Document type: Checklist Practice area: Technology — Platform Regulation Jurisdiction: European Union, with United States comparison Last reviewed: 5 September 2026

Part 1 — Scope and tier (do this first; everything depends on it)

  • Do we offer any service to recipients located in the European Union? Scope follows the offering, not establishment — no European entity, staff, or revenue is required.
  • Are we an intermediary service (mere conduit, caching, or hosting)?
  • Are we a hosting service — do we store information provided by a user? (Comments, reviews, uploads, profile bios, support forums all count. This catches companies that do not consider themselves platforms.)
  • Are we an online platform — do we store and disseminate information to the public at a user's request?
  • Are we a marketplace — do consumers conclude distance contracts with traders on our service?
  • Are we a small or micro enterprise? If so, the online platform obligations do not apply. Diarize a recheck — companies that grow past the threshold and never look again are the ones caught.
  • Are we at or near 45 million average monthly active recipients in the Union (very large online platform territory)?
  • Scoping memo written — services, tier conclusion for each, reasoning, resulting obligations.
  • Internal debate about whether the rules apply closed by the memo.

Part 2 — Structure: representative and contacts

  • Legal representative appointed in a member state (required where we have no Union establishment).
  • Member state chosen deliberately — it determines our supervising Digital Services Coordinator. Advice taken on coordinator resourcing and activity.
  • Representative diligenced: able to actually perform the function, not a mail drop.
  • Point of contact for authorities designated and published.
  • Point of contact for recipients designated and published, allowing rapid electronic communication and not relying solely on automated tools.
  • Both routed to a monitored queue, not an individual.
  • Languages of communication stated, including a language broadly understood in the Union and the official language of our coordinator's member state.
  • Contacts published in the terms, on the site, and in the help center.

Part 3 — Terms and conditions

  • Rewritten (not amended) in clear, plain, intelligible, user-friendly, unambiguous language.
  • States any restrictions imposed on use of the service in respect of user information.
  • Describes policies, procedures, measures, and tools used for content moderation, including algorithmic decision-making and human review.
  • Sets out the rules of procedure of the internal complaint-handling system.
  • States the misuse suspension policy, with examples.
  • States recommender system main parameters and any options to modify them.
  • Commitment to act diligently, objectively, and proportionately, with due regard to fundamental rights.
  • Process for informing users of significant changes.
  • Where the service is directed at or predominantly used by minors: explained in terms minors can understand.
  • Practices surfaced by the rewrite that we would rather change than publish have been changed or documented.

Part 4 — Notice and action mechanism

  • Mechanism is easy to access and user-friendly, allowing submission by electronic means.
  • Form captures a valid notice: substantiated explanation of alleged illegality; exact electronic location (URL); notifier name and email (except for certain offences); good-faith statement.
  • Understood: a sufficiently precise and adequately substantiated notice confers actual knowledge and starts the liability clock. Form designed deliberately with that in mind.
  • Receipt acknowledged to the notifier without undue delay.
  • Workflow built: triage → assess → decide → act → statement of reasons → notify notifier of decision and redress options → log.
  • Notifier told whether automated means were used.
  • Understood: no general monitoring obligation may be imposed, and we are not required to proactively seek out illegal content.

Part 5 — Statements of reasons

Required for every restriction on illegality or terms grounds: removal, disabling, demotion or visibility restriction, demonetization, service suspension or termination, account suspension or termination.

Each must contain:

  • The type of restriction and, where relevant, its territorial scope and duration.
  • The facts and circumstances relied on, including whether it followed a notice or an own-initiative investigation, and where strictly necessary the notifier's identity.
  • Whether automated means were used, including in detection or identification.
  • Where illegality: the legal ground and why the content is illegal on that ground.
  • Where terms: the contractual ground and why the content is incompatible with it.
  • Clear, user-friendly redress information — internal complaints, out-of-court settlement, judicial.

And:

  • Submitted to the Commission's public transparency database (online platforms), without personal data.
  • Submission is automatic, at the moment of the enforcement action — not a monthly batch.
  • Generated from the case record, not typed into a template afterwards.
  • Understood: our moderation decisions become publicly analyzable at scale.
  • Narrow exception noted: does not apply to deceptive high-volume commercial content.

Part 6 — Internal complaints and out-of-court settlement

  • Internal complaint system free of charge, electronic, available at least six months after a decision.
  • Covers: removal/disabling/visibility restriction; service suspension or termination; account suspension or termination; monetization restriction; and decisions not to act on a notice.
  • Decisions timely, non-discriminatory, diligent, and non-arbitrary.
  • Handled under the supervision of appropriately qualified staff and not solely by automated means.
  • Reviewers are not the people who made the original decision.
  • Decision reversed where the complaint has sufficient grounds; complainant informed of the decision and of out-of-court and judicial redress.
  • Complaint entry point built into the statement of reasons as a link.
  • Out-of-court dispute settlement: we engage in good faith with any certified body a user selects.
  • Cost rule understood: if the body decides for the user, we bear their fees and reasonable expenses; if for us, the user bears ours only if they acted in bad faith.
  • Budget contingency set for dispute settlement — a few disputes consume disproportionate time.
  • Reversal rate tracked by policy and by reviewer.

