The European Commission has issued its first fines, national regulators are stepping up investigations and courts are starting to define what compliance means in practice. This blog discusses the DSA's key obligations, the emerging enforcement landscape and what businesses should expect going forward.
Key takeaways
- The DSA is no longer merely a theoretical compliance obligation, it is becoming enforcement reality. Companies are wise to take DSA implementation seriously.
- Public enforcement actions are increasing at both the European and the national level, with hefty fines being imposed, a sharp rise in complaints and a growing number of trusted flagger designations.
- At the same time, private enforcement is gaining momentum. Dutch courts have set early precedents and collective actions are likely next.
What is the DSA?
The DSA sets out clear rules for online intermediary services involving the transmission and storage of user-generated content, including online marketplaces, social media networks and video-sharing platforms. It aims to address the responsibilities of these services in tackling illegal content, increasing transparency, and protecting fundamental rights online.
The DSA entered into force in November 2022 and gave both the European Commission (Commission) and Member State Digital Services Coordinators (DSCs) the power to take enforcement action. DSCs, on the one hand, are competent to supervise and enforce compliance with the DSA by providers of intermediary services in their Member States, regardless of the number of users. The Commission, on the other, has exclusive competence to supervise, enforce and monitor compliance over the systemic risk obligations specific to very large online platforms and search engines (so called VLOPs and VLOSEs).
The DSA has a tiered system of obligations with four horizontal layers: (i) obligations for all intermediary services; (ii) obligations for hosting services; (iii) obligations for online platforms; and (iv) further obligations for VLOPs and VLOSEs. As of date, the Commission has designated twenty-five VLOPs and VLOSEs, including AliExpress, Meta, Microsoft and Google.
Some of the main obligations under the DSA include:
- Notice-and-action mechanisms: platforms must establish systems allowing users to flag illegal content and cooperate with specialised ‘trusted flaggers’ to identify and remove such content;
- Transparency measures for online platforms: providers must disclose information about their content moderation policy, advertising practices and algorithms;
- Traceability of traders: online marketplaces are required to verify the identity of third-party sellers;
- User redress mechanisms: users must have access to appeals and alternative dispute resolution when content is removed or accounts are suspended; and
- Obligations for the protection of minors on any platform in the EU. To this end, the Commission published its guidelines in July 2025 on the protection of minors under the DSA to ensure a safe online experience for young people.
Practice in the Netherlands, Belgium and Luxembourg
-
The Netherlands
In the Netherlands, the Authority for Consumers and Markets (ACM) is the primary supervisor for DSA compliance and has held full enforcement powers since 4 February 2025, while the Dutch Data Protection Authority (AP) oversees a few specific data provisions.
The ACM takes this supervisory role very seriously, with a designated digital team aimed at both investigations and informing the public. In 2024, the ACM organised webinars and published guidelines on the interpretation of the DSA. Mid 2025, the ACM published its annual DSA report 2025, summarizing the development and actions undertaken in 2025. These include the introduction by the ACM of an online "DSA-check” tool for companies and granting Stichting Brein, Meld Online Discriminatie (MOD), Stichting React, and Offlimits the status of trusted flaggers. In addition, in 2025, the ACM shared a joint opinion with the AP on the relevance of human contact and transparency regarding the deployment of AI chatbots in customer service, and, together with other Dutch authorities, is active in the Digital Regulation Cooperation Platform. For 2026, the ACM has indicated that a safe and trustworthy online environment - including the protection of minors - is a key priority. -
Belgium
In Belgium, the Belgian Institute for Postal Services and Telecommunications (BIPT) was appointed as the federal DSC in 2024. The BIPT is supported by other competent authorities, representing the Flemish (VRM), French (CSA) and German-speaking (Medienrat) communities, which handle local enforcement and compliance within their areas.
Since the entry into force of the DSA, the BIPT has actively collaborated with other DSCs, processed multiple user complaints and participated in the European Board for Digital Services. The Belgian regulators have been working on evaluating IT systems to streamline coordination with the European Commission. In 2025, BIPT granted Child Focus, VMRI and Unia the status of trusted flaggers. -
Luxembourg
In Luxembourg, the DSA was transposed into national law on 2 April 2025. While several larger platforms with seats in Luxembourg will be supervised by the Commission, the Luxembourg Competition Authority, acting as DSC, has not been sitting idle. Even prior to the transposition of the DSA into national law, the Luxembourg Competition Authority already received 17 complaints concerning alleged breaches of the DSA in 2024, including five referrals from other DSCs.
In March 2025, the Luxembourg Competition Authority signed a cooperation agreement with seven other national authorities to coordinate the effective implementation of the DSA. Further streamlined cooperation between authorities in Luxembourg is therefore to be expected.We refer to our separate publication on Luxembourg for more information.
