The EU’s digital rulebook and the future of online rights
For years, the internet has operated according to a simple bargain that users rarely negotiated. Platforms offer communication, entertainment, shopping, and information, while collecting attention and personal data at enormous scale. In return, people accept opaque moderation systems, targeted advertising, profiling, and terms of service that few can realistically challenge.
The Digital Services Act (DSA) is the European Union’s attempt to renegotiate that bargain. It creates obligations for social networks, marketplaces, search engines, hosting companies, and the largest online platforms. Its language is broad, but its central promise is concrete: people should have more information about how digital services affect them and more ways to contest decisions made by those services.
That promise makes the law significant for privacy and internet rights. Yet a legal framework can produce genuine accountability only when regulators have the resources, independence, and determination to enforce it. The DSA could become a meaningful check on platform power, or it could become another layer of compliance language surrounding the same surveillance-based business model.
Why the DSA matters now
The law arrived after years in which online platforms grew faster than public oversight. Content moderation decisions were often made through private rules, automated systems, and poorly explained appeals processes. Online marketplaces hosted counterfeit or unsafe products, while advertisers and data brokers built detailed profiles from browsing behavior, purchases, location signals, and inferred interests.
The DSA does not abolish this system. It establishes duties intended to make it more transparent and contestable. Platforms must explain certain moderation decisions, provide mechanisms for reporting illegal content, and offer internal complaint procedures. Very large online platforms and search engines face additional obligations because their reach creates wider social risks.
This matters because power online is frequently invisible. A post may disappear without a clear reason. A seller may be suspended by an automated system. A user may receive different prices, search results, or political messages based on a profile they cannot inspect. By requiring explanations and risk assessments, the DSA tries to turn hidden infrastructure into something that can be examined by users, researchers, journalists, and regulators.
The law also reflects a change in political thinking. For a long time, policymakers treated platforms as neutral intermediaries that merely carried information. The DSA recognizes that recommendation engines, advertising systems, interface design, and content-ranking tools actively shape public life. That recognition is important, even if the legal remedies remain incomplete.
What platforms must do
The DSA applies proportionate obligations. Small services are not regulated in exactly the same way as companies operating across the entire European market. All providers must meet baseline duties, while larger services face stricter requirements linked to their potential impact.
A platform generally needs to provide clearer terms and conditions, explain content restrictions, and establish a notice-and-action system for allegedly illegal material. Users should be told why content was removed, restricted, or demoted, except where detailed disclosure would create legal or safety problems. They must also have access to an appeal process that is more meaningful than sending a complaint into an automated queue.
Online marketplaces have additional responsibilities. They must verify and display information about traders, make reasonable efforts to identify illegal products, and improve traceability within commercial transactions. This does not guarantee that every seller is trustworthy, but it raises the cost of anonymous and fraudulent activity.
The largest platforms must assess systemic risks, including threats to fundamental rights, electoral processes, public health, and civic discourse. They are expected to reduce those risks and submit to independent audits. They must also provide greater access to certain data for approved researchers. In principle, this can help outsiders investigate how recommendation systems, advertising tools, and moderation practices operate.
The strongest privacy-related provision concerns targeted advertising. Platforms cannot use sensitive personal data for advertising, and they cannot target children with personalized advertising. The law also prohibits certain deceptive interface practices, often called dark patterns, that manipulate users into choices they did not intend to make. These restrictions are valuable, although proving manipulation in a complex interface may be difficult.
Rights on paper and rights in practice
The DSA gives users a vocabulary for challenging online decisions. A person whose account is restricted or whose content is removed should receive a statement of reasons. A person who believes a platform acted unlawfully can use an internal complaint system and, in some circumstances, an out-of-court dispute settlement body.
These rights are stronger than the old model, where a platform could simply point to its terms and close the conversation. Still, access to a process does not automatically mean access to justice. A user may receive a formal explanation that says little more than “this content violated our policies.” An appeal may be reviewed quickly by a contractor with limited context. A small business may be unable to spend hours contesting an automated suspension.
Transparency also has limits. Revealing the precise workings of anti-abuse systems could help malicious actors evade detection. Protecting trade secrets can be legitimate, but it can also become a convenient excuse for withholding information. The important question is whether explanations are specific enough for an ordinary person to understand what happened and decide whether to challenge it.
The DSA should therefore be judged by outcomes rather than by the number of published policies. Users need accessible remedies, timely responses, and decisions that can be independently reviewed. Regulators need technical expertise and the capacity to detect patterns across millions of complaints. Without those elements, procedural rights may exist mainly as a formal shield for platform companies.
| Area | What the DSA promises | What may limit its effect |
|---|---|---|
| Content moderation | Reasons for restrictions and appeal mechanisms | Vague explanations, automated reviews, slow appeals |
| Online advertising | Limits on sensitive-data targeting and child profiling | Difficult audits and opaque data ecosystems |
| Marketplaces | Greater trader traceability and product responsibility | Cross-border sellers and weak enforcement capacity |
| Very large platforms | Risk assessments, audits, and researcher access | Company-controlled data and disputed methodologies |
| User choice | Limits on deceptive interface design | Manipulative design can be subtle and hard to prove |
| Public oversight | National authorities and EU supervision | Uneven resources, political pressure, and legal delays |
The enforcement problem
The European Commission directly supervises the largest platforms, while national Digital Services Coordinators oversee many other services and handle parts of the enforcement system. This division can improve specialization, but it also creates coordination challenges. Digital companies operate across borders, whereas regulators often work within national legal and administrative structures.
