Does the Digital Services Act apply to an Irish online shop?

Selling online does not by itself bring a shop into the Digital Services Act. The reason is not an exemption. It is the definition of an intermediary service.

Article 3(g) of Regulation (EU) 2022/2065 defines intermediary service as one of the following information society services, and then gives three: a mere conduit service, a caching service, and a hosting service, which is the storage of information provided by, and at the request of, a recipient of the service.

The list is closed. A shop that sells its own goods transmits and stores its own information: its own product descriptions, its own photographs, its own prices. Nothing there is information provided by a recipient of the service. It is a content provider, not an intermediary, and the due diligence obligations in Chapter III do not apply to it at all.

The Regulation's scope provision says the same from the other side: it applies to intermediary services offered to recipients of the service that have their place of establishment or are located in the Union.

The question to ask is a narrow one: does your site store anything that other people provided?

The distinction matters because the obligations differ sharply.

Article 3(i) defines an online platform as a hosting service that, at the request of a recipient, stores and disseminates information to the public, unless that activity is a minor and purely ancillary feature of another service or a minor functionality of the principal service, and, for objective and technical reasons, cannot be used without that other service, and is not integrated as a way of avoiding the Regulation.

Recital 13 illustrates that exception with the comments section of an online newspaper, where it is clear the comments are a side feature of the main service. A reviews section on a product page is a close match. It is probably a hosting service, and probably not an online platform.

That matters because the micro-enterprise exemptions switch off the platform obligations and leave the hosting ones running.

Article 19 provides that Section 3 of Chapter III, with the exception of Article 24(3), does not apply to providers of online platforms that qualify as micro or small enterprises. Section 3 is Articles 19 to 28: internal complaint-handling, out-of-court dispute settlement, trusted flaggers, measures against misuse, most of the platform transparency reporting, dark patterns, advertising transparency, recommender system transparency, and protection of minors.

One provision in Section 3 still applies. Under Article 24(3), a micro platform must still be able to tell the Digital Services Coordinator of establishment, on request, its average monthly active recipients in the Union.

Article 29 provides that Section 4 does not apply to providers of online platforms allowing consumers to conclude distance contracts with traders that qualify as micro or small enterprises. Section 4 is Articles 29 to 32: traceability of traders, compliance by design, and the right to information. There is no exception here.

Both exemptions continue for twelve months after a provider stops being micro or small. Neither applies to a provider designated as a very large online platform.

Two tiers stay in force at any size, with a single exception in the first.

Section 1 of Chapter III applies to all providers of intermediary services. Article 11 requires a single point of contact for authorities, published and kept up to date. Article 12 requires a point of contact for users of the service which is direct, rapid, user-friendly and, in the Regulation's own words, does not solely rely on automated tools. A chatbot alone does not satisfy Article 12. Article 13 requires a legal representative, but only for providers with no establishment in the Union, so an Irish company does not need one. Article 14 requires terms and conditions setting out restrictions on use, including content moderation policies, procedures, algorithmic decision-making and human review, applied diligently, objectively and proportionately.

Article 15 is transparency reporting, and Article 15(2) exempts micro and small enterprises that are not very large online platforms.

Section 2 applies to hosting services including online platforms, and it is not exempted for micro or small enterprises at all. Article 16 requires a way for people to report content they consider illegal (notice and action), which must be easy to access, user-friendly and allow electronic submission. Article 17 requires a statement of reasons to an affected user when you remove, hide or demote something they posted because it is illegal or breaks your terms, if you have their contact details. Article 18 requires notification to law enforcement where you become aware of information giving rise to a suspicion of a criminal offence involving a threat to the life or safety of a person.

A five-person Irish shop with customer reviews owes Articles 11, 12, 14, 16, 17 and 18, must answer authority orders under Articles 9 and 10, and owes nothing under Sections 3 and 4 (Article 24(3) aside, if the reviews make it an online platform).

The Digital Services Act 2024 gives further effect to the Regulation here. Section 8 of that Act names Coimisiún na Meán as the Digital Services Coordinator, and as the competent authority under Article 49(1) for everything except Articles 30, 31 and 32. It does this by inserting a new subsection into section 7 of the Broadcasting Act 2009.

Part 3 of the same Act makes the Competition and Consumer Protection Commission (CCPC) the competent authority for Articles 30, 31 and 32, which are the online marketplace provisions.

One consequence of that split: Articles 30 to 32 are Section 4, and Section 4 is exactly what Article 29 switches off for a micro or small marketplace. The CCPC's Digital Services Act remit does not reach a small Irish marketplace for enforcement. Micro and small providers are also exempt from the CCPC's marketplace levy under section 45A, though the CCPC can ask for the records that show the exemption applies.

Who regulates what online in Ireland sets out the wider division, because there are more bodies involved than these two.

If the Digital Services Act does not apply to you, the next question is which of the online selling rules does.

For an Irish consumer-facing shop above the microenterprise line, the answer is the European Accessibility Act. E-commerce services provided to consumers are named in Regulation 3(2)(g) of S.I. No. 636 of 2023. It has applied since 28 June 2025, and it does not exempt small businesses from the requirements themselves. It exempts microenterprises only, under Regulation 5(4), and only on the service side. Whether it reaches you is two questions long.

The other is data protection: an online shop with a contact form and an analytics tag is processing personal data, and needs a privacy notice that says what happens.