Enforcement
Two and a half years since its entry into force, the question remains how the DSA works in practice, and in particular how it relates to other digital regulations such as the DMA, the P2B Regulation, the Digital Fairness Act and the AI Act, which at times conflict with each other. Many provisions contain open norms, and the exact meaning of certain obligations may be debatable. In other words, much is still unknown.
The practical meaning of DSA obligations is therefore being shaped on multiple fronts simultaneously: the Commission and national DSCs take action through public enforcement, including investigations, fines and non-compliance decisions, and companies, organisations and consumers are or will soon find their ways to private enforcement action before the courts. As these tracks continue to develop in parallel, they will increasingly complement and reinforce each other, further defining what DSA compliance requires in practice.
-
Public enforcement
On 5 December 2025, the Commission issued its first non-compliance decision under the DSA, followed by a second non-compliance decision on 28 May 2026. Both decisions resulted in fines of respectively EUR 120 million and EUR 200 million. In July 2026, the Commission issued its highest fine to date:
- The Commission imposed its first fine of EUR 120 million in December 2025 on X for breaching its transparency obligations. The decision identified three shortcomings: (i) X’s 'blue checkmark’ system was found to constitute a deceptive design practice, as the badge suggests identity verification while in practice it is simply awarded to paying users. This exposes users to heightened risk of impersonation frauds and manipulation by malicious actors; (ii) X’s advertisement repository fails to meet the DSA's transparency and accessibility requirements while these requirements are meant to enable the public to detect scams, hybrid threat campaigns, coordinated information operations, and fake advertisements or other potential risks in online advertising; and (iii) X failed to provide researchers with access to the platform’s public data.
- The second fine issued comes from the Commission’s formal investigation into Temu, which it opened in 2024. On 28 May 2026, the Commission imposed a fine of EUR 200 million on the company, finding that Temu failed to diligently identify, analyse, and assess the systemic risks of illegal products being offered on its platform and the resulting harm to consumers in the EU.
- On 20 July 2026, the Commission fined AliExpress EUR 550 million, for breaching the DSA. According to the Commission, AliExpress fell short of its DSA-obligation to thoroughly evaluate the risk of illegal, unsafe, or counterfeit products being spread across its platform. The decision identified three shortcomings: AliExpress (i) failed to adequately determine whether it had enough personnel to handle the review of potentially unlawful products; (ii) insufficiently examined how its recommendation and advertising systems contribute to the proliferation of illegal products on its platform; and (iii) did not include quantitative indicators in its risk assessment.
At a national level, DSC’s are not far behind the Commission. Article 51 DSA provides a minimum set of investigative and enforcement powers for the DSCs, which in particular the ACM has been using often. For instance, in September 2025, when the ACM launched a DSA investigation into Snapchat in connection with alleged illegal sale of vaping products to minors, which has since become part of a broader investigation by the Commission into Snapchat's exposure of minors to harmful content. In addition, on 30 January 2026, when the ACM opened an investigation into Roblox regarding the protection of minors. In fact, already in February 2024, the ACM opened an investigation into bol.com which in 2026 resulted in commitments aimed at providing more protection for consumers and sellers.
-
Private enforcement
In addition to public enforcement, the DSA provides for private enforcement as an integral part of its framework. In particular, Article 54 DSA grants recipients of intermediary services the right to seek compensation for damages resulting from platforms' non-compliance with their DSA obligations, while several provisions – including Articles 17, 20 and 21 – give users the right to challenge content moderation decisions through internal complaint mechanisms and out-of-court dispute settlement, with recourse to the courts as ultimate remedy.
The Netherlands – an already popular jurisdiction for private enforcement – has quickly become a frontrunner in DSA private enforcement as well, with two recent rulings by the Amsterdam District Court illustrating what private enforcement of the DSA can look like in practice.
These cases underline that many DSA infringements are inherently collective in nature. In addition to individual actions, collective claims under the DSA are therefore likely to emerge in the coming years. As the Dutch collective redress regime (WAMCA) enables representative organisations to pursue damages claims on behalf of large groups of affected users, the Netherlands is well positioned to become a leading forum for DSA-based private enforcement. Nevertheless, Belium and Luxembour – with very active DSCs which may help providing theories of harm, may not be far behind. For further information on the collective redress regime please see our earlier blog here.
How we can help
With enforcement activity intensifying on all fronts businesses that offer online intermediary services in the EU are well advised to take DSA compliance seriously and to prepare for a regulatory landscape that is only becoming more active.
NautaDutilh’s Competition team advises various parties across the Benelux on DSA compliance and litigation, enforcement risk and other DSA-related topics. Whether you are navigating a regulatory investigation, reviewing your content moderation policies or have questions about any other DSA-related matter, our team can help.
For more information, please visit our Competition page or contact us directly.
