DSA Self-Assessment

Answer these 12 questions to assess your compliance with key DSA obligations

Note: Questions marked with N/A option can be skipped if they don't apply to your platform type.
Compliance Questions
You must allow users to submit notices electronically with all required elements (reason for illegality, exact URL, contact details where applicable, good-faith declaration); you must send confirmation of receipt without undue delay; inform users of the final decision and available redress options; ensure decisions are timely, diligent, non-arbitrary and objective; and if automated tools are used, you must clearly disclose that in your notification. You must not require offline/complex submission processes or ignore notices that are good enough to indicate illegality (article 16).
You must allow users to lodge complaints electronically and free of charge for at least six months after a decision; cover all decisions regarding removal, visibility restriction, suspension of service, account termination, or monetisation restrictions; ensure the system is easy to access and allows and encourages users to provide the key information needed to understand the dispute; handle complaints in a timely, diligent, non-arbitrary, and non-discriminatory manner; reverse decisions where the complaint shows sufficient grounds; inform complainants of reasoned outcomes and available redress or out-of-court settlement options; and ensure qualified staff supervise decisions. You must not rely solely on automated systems to decide complaint outcomes (article 20).
For example: Safety-critical information or settings buried in locations that are unusually difficult to find, Requiring many steps to access safety settings or to disable an optional feature, Autoplay or infinite-scroll features enabled by default with no easy and visible way to turn them off (article 25).
The ad has an option to see "about this advertiser", "who paid for this ad", and "the following information was used to show you this ad". (article 26 (1)).
(article 26 (2))
These categories cannot be used for profiling users for ads targeting: race, ethnicity, political opinions, religion, philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life, sex orientation. (article 26 (3))
for example: clearly explaining in the T&C which signals shape recommendations (e.g., viewing history, search activity, likes/dislikes, "not interested" feedback, who you follow, language preferences, watch time), why these signals matter more or less than others, and how users can adjust these inputs or choose alternative recommendation options (article 27 (1)-(2)).
For example: offering a clearly visible control that lets users switch their "For You" feed to a chronological timeline, choose a non-profiling-based recommendation mode, or modify their preferred ranking option directly from the section where the content is ordered. (article 27 (3))
For example: Minors are not shown advertisements based on profiling that uses their personal data;, implementing effective age-assurance methods; setting high-privacy defaults for minors' accounts; limiting unwanted contact; adjusting recommender-system behaviour for minors; providing age-appropriate explanations of platform features; offering clear reporting and support tools; ensuring child-friendly terms and conditions; regularly evaluating and updating these measures in consultation with minors, experts and civil-society organisations (article 28).
for example: collecting all mandatory trader details (name, contact info, ID, payment account, trade register number, compliance self-certification); verifying this information using official databases or reliable documentation; requesting timely corrections or updates; and suspending traders who fail to provide or correct the required information (article 30 (1)-(3)).
for example: maintaining secure storage systems that protect identity documents and registration details, retaining this data only for six months after the trader leaves the platform, and ensuring permanent deletion once that period expires (article 30(5)).
for example: releasing trader identity or registration details only in response to lawful requests, official requests from EU member states, or instructions from Digital Services Coordinators or the Commission, and not sharing such data voluntarily or for other purposes (article 30(6)).
for example: showing the trader's name, address, trade-registration information, and compliance self-certification directly on the product page or offer listing, in a format users can easily read and verify before purchasing (article 30(7)).
for example: assessing risks related to illegal content, fundamental rights, civic discourse, public security, gender-based violence, minors' protection, and wellbeing; analysing how recommender systems, content-moderation systems, advertising systems, data practices, intentional manipulation, inauthentic use, automated exploitation, and rapid content dissemination contribute to such risks; considering regional and linguistic factors; and securely preserving documentation of all assessments for at least three years for authorities upon request (article 34).
for example: adjusting the design, features or interfaces of the service; updating and enforcing terms and conditions; improving content-moderation systems and notice handling; testing and adapting algorithmic and recommender systems; modifying advertising systems; strengthening internal processes, documentation and supervision; cooperating with trusted flaggers and other platforms; providing user-facing information and awareness tools; implementing protections for minors (such as age verification, parental controls and abuse-reporting tools); clearly marking manipulated or AI-generated content while offering users an easy way to label it (article 35).
for example: you may use non-personal parameters such as chronological order, overall popularity, freshness of content, or global relevance rules; but you must refrain from using personal data such as viewing history, search history, likes or dislikes, "not interested" signals, follows/subscriptions, demographic inferences, device behaviour, or any other data used to build an individual user profile (article 38).
for example: you must include the ad content, the advertiser's identity, who paid for the ad, when the ad was shown, its targeting parameters (including exclusions), commercial communications, and aggregated reach data; and you must not include any personal data of users or full ad details for ads removed due to illegality. In those cases, only the applicable "statement of reasons" must be shown instead (article 39).
for example: you must provide access to the data necessary for compliance monitoring; explain the design, logic, functioning and testing of algorithmic and recommender systems; give vetted researchers access to the data specified in a reasoned request; use appropriate technical interfaces such as APIs or secure databases; and you may request amendments only when the data is unavailable or when access would cause security or confidentiality risks—proposing alternative safe ways to provide the required data; you must not disclose data beyond what the lawfully issued request requires, and you must not refuse access without valid justification (article 40).
Optional: Help us understand your platform

This information helps us provide better insights (all fields optional)

Optional - if you'd like us to follow up with detailed recommendations
Optional - you can provide platform type and region instead
Optional - URL of your platform