Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
DSA
Reglamento de Servicios Digitales, Reglamento (UE) 2022/2065
Moderación de contenidos, transparencia, prohibición de anuncios dirigidos mediante datos sensibles o dirigidos a menores a partir de la elaboración de perfiles, y evaluaciones de riesgos para las plataformas de muy gran tamaño.
The law in brief
The Digital Services Act sets rules for online intermediaries serving the EU: how they handle illegal content, how transparent they are about moderation and advertising, and how they protect users, especially minors. Duties scale with the service: all intermediaries have baseline duties, hosting services and online platforms have more, and very large online platforms and search engines carry systemic risk duties.
For privacy practitioners, its advertising rules matter most: no ads based on profiling that uses sensitive data, no profiling-based ads to minors, and no deceptive interface design on platforms.
A quién se aplica
- Intermediary services offered to recipients in the EU, wherever the provider is established: mere conduit, caching and hosting services.
- Online platforms, such as marketplaces, social networks and app stores, which store and disseminate information to the public.
- Very large online platforms and very large online search engines, with 45 million or more average monthly active users in the EU, designated by the Commission.
- Micro and small enterprises are exempt from many online platform obligations unless designated as very large.
What it requires
Notice and action
Hosting services must provide easy electronic mechanisms to notify illegal content, act on notices diligently, and give a statement of reasons when they restrict content or accounts.
No deceptive design
Online platforms must not design, organize or operate their interfaces in a way that deceives, manipulates or materially distorts users' ability to make free and informed decisions.
Ad transparency and no sensitive-data profiling
Label ads, show on whose behalf they are presented and the main targeting parameters, and do not present ads based on profiling using special categories of personal data.
Protection of minors
Put appropriate and proportionate measures in place for a high level of privacy, safety and security for minors, and do not present ads based on profiling when you are reasonably certain the user is a minor.
Systemic risk for very large platforms
Very large platforms and search engines must assess and mitigate systemic risks each year, including to fundamental rights and minors, and undergo independent audits.
Derechos de las personas
Users can notify illegal content, receive a statement of reasons when their content or account is restricted, use an internal complaint system and out-of-court dispute settlement, see why they are shown an ad, and, on very large platforms, choose a recommender system not based on profiling.
Enforcement and penalties
Multas de hasta el 6% del volumen de negocio anual mundial por incumplimiento, y de hasta el 1% por facilitar información incorrecta o no someterse a una inspección, con multas coercitivas (arts. 52 y 74). La Comisión supervisa el cumplimiento de las plataformas y los motores de búsqueda de muy gran tamaño; los coordinadores nacionales de servicios digitales lo hacen con los demás.
What to do first
- Classify your service: intermediary, hosting, online platform, or very large.
- Set up notice and action and statements of reasons for content decisions.
- Check ad targeting: no profiling using special categories of personal data, and none aimed at users you know are minors.
- Remove dark patterns from platform interfaces.
- Publish transparency reports on moderation as your category requires.
- For marketplaces, verify traders before they can sell.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Novedades recientes
-
Commission preliminarily finds TikTok’s ‘For You’ feed breaches DSA over harmful ‘rabbit hole’ effect
The finding signals heightened regulatory scrutiny of algorithmic recommendation systems under the EU’s DSA, with potential obligations for large online platforms. The European Commission has preliminarily concluded that TikTok violates the Digital Services Act by exposing users to a continuous stream of personalised videos that can lead to harmful ‘rabbit holes’, especially concerning mental health and body image. The Commission’s findings focus on the platform’s risk assessment and required mitigation measures. The breach concerns both vulnerable adults and minors.
Source: European Commission digital strategy news. DSA in the regulations library.
-
Commission seeks feedback on advertising repositories under the Digital Services Act
The feedback will influence how ad transparency measures are implemented, affecting platforms, advertisers and researchers. The European Commission is calling for evidence to shape upcoming technical guidelines on advertising repositories under the DSA. The guidelines will require very large online platforms and search engines to provide public, easily‑accessible ad information. The consultation runs until 2 December 2026.
Source: European Commission digital strategy news. DSA in the regulations library.
