not yet fleshed out the relationship between the DSA and Member States’ laws on overlapping issues, or clarified whether there can be private enforcement of the DSA (ie individuals challenging the VLOPs and VLOSEs in court for breach of the Act, rather than the Commission enforcing it; or similarly individuals challenging smaller platforms or search engines, rather than Member States' authorities) in parallel. Nor has the case law yet discussed any potential overlap with other EU law.
Substantively, the Act’s requirements on VLOPs and VLOSEs (in its Articles 33-43) start with risk assessment: they must ‘diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of their service and its related systems, including algorithmic systems, or from the use made of their services’. Systemic risks are further defined as including ‘dissemination of illegal content through their services’, ‘negative effects’ upon various human rights, ‘actual or foreseeable negative effects on civic discourse and electoral processes, and public security’, and ‘actual or foreseeable negative effects in relation to gender-based violence, the protection of public health and minors and serious negative consequences to the person’s physical and mental well-being’.
Very large platforms and search engines are also obliged to (as further defined): mitigate these risks; comply with a decision requiring a response to a crisis; perform independent audits; offer a recommender system not based on profiling, at least as an option; make public a repository of advertising data; provide access to their data to researchers; explain their algorithms to regulators; establish independent compliance bodies; provide further public data on their operations; and pay an annual supervisory fee to the EU Commission.
The DSA also includes rules exempting online platforms from intermediary liability for transmitting content under certain circumstances, taking over the relevant provisions previously in the e-commerce Directive.
The September 2026 proposal for an EU KIDS Act, which would set out specific rules on child protection online, is closely linked to the DSA but would not amend it as such.
The DSA in the EU courts
Challenges to designations as a VLOP
Amazon, Zalando, Google Shopping and several porn sites have challenged their designation as VLOPs.
- Zalando lost its challenge in the EU General Court in September 2025, but has appealed to the EU’s Court of Justice (appeal pending)
- Amazon also lost its challenge in the EU General Court against designation as a VLOP, and has appealed to the CJEU (the Commission has cross-appealed)
- Amazon had won an interim measures ruling in this case – delaying its obligation to publish information about its advertisers – but that interim measure was overturned by the Court of Justice, following a successful appeal by the Commission)
- Four porn companies brought legal challenges to their designations as VLOPs. A challenge by Pornhub is still pending (a hearing was held in November 2025). A challenge by Stripchat was rejected by a judgment of the EU General Court in October 2026. (Stripchat went to court even though the Commission dropped its designation as a VLOP). Two other challenges - by XVideos and XNXX - were withdrawn in early 2026.
- The porn companies’ applications for interim measures as regards publishing advertisers’ information were dismissed (see the General Court orders re Pornhub and XVideos, and the failed appeals to the Court of Justice as regards Pornhub and XVideos).
Google Shopping is challenging the Commission's refusal to remove its designation as a VLOP.
Regulation fees
The Commission’s decisions on fees for regulation have also been challenged. First of all, two challenges to the fees imposed for 2023 were both successful in the EU General Court (see the judgments as regards Tiktok and Meta), although the Commission has appealed both the Tiktok and Meta judgments to the Court of Justice (appeals pending; the hearings in these two appeals are scheduled for 12 November 2026).
In the meantime, Tiktok, Meta and Google have brought a second round of legal challenges (all still pending) to the regulation fees imposed for 2024.
A third round of cases includes challenges (also all still pending) by Google, TikTok, Amazon, Meta, Stripchat and Zalando to the supervisory fees for 2025.
Non-compliance decisions
X, X.AI and Elon Musk have challenged the December 2025 non-compliance decision against X (cases pending).
Temu and AliExpress have each challenged the 2026 findings of breach against them (cases pending).
Other enforcement
Pornhub's corporate parent has challenged the extension of the investigation of Pornhub (case pending).
Access to documents
In October 2026, the EU General Court ruled against Zalando in a dispute about the Commission's refusal to disclose documents related to the DSA.
Infringement actions
The Commission is suing Spain, Portugal, the Czech Republic and Poland for non-enforcement of their obligations to apply the DSA at national level (cases pending).
Enforcement of the DSA
Non-compliance decisions
So far, the EU Commission has adopted three final decisions for non-compliance with the DSA.
First, it adopted a final decision of non-compliance against X in December 2025, following its preliminary findings in July 2024.
This decision includes a fine to enforce the DSA for the first time: €120 million for three breaches of the Act by X. It concerns certain issues, namely deceptive practices as regards X’s ‘blue ticks’,* researchers’ access to data, and the repository of advertisers.
The Commission subsequently accepted corrective measures from X in July 2026 to address the second and third of these issues, but these corrective measures do not address the 'blue tick' issue.
Second, in May 2026 the Commission fined Temu €200 million for breach of the DSA as regards failed risk assessment on the sale of illegal products. (See previously the preliminary finding in this case)
Third, in July 2026 the Commission fined AliExpress €550 million for breach of the DSA, again regarding failed risk assessments on the sale of illegal products.
Other enforcement actions
Other Commission enforcement actions under the DSA include:
- The Commission has opened proceedings against X on other issues besides those that led to a non-compliance decision, first of all the dissemination of illegal content and the effectiveness of rules against disinformation. In January 2026, the Commission opened proceedings against X on further issues: its recommender systems and ‘nudification’ apps;
- Similarly, in addition to the non-compliance decision against Temu as regards illegal products, an investigation continues as regards other issues;
- It has adopted a preliminary finding that Meta (Facebook and Instagram) is in breach as regards researchers’ access to data, and as regards flagging illegal content and allowing for appeals against content moderation decisions; a later preliminary finding in April 2026 found a breach as regards access to by children under 13; and a further preliminary finding in July 2026 found Meta (Facebook and Instagram) in breach as regards risk assessment and risk mitigation of addictive design. An investigation as regards deceptive advertising, political data, and misinformation on Meta is still underway;
- It has accepted a commitment from TikTok to suspend the ‘TikTok Lite’ programme, which was apparently designed to (further) encourage social media addiction by children, having used the threat of issuing an intention to impose interim measures under the DSA earlier on in this case. Another decision, following a preliminary finding, accepts further commitments regarding information on advertisers;
- The Commission has also adopted a preliminary finding against TikTok as regards researchers’ access to data, a preliminary finding of breach as regards addictive design, and a preliminary finding of breach in July 2026 as regards childrens' accounts;
- It has begun an investigation of Shein for illegal content (child sex dolls), recommender systems and addictive design; and
- It began an investigation of Snapchat in March 2026 for breach of child protection rules.
Great article, has there been a lot of cases that have been privately inforced rather than by the comission or the designated national agencies? Thanks a lot in advance.
ReplyDeleteThanks, there's not much information available on private enforcement so far, there is some litigation against social media companies but it may be relying on other areas of law, such as tort law.
Delete