European Union. Sectoral privacy. Regulation (EU)
DSARegulation (EU) 2022/2065 on a Single Market for Digital Services (Digital Services Act)
§1Summary
- Synopsis
Sets layered obligations for intermediary services (mere conduit, caching, hosting, online platforms) on illegal content, notice and action, transparency and user protection. Very large platforms and search engines also have systemic risk duties. It includes privacy-relevant bans on targeted ads to minors and on ads based on sensitive data profiling.
- Key themes
- Unique features
It bans online platforms from showing ads based on profiling with special-category data, and from profiling-based ads to minors (Arts 26(3), 28(2)). It also bans dark patterns (Art 25).
- SaaS relevance
A SaaS product that hosts user content is a 'hosting service' and needs notice-and-action and transparency measures. Platform duties apply if it disseminates user content to the public (micro and small enterprises are exempt from some duties).
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- 6% of worldwide annual turnover
§3Dates
- Key dates
- Adopted
- In force
- VLOP/VLOSE obligations from four months after designation (first designations 2023-04-25); fully applicable 2024-02-17
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- Authority
- European Commission (VLOPs/VLOSEs); national Digital Services Coordinators
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Non-EU providers must appoint a legal representative.