The enforcement framework under the Digital Services Act

Enforcement procedure

The DSA’s general date of applicability is 17 February 2024. However, the DSA applies to providers of online platforms and of online search engines whose services have been designated as Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) as from four months following notification of the decision designating those services as such. 

On 25 April 2023, the Commission designated 17 online platforms as VLOPs and 2 online search engines as VLOSEs. Consequently, the DSA already applies to the providers of those VLOPs and VLOSEs, for which the Commission enjoys the competence to supervise and enforce. 

Opening of an investigation

Upon assessment of the information obtained during its monitoring, or from reliable sources, the Commission may have the suspicion of infringement. In that case, the Commission may decide to open an investigation and deploy its investigatory tools, such as issuing a request for information, the taking of interviews and inspections of premises. 

At any point in time during the investigation, the Commission can exercise its investigative powers to collect a reliable and consistent body of evidence on the VLOP/VLOSE’s compliance.

In October 2023, the Commission opened the very first DSA compliance investigation by sending requests for information to certain VLOPs. 

Opening of a proceeding

If the Commission continues to suspect an infringement of the DSA following these investigatory steps, it may open a proceeding. Before adopting a non-compliance decision, a decision imposing fines or a decision imposing periodic penalty payments, the Commission must give the VLOP or VLOSE concerned the opportunity of being heard on its preliminary findings, including any matter to which the Commission has taken objections; and any measures that the Commission may intend to take in view of those preliminary findings.

Non-compliance decision

If the Commission definitely establishes a breach of the DSA, it may adopt a decision imposing fines up to 6% of the global turnover of the VLOP or VLOSE concerned and order that provider to take measures  to address the breach by the deadline set by the Commission. That decision may also trigger an enhanced supervision period to ensure compliance with the measures the provider intends to take to remedy the breach. Such a fining decision may be appealed before the EU courts. 

Interim measures

If the Commission deems that there is an urgency due to the risk of serious damage for the users of the service at any point in time during the investigation and before a final decision is taken, it may decide to adopt interim measures that are proportionate and temporary to mitigate such a risk. Examples of interim measures can be changes to recommender systems, increased monitoring of specific keywords or hashtags, or orders to terminate or remedy alleged infringements.  

Commission's enforcement powers

Under the DSA, the Commission has both investigative and sanctioning powers.

Investigative powers

The Commission can:

• send a request for information (RFI) to verify platforms’ compliance with the DSA. The RFI can be sent also upon decision of the Commission. Fines* can be imposed if a reply is incorrect, misleading or incomplete.
• order access to the VLOPS' data and algorithms, e.g. to assess how the algorithm/recommender system of a platform promotes illegal content. Fines* can be imposed if the provider does not comply.
• conduct interviews of any person who might have information on the subject matter of an investigation. Interviews can be conducted only with the person’s consent and cannot be forced.
• conduct inspections at the VLOP’s premises. Inspections can be conducted only after consultation of the DSC of the Member State of establishment. The DSC may need to request an authorisation issued by the judge in the Member State of establishment. Fines* can be imposed if the provider refuses to submit to inspection.

* Fines up to 1% of the worldwide annual turnover can be imposed. Periodic penalties up to 5% of the average daily worldwide turnover can be imposed for each day of delay in replying to RFI by decision or allowing inspection.

Sanctioning powers

Starting from 17 February 2024, the Commission can:

• apply fines up to 6% of the worldwide annual turnover in case of:
  • Breach of DSA obligations
  • Failure to comply with interim measures
  • Breach of commitments
• apply periodic penalties up to 5% of the average daily worldwide turnover for each day of delay in complying with remedies, interim measures, commitments (following lack of compliance with College decision imposing remedies, interim measures or making binding commitments).

As a last resort measures, if the infringement persists and causes serious harm to users and entails criminal offences involving threat to persons' life or safety, the Commission can request the temporary suspension of the service, following a specific procedure:

• the Commission requests interested parties to submit written observations within a period that shall not be less than 14 working days, describing the measures it intends to request and identifying the intended addressee or addressees.
• the Commission requests the DSC of the Member State of establishment to seek from the competent judicial authority of its Member State an order to temporarily restrict access to the service concerned by the infringement.
• the Digital Service Coordinator seeks the order from the judge.
• The order must be issued by a judge in the Member State of establishment.

An overview of investigatory steps taken by the Commission under the DSA since 25 August 2023 in respect of specific VLOPs and VLOSEs is available.

The taking of such steps should not be taken to imply that the providers of the services have infringed the DSA. They are without prejudice to any further investigatory steps that the Commission may decide to take in relation to those providers under the DSA.