Hosting services | Traficom
Transport and Communications Agency

Hosting services

In the Digital Services Act (DSA), certain obligations with which the service providers must comply have been imposed on online hosting services.

What are hosting services?

Hosting services are online services that store the information sent by users upon request. Hosting services include e.g. cloud services, web hosting services, paid referencing services on search engines or other services that enable the sharing of information and content online, including file storage and sharing. 

In the Digital Services Act (DSA), hosting services are seen as one subcategory of intermediary services. Intermediary services also include mere conduit services, such as providing internet connections to end users or caching, such as content delivery networks.

The DSA applies to intermediary services provided within the EU. This means that service providers located outside the EU must also comply with the DSA if they offer their services within the EU.

Obligations that also apply to online platforms in addition to hosting services

In their terms and conditions, providers of intermediary services must include information on any restrictions on the information provided by the recipients of the service. The terms and conditions must be drawn up so that they are clear and easy to understand, and they must also be published in a machine-readable format. Intermediary services must also inform the users of any significant change to the terms and conditions. In addition, special attention must be paid to the realisation of fundamental rights and freedoms in the application and monitoring of the restrictions. If the service is mainly used by minors, the terms and conditions must be such that minors can understand them. 

At least once a year, providers of intermediary services must publish reports on any content moderation that they engaged in during the relevant period. At minimum, the information specified in more detail in Article 15 of the Digital Services Act (DSA) must be mentioned in the report. The reporting obligation does not apply to micro or small enterprises.

The service provider must offer a mechanism that allows anyone to submit a notice concerning illegal content. When the service provider receives a notice, it must:

  • send a confirmation of receipt, if the party that submitted the notice gave their contact information 
  • process the notice and make its decision concerning the suspected illegal content quickly and diligently
  • give a notice of its decision and the related possibilities for redress
  • state if it has used automated means for processing the notices or decision-making.

If the service provider restricts the use of the service because the user has provided illegal content or has failed to comply with the terms and conditions, the service provider must state the reasons for the restriction. The statement of reasons must only be provided if the service provider has the user’s contact information and the matter does not involve spam. The reasons must be stated starting from the day when the restriction is set at the latest and regardless of why or how the restriction has been implemented. An exception to the obligation to provide reasons, however, involves orders given to the service provider by a national judicial or administrative authority to act against the illegal content.

The service provider’s restrictions may include:

  • Removal of content, disabling access, or demoting content
  • Suspension, termination or other restriction of monetary payments 
  • Suspension or termination of the provision of the service in whole or in part 
  • Suspension or termination of the account

The statement of reasons must identify: 

  • what the decision concerns and, if necessary, the territorial scope and duration 
  • the facts and circumstances on which the decision is based 
  • whether automated means have been used 
  • concerning illegal content, a reference to the legal ground relied on and the reason why the information is considered to be illegal content on that ground
  • concerning the incompatibility with the terms and conditions, a reference to the contractual ground and reasons 
  • information on the possibilities of redress, meaning an internal complaint-handling system, out-of-court dispute settlement and judicial redress. 

If the service provider discovers any information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place or will take place, the service provider is obliged to notify the police about the matter.

The service provider must react quickly if it receives an order from a national judicial or administrative authority to take action against illegal content or provide information about certain users of the service. The service provider must inform the authority that issued the order what kind of actions it has taken as a result of the order. It must also be specified to the authority whether and when the order was implemented. 

The service provider must also inform the service user of the order and the actions taken as a result of the order. The notification must be given at the latest when the actions are implemented or according to the time specified by the authority. Users must also be informed about the reasons for the actions, the appeal possibilities and the regional scope of the order.

All service providers must publish information about the contact point, which allows national or EU authorities to communicate directly and electronically with the service provider. In addition to the contact information, it must be stated in which languages the authorities can be contacted. In addition to the national languages, the contact point must work in English or another language commonly spoken in Europe.

Service providers must also publish contact information for the purpose of users of the service contacting them. Users must be offered the opportunity for user-friendly, electronic, direct and fast communication with the service provider. A method that is not fully automated must also be offered for contacting.

The published contact information for contacting the authorities and users must be kept up to date.

Regulation (EU) 2022/2065 of the European Parliament and of the Council on a Single Market For Digital Services and amending Directive 2000/31/EC

(EU) 2022/2065Valid from: 19/10/2022

Page was last updated