Does the EU's Digital Services Act apply to your game? A practical guide for studios

• The EU's Digital Services Act can apply to games featuring chat, mods, player-created content and other community features.
• A game's features and how players access user-generated content help determine which DSA aspects apply.
• Smaller studios may be exempt from some additional requirements, but company size and ownership structures matter.

Alexandra Kurdyumova is co-founder and CEO of Futura. Anton Karpenko is a project lead at Futura.

The Digital Services Act is now producing decisions, but most of the attention has been on platforms far larger than a typical game studio.

For a studio with a chat, player-made content or other community features, the more useful question is simpler: which parts of the DSA actually apply to your game, and which don’t?

Why the rules reach games at all

The DSA (Regulation (EU) 2022/2065) has applied since 17 February 2024. It covers intermediary services, including hosting services that store information provided by users. That can include some very familiar game features: in-game chat, forums, player-created content and other community spaces.

This is where games come in. In-game text and voice chat, clan pages, forums, custom maps, mods and player-made skins can all involve information stored at a player's request. So can the smallest pieces of player input: a username or an avatar the player uploads or creates, that other players see. A studio that is confident it hosts no user content often still hosts those.

If your studio runs any of these features, it may be providing a hosting service under the DSA. However, whether a particular game feature qualifies as a hosting service depends on its technical implementation and the nature of the service provided. The mere processing of player data does not necessarily mean that the game as a whole constitutes a hosting service under the DSA.

The DSA applies to services offered to users located in the EU irrespective of where the provider is established, so no EU entity is required. What is required is a substantial connection, such as a significant number of users in a Member State relative to its population, or activity targeted at one.

One rough rule holds before any of the details: the more one player can show to other players, the wider the obligations run. The rest comes down to where that line sits.

Hosting service, or online platform?

An online platform is a hosting service that makes user content available to the public. In practice, the key question is how players can access it. If anyone can join a group automatically, its content can count as public.

If a person has to approve each new member, it can be considered a limited access group that falls outside the concept of dissemination to the public.

That sorts as follows:

• Private messages between two players: not dissemination to the public.

• A clan or guild that anyone can join on an automatic acceptance: dissemination to the public. Vetted membership, approved by a person, is not.

• Open lobby feeds, forums, player reviews and libraries of player-made maps or mods: dissemination to the public.

There is one important exception. A hosting service is not treated as an online platform if making user content available to the public is only a minor, secondary feature of the main service, and the service cannot be used without that main service for technical reasons. This exception applies only if all of these conditions are met, and it cannot be used simply to get around the DSA. 

A fully offline single-player game is outside the DSA. Cloud saves or player-made levels stored on your servers can make it a hosting service.

Public leaderboards or shared creations raise the online-platform question again. A leaderboard may still fall within the exception above, because it is a minor feature that cannot work without the game itself.

When platforms can be liable for user content

Europe does not have an equivalent of Section 230 of the US Communications Decency Act that broadly shields platforms from liability for user-generated content. Under Article 6, the protection for hosting providers depends largely on what they know about illegal content and how they respond once they become aware of it.

Losing the exemption does not by itself make a provider liable: liability still has to come from national or other EU law.

In practice, this usually starts with a report. A sufficiently detailed report can put the platform on notice that specific content may be illegal, as long as the violation can be identified without requiring a full legal analysis.

The same applies when a national authority identifies the content and explains why it is unlawful. From that point, what matters is how quickly and appropriately the platform responds.

This does not mean platforms are expected to monitor everything players post or proactively search for illegal content. The rules do not impose a general monitoring obligation. And carrying out your own checks in good faith and with diligence does not by itself cost you the exemption.

What game companies should have ready

For a game that falls under the hosting-provider rules, the basic setup is fairly practical:

• A contact point for authorities, plus a separate way for players to reach you that is not fully automated.

• An EU-based legal representative if the company has no establishment in the EU.

• Clear terms explaining what player content is allowed, how moderation works, and when content or accounts may be restricted.

• Unless you are a micro or small enterprise, an annual report on your content moderation. (Article 15). 

