Article 16 of the EU's Digital Services Act (DSA) gives every individual and organization a formal way to report illegal content, or material that breaks a platform's own rules: to the hosting service displaying it. A notice containing the three elements the regulation requires creates what the DSA calls actual knowledge on the part of the provider, for the specific item identified. From that moment the provider must act expeditiously to remove or disable the content, or risk losing the liability exemption that protects intermediaries under EU law. The regime has applied in full across the EU since 17 February 2024.
The appeal is scope. The DSA mechanism is not limited to copyright: pirated course material, leaked private photos, defamatory posts, counterfeit listings, and impersonation profiles can all go through one channel, with statements of reasons, appeal procedures, and a national regulator behind the process. The DMCA, the US statute most takedown work runs on, still matters, and platforms honor it worldwide by policy. Below is the full DSA notice-and-action chain, then a straight comparison with the DMCA so you can pick the fastest route.
Where the DSA applies and which platforms must accept notices
The DSA is Regulation (EU) 2022/2065, directly applicable in all 27 member states and fully in force since 17 February 2024. It replaced the notice-and-action rules that had lived in the 2000 E-Commerce Directive and gave them teeth.
Its reach follows users, not headquarters. Any intermediary service offered to recipients in the EU is in scope, including platforms incorporated in the United States. If your material is live on an American social network but visible to EU users, that network owes those users DSA duties. A purely US-law strategy leaves tools on the table, and it helps to first check whether the DMCA works internationally.
The Article 16 notice mechanism is mandatory for hosting services, a category covering social networks, video platforms, marketplaces, forums, and file hosts of every size. Enforcement splits by scale: platforms and search engines with at least 45 million average monthly recipients in the EU answer directly to the European Commission, while everyone else answers to the Digital Services Coordinator (DSC) of the member state where they are established. Every member state was required to designate its DSC by February 2024.
Two boundaries matter. The United Kingdom sits outside the DSA since Brexit, so UK copyright takedown notices remain the working route for UK-focused services. And "illegal content" is defined by reference to EU law or the law of any member state, which means the same material can be actionable in one country and contested in another. Name the law you rely on.
What a valid Article 16 notice must contain
The formalities are lean by design. A notice submitted through the platform's official mechanism must include three things:
- A sufficiently substantiated explanation of why the content is illegal, or why it is incompatible with the platform's terms and conditions.
- Clear identification of the electronic location of the material, the specific URL or URLs, or the complete item of content where a whole post, listing, or file is at issue.
- The notifier's name and electronic contact details.
Any individual or entity can file. You do not have to be the rights holder, though ownership affects what a court will do later. The phrase doing the legal work is "sufficiently substantiated": name the rule you rely on, copyright, defamation, consumer protection, a member state's fraud or impersonation statutes, and show your connection to the material. For copyright claims that means proof of ownership or authorization. Dated, verifiable copies persuade; bare assertions do not. Timestamped evidence and the discipline of proving content ownership carry the load on both sides of the Atlantic.
The regulation also covers pure terms-of-service complaints, which platforms must process through the same mechanism. The consequences differ. The actual-knowledge trigger, and the liability pressure that follows, attaches to illegal content. A terms complaint drives policy enforcement without putting the platform's legal shield on the line.
There is no penalty-of-perjury attestation as in the DMCA, and a random support email is not the privileged channel. File through the mechanism the platform designates, usually described in its DSA transparency page, because that is the channel the regulation contemplates.
Without undue delay, what the platform owes you once it knows
A qualifying notice creates actual knowledge, and that starts the liability clock. A hosting provider with actual knowledge of specific illegal content must act expeditiously to remove or disable access, or it forfeits the intermediary exemption. As with the DMCA's identical word, the DSA fixes no number of days, so realistic expectations about how long takedowns take transfer roughly between the two regimes.
Be precise about what a notice does not do. Actual knowledge does not itself compel removal. A provider that thinks a notice is unfounded can decline it, accepting the risk that a court later finds the content illegal, at which point the exemption is gone and the platform's exposure changes. A decision that must be obeyed is a different instrument: an order to act against illegal content under Article 9, issued by a court or competent authority, which providers must comply with without undue delay.
That phrase does firmer work in the procedural duties. Statements of reasons after a restriction are due without undue delay, and internal complaints are processed on the same standard. Terrorist content runs on a separate EU regulation with its own one-hour removal duty, measured from an authority's referral.
