The Digital Services Act (DSA, Regulation (EU) 2022/2065) sets duties for every online intermediary that offers services to users in the EU, scaled to the type and size of the service; it has applied to all providers since 17 February 2024. The Digital Markets Act (DMA, Regulation (EU) 2022/1925) binds only the large platforms the European Commission designates as gatekeepers, and for most Dutch businesses it is a source of rights rather than duties.
Both are EU regulations, so their text applies directly in the Netherlands. The Dutch implementing act for the DSA (Uitvoeringswet digitaledienstenverordening) entered into force on 4 February 2025 and makes the Authority for Consumers and Markets (ACM) the Digital Services Coordinator.
Table of contents
What do the DSA and the DMA regulate?
The DSA is the general rulebook for online services that pass on or store information from users; the DMA is a set of fixed rules for gatekeepers. When you check your obligations, you read the articles of the regulations themselves, not a Dutch act.
The DSA replaces the liability rules of the e-Commerce Directive (2000/31/EC). It keeps the liability exemptions for mere conduit, caching and hosting, and adds due diligence duties on illegal content, transparency and user recourse. The DMA has applied since 2 May 2023. A designated gatekeeper must comply with its obligations within six months of designation.
| Aspect | Digital Services Act | Digital Markets Act |
|---|---|---|
| Who it binds | All intermediary services offered to users in the EU, wherever the provider is established | Only core platform services the European Commission has designated as gatekeepers |
| Main duties | Points of contact, clear terms, notice and action, statement of reasons, complaint handling, advertising transparency | No self-preferencing, data access for business users, no anti-steering, no forced tying |
| Supervisor | ACM in the Netherlands; European Commission for very large platforms | European Commission |
| Maximum fine | 6% of worldwide annual turnover | 10% of worldwide turnover, 20% for a repeated infringement |
Which DSA category does your service fall into?
Your duties depend on your category, so classify your service first. Each category carries its own duties plus those of the categories below it.
- Intermediary services: mere conduit and caching, such as internet access providers and domain name registrars.
- Hosting services: services that store information provided by users, such as cloud and web hosting.
- Online platforms: hosting services that also make user information public, such as marketplaces, app stores, social networks and review sites.
- Very large online platforms and search engines: services with an average of at least 45 million monthly active users in the EU (Article 33 DSA), designated by the European Commission.
A webshop that only sells its own products and hosts no user content falls outside the DSA. Add a public review or comment section and you become an online platform. Let third-party sellers conclude contracts with consumers and the marketplace rules apply on top.
Are small platforms exempt?
Partly. Under Article 19 DSA, online platforms that are micro or small enterprises (fewer than 50 staff and turnover or balance sheet total of at most €10 million, per Recommendation 2003/361/EC) are exempt from the specific platform duties, unless they are designated as very large. The baseline duties for intermediaries and hosting services still apply to them.
What does the DSA require from you?
Most DSA duties are about documents and processes, not technology. The list below follows the categories from the bottom up.
Every intermediary must publish a single point of contact for authorities (Article 11) and one for users (Article 12). A provider without an establishment in the EU must appoint a legal representative in a member state where it offers its services (Article 13), and that representative can be held liable for non-compliance. Your terms and conditions must explain in plain language which restrictions apply to user content and how content moderation works, including automated tools. Annual transparency reports on content moderation are required (Article 15), with micro and small enterprises exempted.
Hosting services must offer an easy notice and action mechanism through which anyone can report content they consider illegal (Article 16). Every removal, demotion or suspension must come with a statement of reasons to the user concerned (Article 17). If a hosting provider becomes aware of a criminal offence that threatens someone’s life or safety, it must report it to the police or judicial authorities (Article 18).
Online platforms carry extra duties. They must run an internal complaint system that stays open for at least six months after a decision (Article 20) and cooperate in good faith with certified out-of-court dispute settlement bodies (Article 21). Notices from trusted flaggers get priority (Article 22), and users who often post manifestly illegal content must be suspended after a warning (Article 23).
What rules apply to design and advertising?
Online platforms may not design their interfaces in a way that deceives or manipulates users (Article 25), the practice known as dark patterns. Advertising must be recognisable as such, and advertising based on profiling with special categories of personal data is prohibited (Article 26(3)). Platforms must also protect minors and may not show them advertising based on profiling (Article 28). The main parameters of recommender systems must be explained in the terms and conditions (Article 27).
What extra duties apply to online marketplaces?
