What is the Digital Services Act?
The EU rulebook for hosting services and online platforms: how illegal content is reported and removed, and how the largest platforms are supervised.
General information about EU and US law for readers of tool reviews, not legal advice. Questions: editorial@clothoff.ai.
The Digital Services Act (DSA) is Regulation (EU) 2022/2065, the European Union’s law on intermediary services, fully applicable since February 17, 2024. It requires hosting services to run notice-and-action mechanisms for illegal content, explain removal decisions and offer complaint handling, with duties scaled by size and fines of up to 6% of worldwide turnover.
Key provisions at a glance
Checked against the linked sources on September 3, 2026; no editor scores here (how we rate).
| Law | Effective date | What it covers | Penalty | Source |
|---|---|---|---|---|
| Art. 6 — hosting liability | Feb 17, 2024 | No liability until the host knows and fails to act expeditiously | Up to 6% of worldwide turnover | EUR-Lex |
| Art. 16 — notice and action | Feb 17, 2024 | Electronic reporting of illegal content, confirmation, reasoned decision | Up to 6%; 1% for missing information | EUR-Lex |
| Art. 17 and 20 — reasons, complaints | Feb 17, 2024 | Statement of reasons; internal complaints open at least six months | Up to 6% | EUR-Lex |
| Art. 22 — trusted flaggers | Feb 17, 2024 | Priority handling of notices from certified organizations | Up to 6% | Commission |
| Art. 33 — very large platforms | Four months after designation | Risk assessments and audits above 45 million monthly EU users | Commission fines up to 6%; periodic penalties up to 5% of daily turnover | Commission |
How does the DSA work?
The regulation replaces 27 national regimes with one set of rules scaled by role and size. Under Article 6 a host is not liable for user content until it obtains knowledge of illegality and fails to act expeditiously. Hosting services add notice-and-action; online platforms add complaint handling, trusted flaggers and transparency reports; very large platforms with at least 45 million monthly EU users add systemic-risk assessments supervised by the European Commission.
Enforcement is active: the Commission fined AliExpress €550 million on July 20, 2026 for failing to mitigate risks from illegal products.
What must a notice-and-action mechanism do?
Article 16 requires an easy, electronic mechanism. A complete notice explains why the content is illegal, gives the exact URL, includes the reporter’s name and email, and confirms good faith. The host confirms receipt, decides in a timely and non-arbitrary way, and tells the reporter about the decision and redress.
Article 17 requires a statement of reasons for removals or suspensions, and Article 20 keeps an internal complaint system open for at least six months. This is the EU counterpart of the US DMCA safe harbor, but for all illegal content rather than copyright alone.
Does the DSA apply to undress apps and to this site?
An undress app that lets users upload and share images in the EU is a hosting service, so it must offer an Article 16 route for reporting non-consensual intimate imagery. Each review on this site records that route in the “Route to remove an image” row, compared in the removal guide.
Clothoff AI hosts no user content, so most DSA duties do not attach to it. The site still mirrors the structure: a report form, a dedicated NCII form with a 48-hour target, and a periodic transparency report.
How does the DSA compare with US law?
US intermediaries rely on Section 230, which shields platforms from most liability without imposing procedures. The DSA keeps a similar shield but conditions it on procedures. For intimate imagery the United States has moved closer to that model: the TAKE IT DOWN Act requires covered platforms to remove reported NCII within 48 hours. Both frameworks sit alongside the EU AI Act, which adds labeling duties for synthetic content. This page is general information, not legal advice.
Sources
All sources accessed September 3, 2026.
- Regulation (EU) 2022/2065, Articles 3, 6, 16, 17, 20, 22, 33, 52 — EUR-Lex
- The Digital Services Act package — European Commission
- Regulation (EU) 2024/1689 (AI Act) — EUR-Lex
- 47 U.S.C. §230 — Legal Information Institute
- 17 U.S.C. §512 (DMCA) — Legal Information Institute
- TAKE IT DOWN Act, S.146 — Congress.gov
Corrections: editorial@clothoff.ai · Editorial policy
Frequently asked questions
When did the Digital Services Act take effect?
Regulation (EU) 2022/2065 was published on October 27, 2022, applied to designated very large platforms first, and became fully applicable to all intermediary services on February 17, 2024. Each Member State had to designate a Digital Services Coordinator by that date to handle complaints and enforcement.
What counts as illegal content under the DSA?
Article 3(h) defines it as any information that does not comply with EU law or with the law of a Member State in compliance with EU law. The DSA creates no new offenses; it tells platforms how to handle content other laws already make illegal, including non-consensual intimate images.
Does the DSA require removal within a fixed deadline?
No fixed clock. Article 16(6) requires decisions in a timely, diligent, non-arbitrary and objective manner, and Article 6 removes the liability shield once a host has knowledge and fails to act expeditiously. By contrast, the US TAKE IT DOWN Act sets an explicit 48-hour window for NCII.
What is a trusted flagger?
Under Article 22, a trusted flagger is an entity certified by a Digital Services Coordinator for expertise and independence in a subject area. Online platforms must give its notices priority and process them without undue delay. Organizations fighting image-based abuse can seek the status to speed up removals.
Can a small US website be fined under the DSA?
Only if it offers intermediary services to EU users. A publisher that hosts no user content and stores no images, like this site, falls largely outside the obligations, and micro and small companies get lighter duties. Fines are set by Member States and capped at 6% of worldwide turnover.
How does the DSA help a victim of a deepfake?
It guarantees a reporting route on every hosting service in the EU, a confirmation of receipt, a reasoned decision and an appeal. Victims should also file with StopNCII.org or NCMEC’s Take It Down to block re-uploads on participating platforms, and in the United States use the 48-hour TAKE IT DOWN process.