The underlying trade should feel familiar: in both systems a private notice is not a binding order, it is a lever on the platform's safe harbor once knowledge is in hand.
Statements of reasons under Article 17
When a hosting provider restricts content, removes it, hides it, reduces its visibility, or suspends or terminates a user's ability to post, it must give the affected user a statement of reasons, without undue delay.
The requirements are concrete. The document must be durable, meaning a copy the user can keep, and written in the language the user primarily used. It must set out the facts and circumstances, say whether the decision rested on alleged illegality or on a terms breach, disclose whether the assessment involved human review or automation, and identify the avenues to contest it, the internal complaint system, certified out-of-court settlement, or a court.
One point trips up filers. The statement of reasons goes to the person whose content was restricted, not to the notifier. You may receive a status update; the binding documentation duty runs to the other side. That still serves you, because every statement locks the platform's reasoning into the record, and very large platforms must file those statements in a public, searchable Commission database. If a platform tells the user your notice was unfounded while telling a regulator something different, that inconsistency is exactly what a Digital Services Coordinator, or a court, will want to see.
Challenging outcomes: internal complaint systems, out-of-court bodies, and Digital Services Coordinators
The DSA builds an appeal architecture around moderation decisions, but who holds the decision determines who can use it.
The internal complaint-handling system required by Article 20 belongs to recipients of the service, the people whose content or accounts were restricted. They can challenge a decision free of charge, and the platform must process the complaint without undue delay. Notifiers are not symmetric here. If the platform rejects your notice, you generally cannot force an internal appeal of that rejection, because the regulation frames complaints as protection for the moderated party. Filers used to the DMCA's counter-notice symmetry expect the same structure; the DSA is deliberately different.
The second rung is out-of-court dispute settlement under Article 21, for disputes between users and online platforms. Bodies certified by a Digital Services Coordinator resolve these disputes faster and cheaper than courts. The outcome binds the platform only where the user has agreed to it, and neither side gives up access to a judge.
The third rung is the one notifiers use. Any individual or entity may complain to a DSC about an alleged DSA infringement, a platform without a functioning notice mechanism, or one that ignores duly substantiated notices. DSCs have investigative and fining powers, with penalties that can reach 6 percent of a provider's annual worldwide turnover, and the Commission enforces directly against the very largest platforms; it has already opened non-compliance proceedings against several of them. Court remains open alongside the regulatory route: sue the poster directly, or, where a platform had actual knowledge and did nothing, argue that its exemption is forfeited.
Trusted flaggers and priority processing under Article 22
The DSA also formalizes who jumps the queue. Digital Services Coordinators award trusted flagger status to organizations that demonstrate expertise in detecting a specific type of illegal content, that represent affected interests or have a proven flagging record, and that file accurately and responsibly. The status runs for a defined period and can be withdrawn.
The payoff is procedural. Hosting providers must process and decide notices from trusted flaggers with priority. A trusted flagger's notice still needs substantiation, and it still creates actual knowledge exactly like yours. What changes is the queue position.
For most filers the status is irrelevant, a well-documented notice already triggers the duty to act expeditiously. It is worth pursuing for rights organizations and enforcement teams filing at volume with an establishment in a member state. Professional filing services occupy the same practical space: knowing each platform's mechanism, evidence conventions, and escalation habits does more for turnaround time than any single legal lever.
How the DSA differs from the DMCA
The two regimes answer different questions. Title II of the US Copyright Act, the DMCA notice-and-takedown and safe harbor system, addresses copyright infringement through US-located intermediaries. The DSA addresses all illegal content on services offered in the EU, plus terms-of-service breaches. If your claim is "they copied my work," both may apply. If your claim is defamation, a counterfeit listing, or an impersonation profile, the DMCA is the wrong tool. For the US fundamentals, start with the difference between copyright and the DMCA.
Formalities diverge sharply. A DMCA notice must satisfy six statutory elements under 17 U.S.C. § 512(c)(3), signature, identification of the copyrighted work, identification of the infringing material with location details, contact information, a good-faith statement, and a penalty-of-perjury attestation, or it is not valid and the takedown clock never starts. The DSA asks for three elements and no perjury clause. The US formality exists because the notice strips a shield only copyright claims can reach; the DSA's lighter form reflects the breadth of what it covers. A walkthrough of the DMCA notice template shows how each element gets drafted.
The channels differ as well. DMCA notices go to a designated agent, which US services must register with the Copyright Office to keep safe harbor. DSA notices go through an in-service reporting mechanism.
