Operating your own marketplace or platform

• Regulation (EU) 2022/2065 — Digital Services Act, Articles 11, 13, 30 and 31
• Regulation (EU) 2016/679 — GDPR, Article 27
• Regulation (EU) 2023/988 — GPSR Article 22
• Regulation (EU) 2019/1150 — platform to business

Who has to appoint one

Any provider of intermediary services offering services in the Union without an establishment there: marketplaces, hosting providers, forums, social features, app stores and any service that stores information provided by users. The legal representative must be designated in writing and notified to the Digital Services Coordinator of the member state where it is established.

Thresholds and exemptions

Micro and small enterprises are exempt from several platform-specific duties, including trader traceability and the internal complaint system, but not from designating a legal representative or from the notice-and-action mechanism. Very large platforms above 45 million monthly users have a much heavier regime supervised by the Commission.

What must appear on the label

Publication of the legal representative's name, postal address, email and telephone in an easily accessible part of the interface, plus a single point of contact for authorities and another for users. Terms and conditions setting out moderation policies in clear language.

Marketplace fields

Payment providers and app stores verify DSA compliance before onboarding. Under GPSR Article 22 a marketplace must register in the Safety Gate portal, act on authority notices within two working days, and design its interface so sellers can supply the responsible person details.

Documentation you must hold

The designation of the legal representative and the notification to the Coordinator. Notice-and-action procedures with statements of reasons for every moderation decision, submitted to the Commission's transparency database. Trader verification records under Article 30. Annual transparency reports. Internal complaint handling and out-of-court dispute settlement information. GDPR records for the personal data processed.

Standards and testing

Not applicable, though the interface itself is assessed: dark patterns are prohibited, advertising must be identifiable, and profiling of minors for advertising is banned.

Language requirements

Terms, notices and the complaint system in the languages of the member states served, and communication with the Coordinator in an official language of its state.

When it applies

Applicable to all intermediary services since 17 February 2024. Trader verification applies before a trader can use the marketplace, and notices must be acted on promptly, with a two-working-day deadline for authority orders under GPSR.

How long records are kept

Moderation decisions and statements of reasons per the transparency obligations, trader verification records for the duration of the relationship plus six months, and GDPR records for the life of the processing.

What happens if you do not comply

Up to 6% of worldwide annual turnover, imposed by the Digital Services Coordinator, with periodic penalty payments for continuing infringements. Under GPSR, orders to remove listings and fines. The reputational dimension is significant because moderation decisions are published in the Commission's transparency database.

Who enforces it

The Digital Services Coordinator of the member state where the legal representative is established, the Commission for very large platforms, market surveillance authorities under GPSR, and data protection authorities.

Where the boundary lies

Article 13 DSA and Article 27 GDPR are separate appointments and neither covers the other, even where the same provider holds both. A common misunderstanding is that hosting user reviews is not 'a platform': storing information provided by users makes you a hosting service, which is enough to trigger the representative and the notice-and-action duties.

Questions we are asked

We only host customer reviews — does the DSA apply?

Hosting user-generated content makes you a hosting service at minimum, which requires a legal representative, a notice-and-action mechanism and statements of reasons.

Are we responsible for sellers' product compliance?

Not as the manufacturer, but under GPSR Article 22 you must enable and check the responsible person information and act on authority notices within two working days.