Enforcement requires more than issuing fines after a scandal. Authorities need to examine recommendation systems, inspect advertising databases, compare public claims with internal practices, and protect whistleblowers and researchers. They must also respond quickly enough to matter. A remedy delivered years after an election, a harmful product sale, or a widespread privacy breach may have little practical value.
There is a further imbalance between public institutions and technology companies. Large platforms employ lawyers, engineers, policy specialists, lobbyists, and public-relations teams around the clock. A regulator may have formal authority but lack the staff or technical tools required to challenge a company’s preferred interpretation of its obligations.
The first years of enforcement will reveal whether the DSA is a serious instrument or a compliance exercise. High-profile investigations can establish useful precedents, particularly if they force platforms to change product design rather than merely pay fines. Penalties that are treated as a predictable cost of doing business will not alter the incentives that created the problem.
Privacy beyond platform disclosures
The DSA improves transparency, but transparency alone does not dismantle surveillance advertising. A person may learn that a platform uses personal data for recommendation or advertising and still have no realistic alternative. The service may be essential for work, social life, commerce, or political participation. Consent obtained under those conditions can be legally valid while remaining practically coerced.
This is why the wider data economy matters. Platforms collect signals directly, but they also rely on advertising intermediaries, analytics firms, data brokers, and tracking technologies embedded across the web. The result is an ecosystem in which information about a person can circulate far beyond the service where it was first generated. The deeper structure is examined in the surveillance business model, which helps explain why platform transparency cannot be separated from the economics of attention and profiling.
The DSA can restrain some abuses within that ecosystem. It can require clearer advertising labels, limit certain forms of targeting, and give researchers better opportunities to investigate systemic effects. It cannot, by itself, establish data minimization across the entire digital economy or prevent every invisible exchange between companies.
That limitation does not make the law useless. It clarifies what must happen next. The DSA needs to work alongside the General Data Protection Regulation, consumer protection rules, competition law, and legislation governing artificial intelligence. Fragmented rights can leave gaps that sophisticated companies exploit, especially when responsibility is divided between several regulators.
When transparency becomes a performance
There is a risk that platforms will satisfy the visible parts of the law while preserving the underlying systems. They may publish lengthy reports, create polished complaint portals, and describe broad risk-management processes without changing the incentives built into their products. Compliance can become a performance designed to reassure regulators and the public.
Researchers will be essential in testing those claims. Independent access to platform data can reveal whether a service amplifies inflammatory content, discriminates through advertising delivery, exposes children to harmful material, or systematically favors certain commercial interests. The safeguards must be strong enough to protect researchers from retaliation and users from unnecessary exposure of personal information.
The quality of public reporting will also matter. A platform should not be allowed to define its own success through metrics that measure activity rather than harm. Processing millions of notices does not prove that illegal content is being addressed effectively. Publishing an appeal rate does not show whether appeals are fair. Risk assessments should identify who bears the cost of a system, not simply describe the system in neutral technical language.
Civil society groups and journalists can help translate complex disclosures into public accountability. Their work should not be treated as an optional supplement to enforcement. In many areas of digital regulation, outside investigators discover problems before authorities do. A healthy DSA regime will protect that scrutiny instead of reducing it to a consultation exercise.
Practical protections for everyday users
People should not have to become legal specialists to exercise their rights, but a few habits can reduce exposure while the regulatory system develops. The DSA is most useful when users document decisions, challenge unexplained restrictions, and recognize that a platform’s default settings reflect commercial priorities rather than personal interests.
Privacy also depends on devices and networks outside the platform itself. Someone who carefully limits social-media permissions may still expose browsing activity through an insecure home router or poorly configured network. A practical guide to securing your home router shows how local protections fit into the wider effort to reduce unwanted monitoring.
Useful steps include:
- Save screenshots and decision notices when content, accounts, or marketplace listings are restricted.
- Use a platform’s explanation and appeal process instead of assuming an automated decision is final.
- Review advertising, personalization, and location settings regularly, especially on services used by children.
- Prefer services that offer chronological feeds, clear privacy controls, and meaningful account portability.
- Support independent journalism, consumer groups, and researchers who investigate platform practices.
These actions cannot correct a structural imbalance by themselves. A user cannot individually negotiate with an advertising exchange or audit a recommendation engine. They can, however, create evidence, make rights visible, and reduce the assumption that opaque design is inevitable.
The Digital Services Act deserves neither automatic praise nor easy dismissal. It is a serious attempt to place public obligations around private digital power, and it gives users tools that were previously weak or absent. Its success will depend on whether those tools produce changed behavior: clearer decisions, safer marketplaces, less manipulative design, and meaningful access to information about systems that shape public life.
That outcome will be decided through enforcement, court cases, research, and everyday use. Read the explanations platforms provide, challenge decisions that affect your rights, and pay attention to the regulators responsible for turning legal promises into practical accountability. The new rulebook matters most when people insist that it be used.