• An easy-to-find, electronic reporting channel for illegal content, with confirmation that a report was received and information about what happened next.

• An explanation to the player whenever content or an account is restricted because it is illegal or violates the terms.

• An established procedure to report suspected criminal offences that could threaten someone's life or safety to the relevant authorities.

If the game also qualifies as an online platform, there is another layer of requirements. These include an internal complaints process that remains available for at least six months, access to certified out-of-court dispute resolution, priority handling of reports from trusted flaggers, and measures against repeat offenders.

The platform must also avoid deceptive interface design, provide transparency around advertising and recommender systems, publish its average monthly EU user numbers twice a year, and put safeguards in place for minors.

None of this necessarily means building an entirely new moderation operation. For many teams, the rules formalise processes they already have: setting clear moderation rules, defining how reports are handled, and keeping enough records to explain how a decision was made.

Strip the list back, and two things remain: moderating what players post, and dealing properly with what they report. Clear rules on what is allowed, a reporting channel that responds without undue delay, and an explanation when something is removed. Platforms add a route for the player to challenge that explanation. Everything above is a version of these.

How much of this actually applies to you?

Not every game company has to comply with every part of the DSA. The rules depend on the size of the company and, importantly, on the size and nature of the service.

For micro and small enterprises, most of the DSA's additional obligations for online platforms do not apply, although they must still comply with the general requirements applicable to intermediary services and hosting providers. There is one notable exception: they may still have to provide user numbers when requested. The threshold is narrower than it sounds. Small means fewer than 50 staff and turnover or a balance sheet total of no more than €10 million.

The calculation can also include figures from partner or linked companies, so a 30-person studio backed by a larger publisher may not qualify as a small enterprise after all. The same exemption extends to some transparency reporting requirements and the Commission's July 2025 guidelines on protecting minors.

The very large platform regime is further off: it attaches at 45 million average monthly EU users, and only on Commission designation. Recent examples show that these rules are not just theoretical. X was fined €120 million in December 2025 over the design of its verification badge, its advertising repository and the access it gave researchers to its data. Temu was fined €200 million in May 2026 for an inadequate assessment of the systemic risks its marketplace creates.

Most of those findings concern obligations applicable specifically to very large online platforms. However, the DSA also imposes requirements on smaller services, depending on their nature and the size of the provider.

Regulators may therefore scrutinise not only how a service operates, but also how it handles user reports, moderates content and documents its decisions. Size changes the length of the list. It does not change what an inspection looks like: the regulator reads the interface and the decision trail, alongside the content itself.

For games, Roblox is the clearest example to watch. It is a game, but its scale and social features also bring it into the DSA's platform regime.

In January 2026, the Dutch Authority for Consumers and Markets opened an investigation into its protection of minors, including violent and explicit content, contact with potentially harmful users and design features that may encourage purchases. The investigation is ongoing.

On 31 August 2026, the Commission designated Roblox a very large online platform on 46.6 million average monthly EU users; the additional obligations apply four months after notification (by January 2027). That timeline applies to Roblox specifically; it does not mean that other game platforms automatically have the same deadline.

If a regulator comes knocking

A player can complain to the Digital Services Coordinator in the Member State where they are located. The coordinator can then refer the matter to the coordinator where the provider has its main establishment. From there, authorities can ask providers for information without undue delay, or order them to act on specific illegal content or provide information about a particular account. 

In most cases, supervision sits with the Member State where the provider is established. For very large online platforms, the European Commission takes responsibility for the obligations specific to that tier, while national authorities continue to share supervision over the rest.

A provider with no EU establishment and no legal representative can be pursued by any Member State. Penalties are set by individual Member States and can reach up to 6% of a provider's annual worldwide turnover. The same ceiling applies to fines imposed by the Commission on very large online platforms.

But the first step is usually a request for information or an order to act, not a fine. And by that point, the most useful thing a game company can have is a clear paper trail: what its moderation rules are, how players can report problems, who handles those reports, and why a particular decision was made.

The practical takeaway is simple: you do not need to predict every problem. You do need to be able to show how you handle one when it arrives.