DSA Article 16 – Notice and Action: report illegal content 2026

Short answer: Under Article 16 of the Digital Services Act (DSA), a provider of a hosting service, including any relevant online platform, must provide an easily accessible and user-friendly electronic mechanism for notifying specific information that the notifier considers to be illegal content. The mechanism must help the notifier to provide reasons, the exact location of the content, relevant contact details, and a declaration that the notification is submitted in good faith. The platform must process received notifications promptly, diligently, objectively, and in a non-arbitrary manner, and provide an acknowledgment of receipt and decision information under the conditions specified by law.

Legally fact-checked: October 19, 2026. Primary sources: DSA, Regulation (EU) 2022/2065 (specifically Articles 6, 16–17, 19–22, and 24) and the European Commission's explanation of Notice and Action. This article provides general guidance – application must be assessed for the actual service.

Who must have a Notice and Action mechanism?

Article 16 applies to providers of hosting services, i.e., a type of intermediary service where information is stored at the request of a service recipient. Online marketplaces, certain social platforms, and other hosting services may be covered. A regular shop that only publishes its own sales information is not automatically a hosting service for user-generated content. The actual functions of the service determine the assessment.

Important size distinction: The specific exemptions for micro and small enterprises in DSA Article 19 (certain online platform obligations) and Article 29 (certain marketplace obligations) do not generally exempt hosting services from Article 16. It would therefore be incorrect to claim that only larger platforms need a notification mechanism.

If you wish to familiarize yourself with marketplace rules first, see Mallbutiken's overview of DSA requirements for marketplaces and the differences between GPSR and DSA.

Article 16(2) – what information must the notification form enable?

The notification functionality must be easily accessible, user-friendly, and electronic. It should be designed to allow for a sufficiently precise and substantiated notification. Article 16(2) specifies four groups of information:

The DSA does not require a provider to use a specific commercial form, template, or case management system. Exact field names and design can vary, but legal requirements must be met.

Articles 16(3)–(6) – from notification to action

Step 1 – assess the information without prejudice

A notification is an allegation that content is illegal. According to Article 16(3), it is considered to result in actual knowledge or awareness for the purposes of Article 6 only if it enables a diligent hosting service provider to identify the illegality of the specific content without a detailed legal examination. A vague complaint does not in itself mean the provider has established knowledge of illegality.

Step 2 – send an acknowledgment of receipt

According to Article 16(4), the provider shall without undue delay acknowledge receipt if the notification contains the notifier's electronic contact details. Therefore, a case ID, a timestamp, and an understandable confirmation are useful features, even if the law does not prescribe Mallbutiken's specific case fields.

Step 3 – handle promptly, diligently, and objectively

Article 16(6) requires that notifications are processed and decisions taken promptly, diligently, non-arbitrarily, and objectively. There is no universal 24- or 48-hour deadline in Article 16 for all notifications. The required speed depends on, among other things, the type of content, risk, and the applicable regulatory framework.

If automated methods are used in handling or decision-making, information about this must be included in the decision notice according to Article 16(5)–(6). Automated sorting can be a practical support, but it does not replace the obligation to process notifications in the correct manner.

Step 4 – notify the decision and appeal opportunities

Article 16(5) requires that the notifier, subject to the applicable contact conditions, is informed without undue delay of the decision regarding the notified content and of the possibilities for appeal. A decision may involve removing content, restricting access, or taking no action after the assessment. It is not required that every notification automatically results in removal.

Article 17: when does the affected seller or user need a statement of reasons?

See our in-depth look at DSA Article 17 and the requirements for a statement of reasons when a hosting service restricts visibility, services, payments, or account access.

DSA Article 17 is a separate provision that applies to a hosting service provider's decision regarding certain restrictions of content, service, monetization, or account when the reason is illegal content or a breach of terms. The affected service recipient must then receive a clear and specific statement of reasons in accordance with the requirements and limitations of the provision.

This is not the same notice as the acknowledgment to the notifier under Article 16(4). The provider therefore needs to be able to distinguish communication to the notifier from that to the user or trader whose content is affected. Registration in the European Commission's transparency database may also be relevant for relevant online platforms according to Article 24(5); this should not be confused with the general obligations of hosting service providers.

Article 20: must the notifier be able to appeal?

A notifier affected by a decision under Article 20(1) may, where applicable, also choose out-of-court dispute settlement according to DSA Article 21.

