The DSA’s answer to opaque algorithms is not to ban them but to make them observable from three directions: users get plain-language disclosure of how recommendations work, the public gets searchable archives of advertising, and vetted researchers get data access to study what platforms do at scale. For very large platforms, independent audits then verify the story matches reality.
| Regulation | DSA, Articles 27, 34 to 42 |
|---|---|
| Max penalty | 6% of global annual turnover |
| Applies to | All online platforms (Art. 27); VLOPs/VLOSEs for the rest |
| Official text | EUR-Lex CELEX 32022R2065 |
User-facing transparency
Article 27 binds every online platform, not just giants: the terms of service must state the main parameters of recommender systems and their relative importance, in plain and intelligible language, with any modification options directly accessible where recommendations are shown. Article 38 raises the bar for VLOPs: at least one recommender option must not rely on profiling, which is why the designated platforms now offer chronological or non-personalized feeds. Advertising transparency runs in parallel: Article 26 requires each ad to be labeled with advertiser identity and meaningful targeting information in real time.
Public and research-facing transparency
Article 39 turns VLOP advertising into a public record: a searchable repository of every ad shown, who paid for it, its run dates, main targeting parameters, and aggregate reach, retained for a year after last presentation. The Commission’s first formal DSA proceedings, against X, include alleged shortcomings in exactly this repository.
Article 40 is the most novel provision: Digital Services Coordinators can compel VLOPs to give vetted researchers access to platform data for studying systemic risks. The delegated act adopted in 2025 built the machinery: an application portal, vetting criteria (research affiliation, independence from commercial interests, security capability), and data-sharing conditions. It is the first legal regime anywhere granting outside researchers enforceable access to platform internals.
Audits close the loop
VLOPs undergo yearly independent audits (Article 37) covering all DSA obligations, including the transparency set, with platforms required to address findings or explain why not. Combined with the systemic risk assessments of Articles 34 and 35, the design is a verification chain: disclose, be measured, be audited, correct.
For compliance teams below VLOP scale, the actionable slice is Article 27: write an honest recommender disclosure and surface user options. Note the GDPR layer stays live: profiling-driven recommendations need a lawful basis and, where they produce significant effects, engage Article 22. The broader obligations stack is mapped in our DSA platform compliance guide.