The EU Digital Services Act: what it means for hosting

The Digital Services Act is the EU regulation that sets the rules for hosting providers in every member state. For hosting, it does four things: it keeps a conditional liability exemption, bans general monitoring duties, requires a notice-and-action mechanism with reasons for restrictions, and sets conditions for orders from courts and authorities.

This guide takes the Digital Services Act hosting rules article by article, from the regulation's own text. For offshore hosting, the DSA is the main limit on a DMCA-ignored hosting promise inside the EU.

The Digital Services Act in one paragraph

Regulation (EU) 2022/2065 was adopted on 19 October 2022 and has applied in full since 17 February 2024 (Article 93). It is directly applicable in every member state and replaced the intermediary liability rules of the 2000 e-Commerce Directive (Article 89). It does not decide what is illegal: "illegal content" is information that breaks EU law or the law of a member state (Article 3(h)), and EU copyright law applies alongside it (Article 2(4)).

The duties come in layers: some for all intermediaries (Articles 11 to 15), more for hosting services (Articles 16 to 18) and more again for online platforms, which disseminate content to the public (Articles 19 to 28). Recital 29 names cloud computing and web hosting as hosting services, so server hosting normally sits in the middle layer. Each member state designates a Digital Services Coordinator (Article 49), and fines can reach 6% of annual worldwide turnover (Article 52).

Where Digital Services Act hosting rules apply on our servers

Among our seven locations, the DSA applies directly in the three EU member states:

One nuance: the DSA's scope follows users, not machines. It covers intermediary services offered to recipients established or located in the EU, "irrespective of where the providers of those intermediary services have their place of establishment" (Article 2(1)). If you run a platform for people in the EU, it can apply to you as the operator wherever your server is. Our complaint process follows the server: DSA notice and action in our EU locations, local law elsewhere.

Hosting liability and no general monitoring

Article 6 keeps the hosting exemption. A host is not liable for information stored at a customer's request if it "does not have actual knowledge of illegal activity or illegal content" (and, for damages claims, is not aware of facts that make it apparent), or if, on obtaining such knowledge, it "acts expeditiously to remove or to disable access to the illegal content".

The exemption does not cover customers acting under the host's authority or control (Article 6(2)), and it does not stop a court or authority from requiring a host to end or prevent an infringement (Article 6(4)). Losing it does not by itself make a host liable: recital 17 leaves liability to other EU or national law.

Article 8 bars any "general obligation to monitor the information which providers of intermediary services transmit or store", or to actively seek facts indicating illegal activity. A host that checks content voluntarily, in good faith and diligently, keeps its exemption (Article 7). The DMCA has a comparable rule in 17 U.S.C. 512(m).

DSA notice and action: what a valid notice contains

DSA Article 16 requires every hosting provider to run a notice mechanism that is "easy to access and user-friendly" and lets anyone submit notices "exclusively by electronic means". It must make it easy to include four elements:

1. a sufficiently substantiated explanation of why the information is illegal content;
2. "the exact electronic location of that information, such as the exact URL or URLs";
3. the sender's name and email address, except for notices about child sexual abuse offenses;
4. a statement of the sender's "bona fide belief" that the notice is accurate and complete.

A notice gives the host actual knowledge only where it allows "a diligent provider of hosting services to identify the illegality of the relevant activity or information without a detailed legal examination" (Article 16(3)). A precise notice about plainly illegal content does that; a disputed copyright claim that turns on licenses or exceptions may not. That is why a notice is not an automatic takedown order.

The host confirms receipt without undue delay if the sender left electronic contact details, decides "in a timely, diligent, non-arbitrary and objective manner", and tells the sender its decision and the options for redress (Article 16(4) to (6)). There is no deadline in hours. Trusted flaggers (Article 22) and the suspension of people who keep sending manifestly unfounded notices (Article 23) concern online platforms only.

Statement of reasons (Article 17)

When a host restricts a customer because content is illegal or breaches its terms, it owes that customer "a clear and specific statement of reasons" from the moment the restriction applies, if it has the customer's electronic contact details. That covers removing, disabling or demoting content, stopping payments, suspending or ending the service, and suspending or closing an account. The statement must give:

• the decision, its territorial scope and its duration;
• the facts relied on, including whether a notice or the host's own investigation led to it;
• whether automated means were used;
• the legal or contractual ground, and why the content falls under it;
• the options for redress.

