If people can chat, post, or trade with each other on your platform, the Digital Services Act almost certainly already applies to you. The DSA has covered the EU since February 2024, regardless of company size or whether compliance has made it onto anyone’s roadmap yet.

Most people assume it’s a law for social media platforms. It actually covers any online platform that lets people interact, which reaches far past the handful of household names usually associated with it. Marketplaces, dating apps, forums, gaming platforms, and community spaces of every size all fall under the same rules.

Where the line is drawn

In short: if users can talk to each other, post content, or exchange items, money, or services on your platform, you’re an online platform under the DSA. That covers social apps, in game marketplaces, community forums, dating platforms, and anything built around user generated content.

You don’t need a legal team to figure this out. Look at what people can do on your platform. Then match it against three things the DSA regulates: illegal content, transparency about how your service works, and protection of user data and safety.

Three things the DSA asks of you

Underneath the legal language, the DSA comes down to three plain requirements.

  1. Deal with illegal content properly. That means a real notice and action process, not a vague “report” button that leads nowhere. Someone flags something, you act on it, and you tell them what happened.
  2. Be transparent about how your platform works. Clear terms and conditions, a real point of contact, and for most platforms, a yearly report on moderation activity.
  3. Protect user data and safety. This includes specific protections for minors, and rules against manipulative interface design that pushes users toward decisions they didn’t mean to make.

If you already run a serious trust and safety operation, most of this simply formalizes decisions your team is already making.

The tiers

The DSA scales its obligations by what kind of service you run and how big you are.

Every provider has to meet a baseline: clear terms and conditions, a designated point of contact, and cooperation with EU authorities when asked. Hosting services add reporting obligations and a proper notice and action process on top of that.

Most platforms with any kind of user interaction sit in the next tier up: online platforms. That covers games, marketplaces, and community apps alike. This tier adds user complaint handling, appeal rights, priority handling for reports from trusted flaggers, and extra safety measures where minors are part of the user base.

There’s one tier above that: very large online platforms (VLOP), defined in the DSA itself as those with more than 45 million average monthly users in the EU. That tier comes with a much heavier set of obligations, including public risk assessments and independent audits. Very few platforms reading this will hit that number, but it’s worth knowing the line exists if you’re scaling fast.

The small business exemption

Small businesses do get a break, but it’s narrower than most people assume. If your company has under 50 employees and under €10 million in annual turnover, you’re exempt from some obligations, including transparency reporting and several of the online platform requirements.

Baseline obligations, like clear terms and conditions and a point of contact, still apply regardless of size. And the exemption disappears immediately if a platform is designated a very large online platform, no matter how small the company behind it is.

The cost of getting it wrong

For the most serious violations, fines under the DSA can reach 6% of a company’s global annual turnover. That’s the ceiling rather than the typical outcome. Narrower violations like failing to respond properly to an information request from a regulator, are closer to 1%. Either way, the number is large enough to treat this as a real business risk worth planning for now.

Another cost shows up sooner: a moderation and appeals process that can’t hold up if a regulator or a user ever asks you to show your work.

Where to go from here

If you’ve read this far and you’re fairly sure your platform is in scope, the next useful step is figuring out exactly which obligations apply to you and how much of that work you already have covered.

See how Amanda handles DSA compliance walks through it feature by feature, built specifically for gaming and community platforms. If you want the deeper technical picture of how moderation systems are built to hold up under this kind of scrutiny, our piece on moderation architecture goes further into that.