The DSA in 2026: What Happens When Your Platform Has a Hate Speech Problem?

An online forum in Ireland gets a notification. A user in Germany has flagged a comment thread for virulent anti-immigrant rhetoric, citing German law. Under the Digital Services Act, the platform’s content moderation team is now on the clock, facing a complex decision with serious legal consequences.

The EU Digital Services Act (DSA) compels online platforms to create clear procedures for removing content deemed illegal under EU or member state law, which includes certain types of hate speech. By 2026, all platforms must operate robust "notice-and-action" systems. But for Very Large Online Platforms (VLOPs), the stakes are far higher, with stricter risk-assessment duties and potential fines of up to 6% of their global turnover for getting it wrong.

Illegal Content - Under the Digital Services Act, this is any information that, in itself or in relation to an activity, does not comply with Union law or the law of any Member State which is in compliance with Union law, irrespective of the precise subject matter or nature of that law.

Very Large Online Platform (VLOP) - An online platform which provides its services to a number of average monthly active recipients of the service in the EU equal to or higher than 45 million. These entities are subject to the most stringent obligations under the DSA due to their systemic societal impact.

What Does the Digital Services Act Actually Say About Hate Speech?

The Digital Services Act, Regulation (EU) 2022/2065, does something many don't expect. It doesn't create a new, universal definition of "hate speech." Instead, it builds a harmonised rulebook for how online platforms must handle content that is already illegal under other laws, whether at the EU or national level. The focus is procedural justice and platform accountability, not defining what you can and cannot say.

This approach creates a complex landscape. While public incitement to hatred is illegal across the EU, the specific thresholds can differ wildly between member states. Content that is clearly illegal in Germany under its robust hate speech laws might be considered lawful—though offensive—in another member state. For platforms, this means they must build a single, sophisticated system that can assess user reports based on the specific national law being cited. It’s a legal minefield.

What is the EU Digital Services Act in simple terms?

Think of the DSA as a set of EU-wide rules creating a safer, more transparent internet. It forces online intermediary services—from social media giants to small cloud hosting providers—to take more responsibility for illegal content. They must be transparent about their algorithms and content moderation, and they must give users real mechanisms to protect their fundamental rights.

What is considered hate speech in the EU?

No single EU criminal law defines all forms of hate speech. An EU Framework Decision does require every member state to criminalise the public incitement to violence or hatred against groups defined by race, colour, religion, descent, or national or ethnic origin. Still, the exact legal statutes, what they mean in practice, and the penalties are all decided by each country's national laws. This creates significant variation across the Union.

Do All Platforms Have the Same Hate Speech Obligations?

No. The DSA uses a tiered system of obligations based on a platform's size, type, and impact. While every hosting service has baseline duties, the heaviest responsibilities fall on the biggest players.

All online hosting services, including most social media and content-sharing sites, must implement a user-friendly notice-and-action mechanism. This system allows anyone to report content they believe is illegal. The platform must then process the notice and decide "without undue delay." Critically, it must also provide a clear reason for its action (or inaction) to the person who reported it.

The heaviest burden falls on VLOPs (Very Large Online Platforms) and VLOSEs (Very Large Online Search Engines). These are the giants with over 45 million monthly active users in the EU. They face a much higher level of regulatory scrutiny directly from the European Commission.

Why Are Very Large Online Platforms (VLOPs) Under Special Scrutiny?

The DSA operates on a simple principle: platforms with the largest reach pose the greatest systemic risks to society. This includes the potential for viral dissemination of illegal hate speech and disinformation, which can threaten public safety, democratic processes, and fundamental rights.

Under Articles 34 and 35 of Regulation (EU) 2022/2065, VLOPs must conduct annual risk-assessment reports. These aren't just checkbox exercises. The reports must deeply analyze how a platform's design, algorithms, and moderation practices could contribute to spreading illegal content. They also have to assess negative effects on fundamental rights like freedom of expression (under Article 10 of the ECHR) and human dignity.

After this assessment, VLOPs must implement reasonable and effective risk-mitigation measures. This is about more than just deleting posts. Mitigation might mean:

• Tweaking recommender systems to stop amplifying problematic content.
• Dedicating more resources and better training to human content moderators.
• Prioritizing reports that come from vetted "trusted flaggers."
• Improving transparency reports to show exactly what moderation actions were taken and why.

To ensure consistency, the European Board for Digital Services, made up of representatives from each member state, helps the Commission oversee these obligations.

Is There a "24-Hour Rule" for Removing Hate Speech?

This is a critical point. The Digital Services Act itself does not mandate a hard "24-hour" deadline for removing illegal content. The official legal standard is to act "expeditiously" or "without undue delay" after receiving a valid notice.

So where does the 24-hour figure come from? It has become a de facto industry standard and a key performance indicator, originating from the Code of conduct on countering illegal hate speech online+, a voluntary commitment from 2016. On 20 January 2025, this Code was officially recognized under the DSA as a tool to help platforms meet their risk-mitigation duties.

While it's not a strict legal deadline in the regulation itself, a VLOP's consistent failure to meet the Code's 24-hour review target would be damning evidence of an ineffective risk-mitigation system. During an investigation, the European Commission would almost certainly view such a failure as a serious compliance gap.

What Are the Consequences for Platforms That Fail by 2026?

By 2026, the DSA’s enforcement framework will be fully operational across the EU. Regulators will have little patience for failure, as platforms will have had years to adapt. The era of self-regulation is over.

For most platforms, enforcement comes from national authorities called Digital Services Coordinators (DSCs). But the European Commission holds exclusive power to supervise and sanction designated VLOPs and VLOSEs.

The financial penalties are severe, designed to make an impact even on the world's wealthiest tech companies.

• Fines for non-compliance: These can reach up to 6% of a company's total worldwide annual turnover from the previous financial year. Missing a deadline to provide information could result in an immediate penalty, even before the core issue is resolved.
• Fines for providing incorrect, incomplete, or misleading information during an investigation can be up to 1% of annual turnover.
• Periodic penalty payments of up to 5% of average daily turnover can be imposed to force a company into compliance.
• In extreme cases of repeated, serious violations, the Commission can ask a national court to temporarily suspend the service in the EU as a last resort.

This article is published by an independent law firm for informational purposes only and does not represent or claim affiliation with any government body, international organization, or official authority.

Frequently Asked Questions

How does the DSA protect freedom of speech?

The DSA builds in several key safeguards. Platforms must give users a clear statement of reasons whenever their content is removed or their account restricted. Users have a right to appeal these decisions through an internal complaint system. If that fails, they can turn to a certified out-of-court dispute settlement body. This framework tries to balance the fight against `illegal content` with protection from arbitrary censorship, a core concern under Article 10 of the ECHR as interpreted by the European Court of Human Rights.

`Illegal content` is the broad DSA term for any information that violates Union or Member State law. `Hate speech` is a specific *type* of illegal content, but only when a law has explicitly criminalised it (like public incitement to violence). A lot of offensive, controversial, or hurtful speech does not meet the legal definition of illegal `hate speech`.

It's a mandatory system for all `hosting services` that lets users report content they think is illegal. Once a notice is received, the platform must review it "expeditiously." If the content is confirmed as illegal, the platform has to remove or disable access to it and tell the reporting user what it did. This formalizes a process that used to be wildly inconsistent and makes platforms more accountable.