Hosting Services under DSA

Legal Framework

Hosting services constitute a distinct category of intermediary services under the DSA, defined in Article 3(g) as services consisting of the storage of information provided by, and at the request of, a recipient of the service. Article 6 establishes the conditional liability exemption: hosting providers are not liable for illegal information stored at the request of a recipient, provided they lack actual knowledge of the illegal activity or information and, upon obtaining such knowledge or awareness, act expeditiously to remove or disable access to that information. This exemption does not apply where the recipient of the service is acting under the authority or control of the provider.

Recital 29 situates hosting within a broad spectrum of intermediary services that continue to evolve, encompassing everything from DNS services to cloud storage. The liability shield in Article 6 is conditioned on compliance with the general obligations in Article 5 (transparency reporting, designated points of contact, and cooperation with authorities) and the hosting-specific obligations in Articles 14 and 15. Article 14 requires providers to implement notice-and-action mechanisms allowing any individual or entity to notify them of the presence of allegedly illegal content. Recital 52 emphasizes that these mechanisms must be harmonized at Union level, ensuring notices are processed timely, diligently, and non-arbitrarily, with robust safeguards for fundamental rights of all affected parties.

Article 15 obliges hosting providers to inform recipients about their content moderation decisions, including the grounds for removal or restriction and available redress mechanisms.

Key Developments

The DSA's hosting framework builds directly on the e-Commerce Directive's safe harbor concept but introduces materially stricter procedural obligations. The European Commission's designation decisions under Article 33 have clarified the boundary between hosting services and online platforms—providers whose services store and disseminate information to the public fall under the heightened Article 14–17 regime, while private hosting (such as enterprise cloud storage) remains subject only to the baseline hosting obligations. The Commission's guidance on VLOP designations has reinforced that the Article 6 safe harbor is not self-executing: providers must affirmatively demonstrate compliance with notice-and-action requirements to benefit from the exemption.

Practical Guidance

• Implement a structured notice-and-action mechanism under Article 14 that acknowledges receipt of notices, provides clear reasons for decisions, and includes appeal procedures—failure to maintain this mechanism jeopardizes the Article 6 liability shield.
• Establish internal content moderation policies with documented thresholds for what constitutes "actual knowledge" or "awareness" of illegal content, as these concepts trigger the expeditious removal obligation under Article 6(1)(b).
• Provide recipients with clear, accessible information about content moderation decisions and available redress pathways as required by Article 15, including notification of removal or access restriction with specific grounds.
• Maintain transparency reports under Article 5(1) detailing content moderation volumes, notice processing times, and outcomes—these serve as evidence of compliance during regulatory audits.
• Assess whether your hosting service qualifies as an online platform under Article 3(h), as this triggers additional obligations including internal complaint-handling (Article 16) and out-of-court dispute settlement participation (Article 17).