If consumers can conclude distance contracts with traders on your platform, you must collect and make best efforts to verify each trader’s details before the trader can use your service (Article 30). These include name, address, contact details, an identity document, payment account details, trade register number and a self-certification that the trader only offers compliant products. A trader who refuses to correct inaccurate information must be suspended.
Your interface must allow traders to give the information that EU consumer law requires. If you learn that an illegal product or service was offered, you must inform the consumers who bought it in the previous six months (Article 32), or publish the information if you lack their contact details.
When are you liable for content of your users?
You are not liable as long as you meet the conditions of the safe harbours. A hosting service is not liable for stored information if it has no actual knowledge of illegal content and, once it has that knowledge, acts quickly to remove it or disable access (Article 6).
The DSA prohibits a general obligation to monitor content (Article 8), so a Dutch court cannot impose one. Voluntary own-initiative checks for illegal content do not by themselves cost you the exemption (Article 7). But the exemption only covers liability: a hosting provider that ignores a proper notice loses its protection and also breaches the regulation.
What counts as illegal content?
The DSA does not define illegality itself: content is illegal if it breaches EU law or the law of a member state. In a Dutch case, Dutch law decides, for example defamation under the Criminal Code (Wetboek van Strafrecht), unlawful publications under Article 6:162 of the Dutch Civil Code (BW), counterfeit goods, copyright infringement and unlawful processing of personal data.
A notice does not oblige you to remove everything someone dislikes. You must assess whether the content is illegal and act quickly if it is. Lawful but unwelcome content is a matter for your terms and conditions, which you must apply diligently, objectively and proportionately, with regard for freedom of expression.
A Dutch authority can order you to act against specific illegal content (Article 9) or to provide information about a specific user (Article 10). In criminal investigations, these orders are given through the Dutch Code of Criminal Procedure, for example Article 125p Sv. In civil cases, a party that wants a removal or a user’s identity usually asks the court in summary proceedings (kort geding).
What does the DMA give your business?
The DMA gives business users of gatekeeper platforms enforceable rights. It applies to core platform services such as search engines, app stores, social networks, messaging services, operating systems, browsers, cloud services and online advertising services.
Under Article 3 DMA, a platform is presumed to be a gatekeeper if it has an annual EU turnover of at least €7.5 billion in each of the last three financial years or a market capitalisation of at least €75 billion, and at least 45 million monthly active end users and 10,000 yearly active business users in the EU. A platform that meets these thresholds must notify the European Commission within two months.
The rights that matter most to a Dutch business that sells, advertises or distributes apps through a gatekeeper are these:
- No self-preferencing: the gatekeeper may not rank its own products more favourably than yours and must use fair, non-discriminatory ranking conditions.
- Access to your data: you can get continuous, real-time access to the data you generate on the platform.
- No anti-steering: you may offer the same products at different prices elsewhere and contact customers you acquired on the platform.
- Alternative distribution: gatekeeper operating systems must allow third-party apps and app stores.
- No forced tying: users may not be required to sign up to another gatekeeper service to use a core platform service.
The European Commission enforces the DMA. It can fine a gatekeeper up to 10% of its worldwide turnover, and up to 20% for a repeated infringement (Article 30 DMA). Because the obligations apply directly, you can also bring a claim before a Dutch civil court.
How is the DSA enforced in the Netherlands?
The ACM supervises providers established in the Netherlands and handles complaints from Dutch users. The European Commission supervises very large online platforms and search engines.
The ACM can impose fines up to the maximum set in Article 52(3) DSA, a percentage of worldwide annual turnover with a ceiling of 6%, and periodic penalty payments. The Commission can fine very large platforms up to 6% of worldwide turnover (Article 74) and impose periodic penalty payments of up to 5% of average daily turnover (Article 76). Where personal data are involved, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) remains the GDPR supervisor; the implementing act requires the ACM and the AP to coordinate.
In practice, a Dutch business is more likely to face a request from the ACM than a large fine. The ACM will first look at your points of contact, your terms and conditions and your notice and action mechanism. These are also the subjects of most user complaints.
How does the DSA fit with other EU digital law?
The DSA leaves the GDPR fully intact. Profiling for advertising, recommender systems and age checks raise GDPR questions first; our article on controller and processor roles under the GDPR explains who answers for what.
The European Accessibility Act has applied since 28 June 2025 and requires e-commerce services and many digital products to be accessible to people with disabilities. That is a separate duty: a DSA-compliant webshop that a visually impaired user cannot operate is still non-compliant.