-
EU Commission opens investigation into Booking.com for DSA fraud and transparency breaches
The probe signals stricter enforcement of the DSA’s risk‑assessment and transparency obligations for large online platforms. The European Commission has opened formal proceedings to assess whether Booking.com violated the Digital Services Act by failing to assess or mitigate risks from fraudulent listings and phishing scams. The Commission also alleges a transparency breach for not clearly labeling paid‑for boosted listings as advertisements. The investigation will focus on fraudulent listings, phishing scams using reservation data, and undisclosed paid placements.
Source: European Commission digital strategy news. DSA in the regulations library.
-
European Commission sends formal notice to Bulgaria for non‑compliance with the Digital Services Act
The action highlights EU enforcement of the Digital Services Act and its impact on national enforcement frameworks and platform liability. The Commission issued a formal notice (INFR(2024)2241) to Bulgaria for failing to fully comply with the DSA, specifically for not designating and empowering the required Digital Services Coordinators. Bulgaria has two months to respond before the Commission may issue an additional reasoned opinion. The Commission also noted that Bulgaria's sanction regime does not fully respect the DSA's maximum fine limits or proportionality requirements.
Source: European Commission digital strategy news. DSA in the regulations library.
-
Commission designates ChatGPT, Reddit, Roblox as VLOPs/VLOSE under the Digital Services Act
The designations trigger new DSA compliance duties for major online services, affecting their risk‑management and user‑protection obligations. The European Commission has designated ChatGPT as a Very Large Online Search Engine and Reddit and Roblox as Very Large Online Platforms under the DSA, citing each service’s reach of at least 45 million EU monthly users. The designated services must comply within four months (by January 2027) with additional DSA obligations, including risk assessment and mitigation of systemic risks to minors, well‑being, fundamental rights, and public security.
Source: European Commission digital strategy news. DSA in the regulations library.
-
EDPB adopts guidelines on GDPR fines and DSA interaction (17 Sep 2026)
The new EDPB guidance clarifies how authorities should levy fines and align DSA obligations with GDPR rules, impacting controllers, processors and digital platforms across the EU. On 17 September 2026 the European Data Protection Board adopted guidelines on the use of administrative fines by data protection authorities and finalised guidance on the interaction between the Digital Services Act (DSA) and the GDPR. The guidelines outline a five‑step method for assessing fines and describe corrective measures such as warnings, injunctions and service limitations. A public consultation on the guidelines runs until 13 November 2026.
Source: CNIL (France) and 1 more. DSA in the regulations library.
-
EU Commission hosts fifth roundtable on Digital Services Act implementation
The event signals ongoing EU regulator engagement with stakeholders to shape DSA enforcement and address AI and child‑safety risks online. On 23 September 2026 the European Commission held an online roundtable with about 60 civil society organisations and researchers to discuss the implementation of the Digital Services Act. The discussion focused on systemic risks, mitigation measures, protection of minors, online marketplaces and AI‑related risks, and referenced the proposal for an EU KIDS Act. The Commission also presented key steps of the DSA enforcement process and ways for civil society to contribute.
Source: European Commission digital strategy news. DSA in the regulations library.
-
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
The KIDS Act aims to create EU‑wide, age‑based safeguards and design obligations to protect children’s privacy and safety online. On September 17, 2026 the European Commission published a proposal for a new EU KIDS Act that would ban users under 15 from creating accounts on certain social networking and video‑sharing services, with limited exceptions. The draft regulation requires third‑party EU age‑verification solutions and obliges covered providers to embed child‑safety measures and submit compliance plans, especially for VLOPs. A supervisory fee capped at 0.03% of worldwide annual net income would be levied on large platforms and certain AI providers.
Penalty: supervisory fee for in-scope VLOPs as well as certain providers of AI companions, general conversational chatbots, and video gaming platforms, capped at 0.03% of worldwide annual net income.
Source: Covington Inside Privacy and 1 more. DSA in the regulations library.
Fuentes
- Reglamento (UE) 2022/2065 EUR-Lex · Texto oficial o regulador
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales