Summary
- The DSA has applied since 17 February 2024 to any brand whose digital space hosts content produced by third parties: customer reviews, comments, forums, seller listings.
- The enforcement phase has begun: €120 million for X in December 2025, €200 million for Temu in May 2026, €550 million for AliExpress in July 2026.
- Company size adjusts your obligations rather than removing them: the exclusion reserved for smaller providers covers a defined, narrower scope.
- Four workstreams fall directly under marketing: the notice channel, the reasoning behind moderation decisions, advertising transparency, and metrics-driven governance.
- The 2026-2027 enforcement priorities focus on the protection of minors and the safety of products sold online.
- The checklist at the end of the article lets you assess your exposure in five minutes.
The DSA has moved from a European text to a line item in the budget
For two years, most marketing departments filed the Digital Services Act under legal matters reserved for the tech giants. The decisions published since December 2025 have closed that debate. The European Commission handed down its first fine against X for €120 million, followed by €200 million against Temu and €550 million against AliExpress, the latter the heaviest penalty issued under the Regulation to date. The point that matters for a marketing director fits in one sentence: the Regulation targets the nature of your digital spaces far more than your sector or your size. A community page, a product review section, or an embedded marketplace is enough to bring your brand into scope, with obligations that Arcom, the DGCCRF and the CNIL can enforce in France.
What has actually changed for brands
Your comments section makes you a regulated actor
The Regulation targets services that store and disseminate content provided by third parties, a reality very familiar to marketing teams. A corporate site that only showcases your own products falls under standard e-commerce rules. The moment that same site opens a review section, a comment thread, a support forum, or a marketplace, it becomes an online platform within the meaning of the text, together with the obligations that come with it. Arcom explicitly places social networks, video-sharing platforms and marketplaces in that category.
Your next step: list every public space open to external contributions, including those run by an agency, and have their qualification confirmed in writing by your legal department.
Penalties have become real, public, and quantified
The Regulation allows for fines of up to 6% of annual worldwide turnover, a ceiling that stayed theoretical for a long time. The decision against X sanctions transparency failures: a paid badge that misled users about account identity, a defective advertising repository, and hindered researcher access to data. The AliExpress decision faults an inadequate assessment of the human resources assigned to risk analysis and an overestimation of the effectiveness of automated detection tools. The Commission treated the relative novelty of the framework as a mitigating factor, an argument whose weight diminishes with every new decision published.
Your next step: verify that your current setup produces dated evidence, since enforcement scrutinises your ability to document as much as your results.
Company size adjusts your obligations rather than removing them
The idea that SMEs escape the Regulation circulates widely, and the reality deserves to be stated with precision. An exclusion does exist for micro and small enterprises, as defined in the relevant EU recommendation, meaning fewer than 50 employees and no more than €10 million in annual turnover or balance sheet total. It covers the obligations specific to online platforms: internal complaint-handling, out-of-court dispute settlement, trusted flaggers, advertising transparency, protection of minors, interface design, and the regime applicable to marketplaces. The baseline that applies to every hosting provider, regardless of size, remains untouched: a point of contact, readable terms and conditions, a notice mechanism, and a reasoned explanation for every moderation decision. The exclusion also lapses twelve months after the threshold is crossed, and GDPR as well as consumer law continue to apply in parallel.
Your next step: have your status formally qualified in writing, then budget the baseline as a permanent line item rather than a one-off project.
The three workstreams that fall directly under marketing
A notice channel that runs continuously
The Regulation requires an easily accessible electronic notice mechanism on every one of your spaces, and above all prompt handling of the alerts it receives. The rule that changes everything lies in the legal effect of these notices: once a sufficiently precise notification allows a manifestly illegal content item to be identified, your brand is deemed to have knowledge of it, and your liability runs from that moment. In practice, a report filed on a car brand’s community page on a Friday evening engages that brand’s liability over the weekend, well before internal teams return on Monday.
Your next step: cover your spaces 24/7, measure your median handling time, and set an escalation procedure for the most sensitive content.
Moderation that explains and documents its decisions
Every removal, masking, or account restriction triggers an obligation to explain the decision to the person concerned, with a clear ground tied to a specific rule. An internal complaint-handling system and information on out-of-court redress options come on top of that. Online platforms must also submit these decisions to the Commission’s public database, updated in near real time since September 2023. This requirement turns a function long treated as a craft into a tooled process: moderation run out of a shared mailbox rarely produces the expected trail.
Your next step: equip your teams with a tool that generates structured, exportable statements of reasons, and align your moderation rules with your terms and conditions.