The Cybersecurity Act (Cyberbeveiligingswet), which implements the NIS2 Directive, entered into force on 15 August 2026. Many hosting providers and online platforms fall within its scope; see our guide to NIS2 and the Dutch Cybersecurity Act. The AI Act also applies in stages, and the AI omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) postponed the high-risk rules; AI used for moderation or ranking must already be described under the DSA. For the criminal-law side of online conduct, see our article on the Dutch Cybercrime III Act.
What can you do if a platform removes your content or account?
You are entitled to a statement of reasons and to three routes of recourse. The statement must say what was restricted, on what legal or contractual ground, whether automated means were used, and how you can challenge the decision (Article 17).
First, file a complaint through the platform’s internal system; this is free, stays open for at least six months, and decisions may not be taken solely by automated means (Article 20). Second, you can go to an out-of-court dispute settlement body certified by a Digital Services Coordinator (Article 21); its decision does not bind you. Third, you can go to the Dutch civil court at any time, usually in summary proceedings if a suspension is causing ongoing loss.
Keep the statement of reasons and all correspondence, file the internal complaint promptly and record your loss from day one. If the platform is a gatekeeper, the DMA duties on fair access conditions may give you an extra argument.
What should you check as a platform or hosting provider?
Start with the classification, because every other duty follows from it.
- Record in writing which DSA category your service falls into and whether you qualify as a micro or small enterprise.
- Publish a point of contact for authorities (Article 11) and one for users (Article 12); appoint an EU legal representative if you have no EU establishment.
- Check that your terms and conditions describe your moderation policy, automated tools and complaint route in plain language.
- Test your notice and action mechanism and the statement of reasons that goes with every decision.
- If you run a marketplace, check that you collect and verify trader details before a trader goes live (Article 30).
- Review your interface and advertising for dark patterns and profiling based on special categories of data.
What should you check as a business user of a platform?
As a seller, advertiser or app developer, you mainly have rights to check.
- Check whether the platform you depend on is a designated gatekeeper for that service.
- Compare your platform contract with the DMA bans on self-preferencing, anti-steering and forced tying.
- Request access to the data you generate on the gatekeeper’s platform.
- Keep every statement of reasons when a listing, advertisement or account is restricted.
- Note the deadline for the platform’s internal complaint and file it in time.
What can we do for you with the DSA and DMA?
Our IT lawyers advise Dutch and international businesses on both regulations; our IT law guides collect the background material.
- We classify your service under the DSA and record the reasoning in a memo.
- We draft or review your terms and conditions, moderation policy and statements of reasons.
- We set up your notice and action and complaint procedures, including the deadlines.
- We assist you when the ACM sends a request for information or starts an investigation.
- We review your platform contracts against the DMA and draft a complaint to the European Commission where needed.
- We file the internal complaint or start summary proceedings when your account or listing is suspended.
Summary
- The DSA applies to every intermediary that serves EU users, with duties scaled by category; the DMA binds only designated gatekeepers.
- The ACM is the Dutch Digital Services Coordinator under the implementing act in force since 4 February 2025.
- Micro and small online platforms are exempt from the specific platform duties, but not from the baseline duties.
- DSA fines go up to 6% of worldwide turnover; DMA fines up to 10%, or 20% for repeat infringements.
- Business users can rely on DMA rights and on the DSA complaint routes when a platform restricts their content.
Frequently asked questions
Do the DSA and DMA apply if my business is not established in the EU?
Yes. Both regulations apply on the basis of where the users are. Under the DSA, a provider without an EU establishment must appoint a legal representative in a member state where it offers its services (Article 13 DSA), and that representative can be held liable.
Does the DSA apply to my webshop?
Only if it passes on or stores information from users. A shop that sells only its own goods and hosts no user content falls outside the DSA. A public review or comment section makes it an online platform, and third-party sellers bring in the marketplace rules of Article 30 DSA.
What is the main difference for a small business?
The DSA gives you obligations for your own service; the DMA gives you rights against gatekeepers. If you are a micro or small enterprise, you are exempt from the specific online platform duties under Article 19 DSA, but not from the baseline duties.
Who supervises the DSA in the Netherlands?
The Authority for Consumers and Markets (ACM) is the Digital Services Coordinator under the Uitvoeringswet digitaledienstenverordening, in force since 4 February 2025. The European Commission supervises very large online platforms and search engines and enforces the DMA.