For hosting customers, redress mostly means the courts: internal complaint systems and certified out-of-court bodies are duties of online platforms (Articles 20 and 21). Orders under Article 9 follow their own rules instead (Article 17(5)).

Orders from authorities (Articles 9 and 10)

Article 9 creates no new powers (recital 31). It sets minimum conditions for orders that national judicial or administrative authorities issue "on the basis of the applicable Union law or national law in compliance with Union law". An order must cite its legal basis, explain why the content is illegal by reference to specific provisions, identify the authority, locate the content, "such as one or more exact URL", and describe the redress available. Its territorial scope must be limited to what is strictly necessary.

The host tells the authority without undue delay whether and when it complied, and tells the customer at the latest when it complies, or at the time the order sets, with reasons and redress options (Article 9(5)). Article 10 applies the same model to orders for information about specific recipients, which can only reach information "already collected for the purposes of providing the service and which lies within its control".

National law decides who may issue orders. In Romania, Law No. 50/2024 lets sector regulators and judicial authorities do so; ANCOM recorded four removal orders and two information orders in 2024. Terrorist content can also be ordered offline within one hour under Regulation (EU) 2021/784.

Suspected criminal offenses (Article 18)

A host that becomes aware of information "giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person or persons has taken place, is taking place or is likely to take place" must promptly inform the law enforcement or judicial authorities of the member state concerned. If it cannot identify that state, it informs the authorities where it or its legal representative is established, or Europol, or both.

The scope is narrow: threats to life or safety, not every offense and not copyright claims. Separately, our own rules remove child sexual abuse material at once and report it to the competent authorities in every location.

DSA vs DMCA: how the two systems compare

Both tie a host's protection to what it knows, but differ in the details:

So a DMCA notice sent to a server in Amsterdam does not become a DSA notice by arriving there. It counts as one only if it contains the Article 16 elements and concerns content that is illegal under EU or Dutch law. Our guide to DMCA-ignored countries explains what our other locations apply instead.

How we handle Digital Services Act hosting notices

1. Every complaint about a server in the Netherlands, Romania or Bulgaria is logged and checked against EU and national law.
2. Citing the US DMCA changes nothing. What matters is whether a notice meets Article 16 and concerns illegal content: one that does is assessed on its merits, whoever sends it, and one that does not is handled as a foreign notice under our DMCA and complaints policy.
3. A valid court order, an Article 9 order or a notice that meets Article 16 can require action. The customer is informed first and can respond, unless a court forbids it; when a matter is not urgent or sealed, we normally allow 5 business days. A restriction comes with a statement of reasons.
4. Requests and outcomes are counted, without customer data, in our quarterly transparency report, which has a category for DSA notices.

Frequently asked questions

Does the Digital Services Act apply to hosting providers?

Yes. Hosting is one of the three intermediary services the DSA covers, with mere conduit and caching. The core DSA hosting provider obligations are a notice-and-action mechanism, statements of reasons, handling valid orders and reporting threats to life or safety; separately, hosts keep a conditional liability exemption. Online platforms and the largest services carry extra duties.

What is notice and action under the DSA?

It is the procedure in Article 16. Anyone can notify a host of content they consider illegal, giving reasons, the exact URL, their name and email address and a good-faith statement. A notice that lets a diligent host see the illegality without a detailed legal examination gives it actual knowledge, and the host must then decide in a timely, diligent and objective way.

Is the DSA the same as the DMCA?

No. The DMCA is a US law about copyright only, with a fixed takedown and counter-notice routine. The DSA is an EU regulation covering all illegal content, and it leaves the decision to the host, subject to a statement of reasons and the courts. A DMCA notice has no force under the DSA unless it also meets Article 16.

Does the DSA apply to servers outside the EU?

Not as local law. The DSA is not part of Swiss, Moldovan or Malaysian law, and not yet part of Icelandic law. Its scope follows users, though: Article 2(1) covers services offered to people in the EU wherever the provider is established, so an EU-facing platform can fall under it even on a server outside the EU.

Do hosts have to monitor content under the DSA?

No. Article 8 forbids imposing a general obligation to monitor stored information or to actively seek facts indicating illegal activity. Hosts must act on specific notices and orders instead. A host may still check content voluntarily without losing its liability exemption, provided it acts in good faith and diligently (Article 7).