The counter-processes are the sharpest split. Under the DMCA, a counter-notice under § 512(g) puts the provider on a clock: restore within 10 to 14 business days unless the claimant files suit. The DSA has no counter-notice and no restoration clock; the recipient's path is the statement of reasons, the internal complaint, an out-of-court body, and ultimately a court.
The consequences differ too. The DMCA conditions safe harbor on a reasonably implemented repeat-infringer policy under § 512(i); the DSA has no equivalent condition, though account-level sanctions must be explained in statements of reasons. And a bad-faith DMCA filer faces damages under § 512(f), while abusive DSA notices are handled through member-state law.
Choosing your route, DSA notice, DMCA takedown, or both
Route by claim and location. For copyright infringement on a platform operating in the EU, file the DMCA notice first: it is the fastest, best-understood instrument, and platforms process it globally as a matter of policy. The mechanics are covered in how to file a DMCA takedown notice; the DSA stays as backup leverage if a copy sits on a host that ignores it.
For non-copyright illegality, impersonation, scams, counterfeit goods, defamatory material, there is no DMCA answer. The DSA mechanism, alongside the national procedures it supplements, is the right door. Impersonation is the clearest example: getting impersonation accounts removed runs through platform reporting and DSA-style processes, not copyright.
Copyright in the EU carries one more layer. A separate Article 17, this one in the EU Copyright Directive, not the DSA, imposes licensing duties that run on upload filters, which is why the big services block some infringing uploads before publication.
One caution for copyright cases: check whether the use might be lawful before filing. In the US that means the fair-use analysis and knowing when not to file a DMCA notice; in the EU, member-state exceptions differ, and a misfired notice costs credibility with the platform's moderation team.
If both routes fit, use both. Nothing in either law creates exclusivity. A DMCA notice addresses the copyright claim; a parallel DSA notice frames the same material as illegal distribution in the EU. The combination can move US-based platforms too, since their compliance teams treat EU regulatory exposure seriously.
Frequently asked questions about DSA notices
Does the DSA replace the DMCA in Europe?
No. They are different laws from different jurisdictions running in parallel. The DMCA is a US statute that platforms honor worldwide as policy; the DSA is an EU regulation creating duties for services offered to EU users. On copyright, both can cover the same material, and filing both is often the fastest path to removal.
How fast must a platform act on a DSA notice?
The regulation sets no fixed removal deadline. A valid notice creates actual knowledge, and the provider must then act expeditiously to keep its liability exemption. Statements of reasons and internal complaint processing are due without undue delay, authority orders must be obeyed without undue delay, and terrorist content follows a separate regulation with a one-hour duty.
Can a US company or individual use the DSA?
Yes. Article 16 allows any individual or entity to submit a notice, with no EU residency requirement. What matters is that the platform offers a service in the EU and the content is accessible to EU users. Enforcement runs through member-state Digital Services Coordinators, so the follow-through differs from a US filing.
What happens if the platform ignores a valid DSA notice?
You keep three options. Complain to a Digital Services Coordinator, which can investigate and fine. Escalate through the platform's other channels while keeping your records. Or go to court: a provider that had actual knowledge and failed to act expeditiously can lose its liability exemption, which changes the litigation calculus against the platform itself.
Do you need trusted flagger status to be taken seriously?
No. Any substantiated notice creates actual knowledge and the same duty to act expeditiously. Trusted flagger status, granted by a Digital Services Coordinator to vetted organizations, buys queue priority rather than greater legal effect. For most rights holders, a documented notice, or a filing service that knows each platform's mechanism, achieves the same result.
What to do before you file, and after
- Establish the basis. Illegal content is defined by EU or member-state law, so decide which rule your notice relies on before opening the report form. That choice is the substantiation.
- Preserve evidence first. Capture URLs, screenshots, and dated proof of ownership before filing, because material moves or disappears once a platform reacts.
- Use the official mechanism. Find the notice channel on the platform's DSA transparency page rather than a support email, and include all three elements: reasons, location, contact details.
- Log everything. Dates, channels, and case numbers are what a Digital Services Coordinator complaint or a court action will be built from.
- Escalate deliberately. An ignored or rejected notice can go to the relevant DSC, and for copyright claims a parallel DMCA filing through the platform's agent remains open.
- Bring in help when the problem repeats. If the same content resurfaces across services, a professional takedown service can run both routes on your behalf, with pricing published up front.