Digital Services Act (DSA): Obligations for Online Shops Explained Simply

1. What Is the Digital Services Act and What Is It About?

The Digital Services Act, or DSA, is Regulation (EU) 2022/2065 of the European Union. Unlike a directive, a regulation does not first need to be transposed into a German law, it applies directly in all member states from the date it becomes applicable. For enforcement and certain national responsibility questions, Germany additionally passed the Digitale Dienste Gesetz (DDG), which determines which authority is responsible for oversight in Germany. The DSA itself is addressed at so called intermediary services, meaning providers that transmit, store, or make accessible information on the internet.

For online shops, one subcategory matters most, hosting services, and within that, online platforms. A hosting service stores content on behalf of others, while an online platform additionally disseminates such content to the public, for example through customer reviews, comments, or offers from third party sellers. A shop that sells only its own products, without a review function and without a marketplace for third party sellers, has comparatively few direct obligations under the DSA. But as soon as customers can publish text, images, or reviews, or external traders sell through the shop, the shop counts as a hosting provider or online platform for that function and must follow the corresponding rules.

A simple thought experiment helps with this classification: picture two shops, a pure furniture maker's shop with no comment function at all, and a marketplace that additionally allows independent craftspeople to offer their own products. The furniture maker's shop sells only its own goods and has no function through which third parties publish content, so it stays largely outside the DSA's core obligations. The marketplace, on the other hand, lets outside traders appear and publicly displays their offers, making it a textbook example of an online platform under the DSA. Most real shops sit somewhere between these two extremes, and that is exactly why it is worth carefully examining your own functions instead of assuming, in general terms, that you are affected or not.

For practical work on your shop, this means the following: before you dive into individual DSA provisions in detail, it is worth doing a short function check of your own shop. Ask yourself which areas of your shop can be filled with content by customers or third parties, and jot these areas down as keywords. This short list is the basis for all further steps in this article, in particular for the checklist in section 5. Without this clarity about your own shop functions, any discussion of the DSA inevitably remains abstract.

2. Since When Does the DSA Apply?

The DSA formally entered into force on 16 November 2022, but its practical application was staggered. Very large online platforms and very large online search engines, individually designated by the European Commission, such as major marketplaces and social networks, had to comply with the full obligations from around August 2023, since these providers were subject to earlier deadlines given their reach. For all other intermediary services, hosting providers, and online platforms, meaning also the vast majority of small and medium online shops with a review or marketplace function, the DSA has applied without exception since 17 February 2024. There is no further transition period for this group, the obligations have applied since that date.

For the practical implementation, the time that has now passed means that fixes can no longer be postponed by pointing to an ongoing transition period. Unlike some other EU initiatives, there is no further staggered national deadline, the regulation has applied directly since that date without any further action by the German legislator. In parallel, the German Digitale Dienste Gesetz (DDG) mainly established the responsibility of the Bundesnetzagentur as the national coordinator, but it does not create its own substantive deadlines that differ from the DSA. Anyone who has not yet carried out an inventory should not treat this as a future project, but as a task that is already overdue.

A misconception that often comes up in this context concerns the German implementation: some shop owners assume that without a fully drafted German law, nothing binding can apply yet. That is precisely not the case for the DSA, because it is a directly applicable EU regulation and not a directive that would first need to be brought into force at national level. The German Digitale Dienste Gesetz only regulates accompanying matters such as responsibilities and procedures, the actual substantive obligations arise directly from EU law. Anyone waiting for a further German law before taking action is confusing rules on responsibility with the actual substantive obligations.

3. Who Is Affected, Does This Apply to Small Shops Too?

Yes, the DSA does not initially distinguish by company size but by which functions a shop actually offers. What matters is whether your shop stores and publicly disseminates content from users or third party traders. This includes, for example, a product review function, a question and answer area, a forum, or a marketplace model where external traders sell through your platform. If such a function exists, the basic DSA obligations apply regardless of whether you run a one person business or a large retail company. Micro and small enterprises, meaning businesses with fewer than 50 employees and an annual turnover or balance sheet total under 10 million euros, are relieved of some additional obligations, such as certain transparency reports or out of court dispute resolution requirements, but the basic obligations, such as the point of contact, the notice and action mechanism for illegal content, and the ban on manipulative interface designs, still apply to them as well. If you sell only your own products without any user content function, your exposure is significantly lower, but the ban on manipulative interface designs in checkout and cookie banners still applies, since it is framed very broadly.

4. Deadlines and Thresholds at a Glance

The table below summarizes which deadlines and thresholds apply to different groups of providers.

As the table shows, the concrete scope of obligations depends less on your shop's founding date or industry than on the functions actually in use. A shop can therefore grow into a new category over time, for example when a review function or a marketplace module for third party traders is introduced later on. It is therefore worth reviewing your own classification not just once, but again whenever your shop undergoes major functional changes. The following section shows which concrete steps follow from this.

5. What You Concretely Need to Do

The first and most important step is an honest inventory: does your shop have any function at all through which customers or third party traders can publish content? If so, you should next check whether your contact options for authorities and users are clearly findable, and whether there is a simple way for users to report illegal content, such as a fake review or an illegal listing. It is equally important to look at your terms and conditions, your checkout process, and your cookie consent, since this is where unintentional dark patterns often hide, such as pre ticked boxes or hard to find cancellation links. The checklist below summarizes the most important steps.

