The shares

Two levels of protection in Europe under the DSA: penalties and compensation

The Digital Services Act assigns a role not only to the authorities but also to individuals

by Marisa Marraffino

13 July 2026

Aggiungi Il Sole 24 Ore
ai preferiti su Google

3' min read

Translated by AI

Versione italiana

Key points

User actions
Requirements for platforms and browsers

3' min read

Translated by AI

Versione italiana

In Europe, a decisive role is played by the supervisory authorities, which have the power to launch investigations and impose multi-million penalties, but individual users can also claim compensation for damages.

User actions

The legal basis is European Regulation 2022/2065, the so-called Digital Services Act (DSA), which will be fully applicable in Italia from 17 February 2024 and which aims primarily to protect minors from large-scale threats to their safety. The European regulations protect users from the risks posed by platforms, but they could also have direct implications for individual cases.

Article 54 of the DSA does, in fact, also allow users to claim compensation for damages before a national court in the event of infringements by platforms. However, it will be necessary to prove the causal link between the platform’s failure to act and the damage alleged. This is certainly no easy burden of proof, but it is nonetheless possible, and significant ‘assistance’ could come both from US court rulings and from the conclusion of the investigations launched by the European Commission.

As well as quantifying the damage immediately, the user must also demonstrate that this would not have occurred had the intermediary service provider complied with its obligations under the DSA.

Requirements for platforms and browsers

In particular, under Article 34, online platforms and search engines of very large scale (more than 45 million active users) must identify and prevent systemic risks arising from the design, operation or use of their services, and draw up an assessment of the security measures adopted at least once a year. They should, for example, prevent the dissemination of illegal content and adverse effects on fundamental rights, public safety and gender-based violence.

The national court could order the platforms to produce the internal document on risk assessment, even whilst preliminary investigations are ongoing. Should Big Tech companies invoke trade secrets, the judge could infer evidence unfavourable to the platform itself on the basis of Article 116 of the Code of Civil Procedure.

Article 54 of the DSA does not provide further guidance on the procedural aspects of claims for damages, but it remains a clear indication that European legislation aims to enable direct protection of consumers (so-called private enforcement) by paving the way for potential claims for damages in all Member States.

In the meantime, any user can report infringements free of charge using the complaint tool, as provided for in Article 53 of the Digital Services Act. Reports can be submitted to the digital services coordinator – in Italia, this is AGCOM – via certified email (PEC) using the form available online.

For platforms with fewer than 45 million users (not very large online platforms), the preliminary investigation is conducted directly by AGCOM, whilst in all other cases the European Commission has exclusive jurisdiction.

In Italia, since January 2025, 20 reports on this matter have been sent to AGCOM the protection of minors, which have been treated as complaints under the DSA.

The person who lodged the complaint is not necessarily kept informed, but the outcome of the investigation is public and should therefore be monitored. Reports should be as accurate as possible, and the coordinator periodically updates the list of so-called reliable reporters, usually associations and organisations involved in the protection of minors and internet users in general.

Every six months, platforms are required to publish the number of their active users , so that they can fulfil their obligations.