The Digital Services Act (DSA) introduces obligations for intermediary service providers that are tailored to the type of service itself. Each provider needs to understand exactly which category it falls into, as this determines which obligations it has to fulfil.
The DSA classifies intermediary services into three main categories:
- Mere conduit services: these are services that merely allow the transfer of data between users, without any modification of the content.
Examples: Internet access providers, telecommunications companies, browser providers, domain registrars and registries, DNS and VPN service providers, certificate and anti-virus providers, messaging application providers.
Role and obligations: As a general rule, these providers do not have an obligation to inspect or remove content, but they are obliged to act on a request from the competent authorities. These providers may be held liable for the content of their users under the conditions set out in Article 4 of the DSA. - Caching services: these services allow data to be stored for a limited period of time in a way that increases the speed of access to content.
Examples: network infrastructure providers such as content delivery networks (CDNs).
Role and obligations: Similar to exclusive downloading, these providers are responsible for acting swiftly when alerted by the competent authorities to illegal content. These providers may be held liable for the content of their users under the conditions set out in Article 5 of the DSA. - Hosting services: this category includes most of the services that allow the storage of data uploaded by users.
Examples: providers of online platforms such as social networks, online marketplaces, content sharing websites (including discussion forums and blogging platforms, and video sharing services).
Role and obligations: Hosting services have wider obligations, including the establishment of mechanisms to report illegal content and deal with it swiftly. These providers can be held liable for the content of their users under the conditions set out in Article 6 of the DSA.
Additional category - Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs): if an online platform or search engine reaches 45 million monthly active users in the EU, the provider falls into a special category. They are subject to the largest set of obligations, which in addition to those listed above, include conducting regular systemic risk assessments, providing access to data for vetted researchers and conducting external audits.