6. Fines and Risks of Non-Compliance

Enforcement of the DSA in Germany runs through the Bundesnetzagentur, which has been designated as the national Digital Services Coordinator. It can investigate violations, issue orders to remedy shortcomings, and, within its remit, impose fines. For very large online platforms and search engines, the European Commission itself can also act and impose sanctions based on a share of the company's worldwide turnover. For smaller providers, responsibility generally lies with the Bundesnetzagentur, which has its own catalogue of fines and its own powers to issue orders. What amount might be at stake in an individual case depends heavily on the type of violation, the size of the company, and whether a violation was repeated or remedied, so specific figures cannot be stated reliably in general. Beyond the financial risk, violations can also lead to regulatory orders to fix the issue and to reputational damage if it becomes known that a shop ignores reports of illegal content or uses manipulative interface designs.

Besides the regulatory risk, there is a second, often underestimated risk: payment providers, marketplace partners, and advertising networks increasingly check for themselves whether their contractual partners comply with basic rules such as the DSA. If it becomes known that a shop obviously ignores illegal content or uses manipulative interface designs, this can, in the worst case, also lead to the termination of payment or advertising partnerships, regardless of any regulatory fine. In practice, this economic risk often hits faster and more directly than a formal administrative procedure.

Even though a blanket figure cannot be stated reliably, a rule of thumb applies: the sooner a violation is recognized, reported, and fixed, the milder the regulatory response tends to be. A proactive review of your own shop functions and a timely fix of identified gaps are therefore more effective than waiting for a possible complaint.

7. Common Misconceptions About the DSA

A widespread misconception is that the DSA only concerns the very biggest names like Meta, Google, or Amazon. In fact, the regulation applies to all providers of intermediary services, hosting services, and online platforms, regardless of size, as soon as the corresponding functions are offered. A second misconception is the assumption that without your own marketplace you are automatically off the hook. Even a simple shop with a product review function is a hosting provider for that function and must offer a way for users to report illegal content.

A third misconception concerns so called dark patterns, meaning interface designs that deliberately steer users toward decisions they would not otherwise make, for example pre ticked boxes at newsletter sign up or hard to find cancellation buttons. Many shop owners consider this purely a design choice, but the DSA explicitly prohibits such practices. Finally, some small businesses believe that being classified as a micro or small enterprise exempts them entirely from the DSA. That is not correct, they are only relieved of some additional obligations, the basic requirements continue to apply once the shop has user content or a marketplace function.

A fifth, often overlooked misconception is confusing the DSA with the General Data Protection Regulation (GDPR). Both frameworks come from the EU and concern digital services, but they regulate different things: the GDPR protects personal data, while the DSA regulates content, moderation, transparency, and marketplace structures. A shop can therefore already be well set up under the GDPR and still have work to do on its notice and action mechanism for illegal content or on labeling advertising. It is worth treating both topics separately instead of assuming that an existing data protection concept automatically also covers DSA requirements.

These misconceptions have one thing in common: they lead shop owners to either ignore the topic of the DSA completely or dismiss it as irrelevant in general, even though a closer review often takes only a few hours. Precisely because the basic obligations are manageable, this review is, in the vast majority of cases, well worth it rather than simply accepting the risk of a violation. A short, structured look at your own shop functions does not replace legal advice, but in practice it usually creates far more clarity than many owners initially expect.

8. What Mironsoft Can Take Care of For You

As an agency for Magento and Hyva based online shops, we check for you whether and to what extent your shop falls under the DSA through review functions, comment areas, or a marketplace function. Building on that, we set up a practical notice and action mechanism that lets users submit reports easily and lets you handle them in a traceable way. We also examine your checkout and cookie consent process to identify possible dark patterns and redesign them in a legally sound way, and we help you clearly label advertising and sponsored content in your shop frontend. If you operate a marketplace with third party traders, we also help you build a traceable trader verification process that meets the requirements for trader traceability.

Much of this can be implemented in a Magento or Hyva shop with manageable effort, for example an additional reporting form in the frontend, a clearly visible contact page, or an adjustment to the cookie consent component so that pre ticked boxes are no longer used. We deliberately talk to you in concrete steps for your shop, not in legal paragraphs, so that in the end you know exactly what needs to be done in your case and what does not.

A one time review is often just the beginning, since shop functions change over time, for example through a new review plugin or an additional marketplace extension. We therefore recommend reviewing your shop's DSA classification again whenever its core functions change, rather than relying on a single inventory.

Note: This article provides general information and does not replace individual legal advice.

9. Summary

The Digital Services Act has applied since 17 February 2024 to practically all online shops that offer reviews, comments, Q&A areas, or a marketplace function with third party traders, regardless of company size. Anyone who sells only their own products without such functions is affected much less, but must still observe the ban on manipulative interface designs in checkout and cookie banners.

The most important steps are an honest inventory of your own shop functions, an easily reachable point of contact, a working notice and action mechanism for illegal content, and a critical look at checkout, cookie banners, and advertising labeling. Enforcement in Germany lies with the Bundesnetzagentur, which can issue orders and impose fines. A structured review can significantly reduce the risk, and we are happy to support you with that.

In the end, it is not about knowing every single detailed rule of the DSA by heart, but about realistically classifying your own shop functions and cleanly implementing the obvious basic obligations. For most small and medium shops, the effort is manageable once it is clear which functions are actually affected.

10. FAQ: Digital Services Act for Online Shops