Part 7 — Marketplace obligations

  • Trader information obtained before allowing trading: name, address, phone, email; identification document or electronic identification; payment account details; trade register and registration number where applicable; self-certification to offer only compliant products and services.
  • Best efforts to assess reliability using free official databases, interfaces, or supporting documents.
  • Where information appears inaccurate or incomplete: correction requested and trader suspended until provided.
  • Information stored securely for the relationship plus six months.
  • Existing seller base re-verified, staged by tier and volume, with a communicated deadline and expected attrition.
  • Interface designed so traders can comply with pre-contractual information, compliance, and product safety obligations — trader details, product identifier, required markings.
  • Process to inform consumers who acquired an illegal product, or to publish the information where contact details are unavailable.
  • Consumer law counsel involved in interface design (the underlying obligations are consumer law, not platform law).

Part 8 — Advertising, recommenders, and interface

  • Each ad identifiable in real time as an advertisement, with prominent markings.
  • On whose behalf presented, and who paid if different.
  • Meaningful information about the main targeting parameters, and how to change them where applicable.
  • No advertising based on profiling using special categories of personal data.
  • No advertising based on profiling where we are aware with reasonable certainty the recipient is a minor.
  • Recommender system main parameters and modification options set out in the terms, with a functionality directly accessible from the prioritized section.
  • Dark patterns review completed — no design that deceives, manipulates, or materially distorts free and informed decisions. (Look for pre-checked boxes, resetting countdowns, asymmetric consent flows, confirmshaming.)
  • Appropriate and proportionate minor protection measures where the service is accessible to minors.

Part 9 — Misuse, orders, and trusted flaggers

  • Misuse suspension, after prior warning, for users frequently providing manifestly illegal content, and for notifiers/complainants frequently submitting manifestly unfounded submissions.
  • Assessment is case-by-case, timely, diligent, objective — considering numbers, proportion, gravity, and intention.
  • Policy stated in the terms with examples.
  • Trusted flagger notices identified on intake and given priority, processed and decided without undue delay.
  • Trusted flagger list maintained.
  • Route exists to report a trusted flagger submitting significant numbers of inadequate notices.
  • Channel built for authority orders — not a general email address.
  • Orders to act against illegal content: issuing authority informed of the effect given and when; recipient concerned also informed.
  • Orders to provide information: same confirmation obligation.
  • Orders checked for prescribed elements — statement of reasons, exact electronic location, redress information, territorial scope. Deficient orders questioned rather than silently obeyed.
  • Territorial scope limited to what is strictly necessary — the answer to an order purporting to require global removal.

Part 10 — Records and the annual transparency report

  • Records kept: moderation decisions, notices, statements of reasons, complaints and outcomes, authority orders and responses, trader verification.
  • Annual report covers: authority orders by type and member state with median acknowledgment and action times; notices by type, action taken, legal or terms basis, trusted flagger volume, median processing time; own-initiative moderation including automated tools and numbers affected; complaints, basis, decisions, median time, reversals; use of automated means with accuracy indicators and safeguards; out-of-court disputes and outcomes.
  • Published in a machine-readable format, easily accessible.
  • First report accurate and unremarkable.

Part 11 — Harmonize or geo-differentiate

  • Decision made deliberately, not left to engineering.
  • If harmonizing globally, understood what is given up: the latitude 47 U.S.C. § 230 provides for moderation decisions, and the editorial-discretion protection the Supreme Court described in Moody v. NetChoice, LLC, 603 U.S. 707 (2024).
  • If geo-differentiating, the complexity tax accepted: two policies, two workflows, two metric sets, a routing decision on every case.
  • Middle path considered: harmonize reasons and appeals globally; scope reporting and formalities to the Union.

Part 12 — DMA: exercise your rights as a business user

  • Gatekeeper relationships inventoried: app stores, marketplaces, search, advertising, operating systems, browsers, cloud, communications.
  • Data access claimed — continuous, real-time access to data generated by our activity and by end users engaging with our offerings.
  • Steering freedom claimed — communicate and promote offers to users acquired through the platform, and contract with them off-platform.
  • Pricing freedom claimed — different prices and conditions through other channels.
  • No forced ancillary services — identification, browser engine, payment.
  • Advertising transparency claimed — daily per-ad prices, fees, remuneration, and metrics.
  • FRAND access conditions for app stores, search, and social networking.
  • Confirmed the gatekeeper is not using our non-public data to compete with us.
  • Complaint routes identified: gatekeeper compliance functions, the Commission, national authorities.
  • Owner assigned — a commercial owner, not compliance.

Part 13 — Or leave the market, properly

  • Arithmetic run: European users and revenue, actual and forecast; build cost; annual operating cost dominated by moderation staffing and the statement-of-reasons pipeline.
  • If geo-blocking: actual technical measures, not a banner.
  • Terms prohibit use from the Union.
  • No European-language marketing, no euro pricing, no European payment methods, no European domain — the test is whether the service is offered to Union recipients.
  • Decision revisited annually; year-two costs are materially lower than year one.

Part 14 — Governance and annual recheck

  • Named owner with authority to change the product.
  • Moderation staffed to the service levels published.
  • Metrics instrumented: notices, handling times, statements generated and submitted, complaints and reversal rate by policy and reviewer, trusted flagger volume, order response times, disputes, trader verification status.
  • Quarterly review: metrics, policy changes, product changes affecting scope, regulatory developments, authority contact.
  • Annual scope recheck: crossed the small enterprise threshold? added a messaging, feed, or marketplace feature that changes our tier?
  • Adjacent regimes coordinated in one roadmap: data protection, consumer law, product safety, copyright, accessibility, AI.
  • Tabletop exercise run: a simulated coordinator information request, answered from documents in 48 hours.

Related documents

This checklist is general information, not legal advice, and does not create an attorney-client relationship.