For which decisions may be appealed, the six-month deadline, and the requirements for qualified personnel, read the separate guide on DSA Article 20 and internal complaints.

Article 20 requires an effective, free-of-charge, and electronic internal complaint-handling system for online platforms covered by that provision. According to Article 19, there is a specific exception for certain micro and small platform providers; that exception does not automatically affect Article 16's obligation to have a notification mechanism.

The right to internal complaints under Article 20 must be made available for at least six months from a relevant decision, with the specific conditions specified by the article. This is a different six-month rule than the one in DSA Article 32 on consumer information after illegal offers. The latter provision deals in some cases with purchases made within six months prior to the time of knowledge.

Article 21 regulates, under its conditions, out-of-court dispute settlement. Trusted flaggers also have specific priority rules in Article 22 for relevant online platforms; a regular company does not become a trusted flagger merely by submitting a complaint.

Practical example: a suspected illegal product advertisement

A consumer discovers a product advertisement on a marketplace and believes it contains an illegal offer. The consumer uses the platform's notification mechanism, explains why the offer is claimed to be illegal, specifies the exact advertisement URL, and provides relevant contact details and a declaration in good faith.

The platform, when electronic contact details are available, provides an acknowledgment of receipt without undue delay. It then makes a factual assessment of the information and takes a decision on the content. The notifier is informed of the decision and relevant possibilities for appeal. If advertising is restricted, Article 17's requirement for a statement of reasons may also become applicable towards the seller.

If an illegal product has actually been offered and sold, Article 32 on consumer information may become relevant for a covered marketplace. For safety risks, separate product legislation, such as the GPSR, must also be assessed.

Checklist: how to review your Notice and Action process

1. Determine if the service is covered by the DSA's rules for hosting services.
2. Ensure the notification functionality is easily accessible, user-friendly, and can be used entirely electronically.
3. Provide the ability to submit a justification for the alleged illegality and the exact location/URL of the content.
4. Have correct fields for name and email and handle the specific exception in Article 16(2)(c).
5. Include an understandable good-faith declaration.
6. Document the time the notification was received and whether electronic contact details are available.
7. Send an acknowledgment of receipt without undue delay when required.
8. Assess the content promptly, diligently, objectively, and without arbitrariness; distinguish suspicion from established illegality.
9. Notify the notifier of the decision, relevant appeal possibilities, and use of automated methods when required.
10. Consider separately whether Article 17 requires a statement of reasons to the affected service recipient and whether Articles 20–22 are applicable.
11. Follow up on official orders, product safety, GDPR, and any consumer information obligations under other legal acts.

Five common mistakes in DSA processes

Related documentation and product

For online marketplaces, a coordinated process can link notifications, decisions, internal review, and relevant seller data. Therefore, also read DSA Article 30 on seller identification, Article 31 on compliance by design, and Article 32 on information to buyers.

Frequently asked questions about DSA Article 16

Do even small hosting services need a notification form?

DSA Article 16 does not contain a general micro/small enterprise exemption equivalent to those in Articles 19 and 29. First, however, it must be determined whether the service is truly a hosting service according to the DSA.

Must someone always provide a name and email address?

The form should enable this according to Article 16(2)(c), but the provision contains an explicit exception for information considered to involve certain sexual offenses against children according to Directive 2011/93/EU.

Does the DSA have a general 24-hour deadline for notifications?

No. Article 16 requires that notifications be handled and decisions taken promptly, diligently, objectively, and without arbitrariness, and that certain confirmations and decisions be sent without undue delay.

Must everything reported be removed?

No. The report must be assessed on its merits. Article 16(3) contains specific requirements for a notification to be considered to provide actual knowledge or awareness under Article 6 regarding specific illegal content.

Are Notice and Action the same as internal complaints?

No. Article 16 covers notification and initial handling. Article 20 regulates internal complaints against certain decisions for online platforms covered by the provision.

What does a trusted flagger mean?

A trusted flagger under Article 22 has a special status awarded by the competent Digital Services Coordinator. The priority applies within the flagger's area of expertise under the conditions specified by the regulation.

Official legal sources

• DSA – Regulation (EU) 2022/2065, Article 16 (notification, information, knowledge, acknowledgments, and handling).
• DSA Articles 6, 17, 19–22, and 24 (liability exemption, statement of reasons, exceptions, complaints, and trusted flaggers).
• European Commission – Notice and Action (guidance, not separate binding law).
• EU Commission – DSA Transparency Database FAQ.