Advertising and influencer marketing made fully traceable
Every advertisement displayed on a platform must be identifiable as such, disclosing the name of the advertiser, the name of the party paying for it where different, and the main targeting parameters. This requirement flows down to advertisers themselves, as ad networks now require this information to feed their advertising repositories. Two prohibitions deserve particular attention: targeting based on special categories of personal data under GDPR, and any personalised advertising once the platform reasonably knows the user is a minor. Influencer marketing follows the same logic, with creators required to disclose the commercial nature of their posts.
Your next step: audit your targeting audiences, purge those built on sensitive criteria, and write the commercial-disclosure requirement into your partnership contracts as a verifiable obligation.
Priorities to budget for in 2026-2027
Protecting minors has become the leading enforcement front
On 14 July 2025, the Commission published guidelines detailing its expectations: private-by-default settings for minors’ accounts, the deactivation of retention mechanics such as infinite scroll, and age-verification methods that are reliable and minimally intrusive. A prototype European age-verification app accompanies this framework, pending the EU digital identity wallet expected by the end of 2026. These recommendations are already shaping regulatory action: in July 2026, the Commission sent TikTok preliminary findings on the default settings applied to minors’ accounts.
Your next step: identify the share of minors in your audiences and review your default settings and advertising targeting rules accordingly.
Online commerce is drawing the heaviest penalties
Two of the three fines issued to date target e-commerce platforms, and a formal investigation into Shein was opened in February 2026. The findings concern the circulation of dangerous or counterfeit products, the recommender systems that amplify their reach, and weak measures against repeat-offending sellers. Brands that distribute through third-party marketplaces feel the direct effects of this tightening, particularly when it comes to handling counterfeit listings that carry their name.
Your next step: document your own takedown requests to marketplaces and keep a record of the response times obtained, useful both for compliance and for commercial negotiation.
Announced simplification does not lower the bar
The Digital Omnibus package, presented in November 2025, promises to ease the burden created by the overlap of GDPR, the DSA, the AI Act and neighbouring texts. Its AI-focused component became a European regulation signed on 8 July 2026, which delays certain obligations for high-risk systems while moving up the deadline for labelling AI-generated content to 2 December 2026. The DSA’s core remains untouched within this package, and the Commission is pursuing its Digital Fairness Act project in parallel.
Your next step: treat your moderation governance as a reusable asset, since the same evidence will serve every text still to come.
Compliance as a measurable trust asset
The DSA turns a function long perceived as a cost centre into a source of evidence useful well beyond the legal department. The most advanced organisations track three simple indicators: median time to handle notices, the share of decisions overturned on complaint, and the split between automated and human-arbitrated decisions. These same figures support conversion, protect the value of advertising inventory, and de-risk influencer partnerships, since a well-moderated community retains more engaged audiences. Compliance therefore comes down to three moves: qualify your spaces, industrialise your moderation, and anticipate European priorities.
Netino: execution, not just advice
France’s leading Marketing Process Outsourcer, Netino runs the digital spaces of more than 200 brands on a daily basis, including L’Oréal, Air France, Castorama and Société Générale. Its Content Moderation offering combines multilingual expert teams available 24/7, trained on each client’s standards and industry context, a hybrid solution pairing proprietary AI with human oversight, and moderation workflows calibrated to your channels, priorities and risks. This setup answers the regulator’s expectations point by point: continuous handling of notices, urgency triage, controlled escalation, detailed volumetric reporting, and compliance oversight built into governance. Brands that work with Netino gain protection against sensitive or unlawful content, a safer and more engaged community, and moderation that respects their editorial identity.
Sources
- Regulation (EU) 2022/2065 on a Single Market For Digital Services: dsa-act.eu
- Arcom, obligations and services covered by the DSA: arcom.fr
- French Ministry for Europe and Foreign Affairs, fine against X, December 2025: diplomatie.gouv.fr
- Tech Policy Press, AliExpress penalty and the shift towards marketplaces, July 2026: techpolicy.press
- European Commission, guidelines on the protection of minors, July 2025: digital-strategy.ec.europa.eu
- DSA Transparency Database: transparency.dsa.ec.europa.eu
- DGCCRF, new obligations for professionals: economie.gouv.fr
- Seban & Associés, overview of the Digital Omnibus package: seban-associes.avocat.fr
This article was produced with the assistance of artificial intelligence, then reviewed, edited and approved for publication by Hervé Rigault and his editorial team, who assume editorial responsibility for it.
