Does the Digital Services Act apply to an Irish online shop?

A business reads that the Digital Services Act applies to online platforms, notices that it sells online, and concludes that it is in scope. That inference is wrong, and the reason is a definition rather than an exemption.

Article 3(g) of Regulation (EU) 2022/2065 defines intermediary service as one of the following information society services, and then gives three: a mere conduit service, a caching service, and a hosting service, which is the storage of information provided by, and at the request of, a recipient of the service.

The list is closed. A shop that sells its own goods transmits and stores its own information: its own product descriptions, its own photographs, its own prices. Nothing there is information provided by a recipient of the service. It is a content provider, not an intermediary, and the due diligence obligations in Chapter III do not attach to it at all.

The Regulation's scope provision says the same from the other side: it applies to intermediary services offered to recipients of the service that have their place of establishment or are located in the Union.

Which makes the useful question a narrow one: is there anything on your site that stores information other people provided.

The distinction matters because the obligations differ sharply and most write-ups collapse them.

Article 3(i) defines an online platform as a hosting service that, at the request of a recipient, stores and disseminates information to the public, unless that activity is a minor and purely ancillary feature of another service or a minor functionality of the principal service which for objective and technical reasons cannot be used without that other service.

Recital 13 illustrates the proviso with the comments section of an online newspaper, where it is clear the feature is ancillary to the main service. A reviews module attached to a product page is a close analogue: probably a hosting service, probably not an online platform.

That matters because the micro-enterprise exemptions switch off the platform obligations and leave the hosting ones running.

This is the part that gets summarised into something false, so it is worth being exact.

Article 19 provides that Section 3 of Chapter III, with the exception of Article 24(3), does not apply to providers of online platforms that qualify as micro or small enterprises. Section 3 is Articles 19 to 28: internal complaint-handling, out-of-court dispute settlement, trusted flaggers, measures against misuse, most of the platform transparency reporting, dark patterns, advertising transparency, recommender system transparency, and protection of minors.

The carve-back is real and specific. Article 24(3) still applies, which means a micro platform must still be able to tell the Digital Services Coordinator of establishment, on request, its average monthly active recipients in the Union.

Article 29 provides that Section 4 does not apply to providers of online platforms allowing consumers to conclude distance contracts with traders that qualify as micro or small enterprises. Section 4 is Articles 29 to 32: traceability of traders, compliance by design, and the right to information. There is no carve-back here.

Both articles carry a twelve month grace period after losing micro or small status, and both are overridden where the provider is designated a very large online platform.

Two whole tiers stay in force at any size, and this is the half that gets left out of the reassuring summary.

Section 1 of Chapter III applies to all providers of intermediary services. Article 11 requires a single point of contact for authorities, published and kept up to date. Article 12 requires a point of contact for users of the service which is direct, rapid, user-friendly and, in the Regulation's own words, does not solely rely on automated tools. A chatbot alone does not satisfy Article 12. Article 13 requires a legal representative, but only for providers with no establishment in the Union, so an Irish company does not need one. Article 14 requires terms and conditions setting out restrictions on use, including content moderation policies, procedures, algorithmic decision-making and human review, applied diligently, objectively and proportionately.

Article 15 is transparency reporting, and Article 15(2) exempts micro and small enterprises that are not very large online platforms. That is the one exemption in this area everybody gets right.

Section 2 applies to hosting services including online platforms, and it is not exempted for micro or small enterprises at all. Article 16 requires notice and action mechanisms that are easy to access, user-friendly and allow electronic submission. Article 17 requires a statement of reasons to an affected user when you restrict something. Article 18 requires notification to law enforcement where you become aware of information giving rise to a suspicion of a criminal offence involving a threat to the life or safety of a person.

So a five-person Irish shop with customer reviews owes Articles 11, 12, 14, 16, 17 and 18, and owes nothing under Sections 3 and 4.

The Digital Services Act 2024 gives further effect to the Regulation here. Section 8 of that Act inserts a new subsection into section 7 of the Broadcasting Act 2009 designating Coimisiún na Meán, for the purposes of Article 49(1), as the competent authority other than in respect of Articles 30, 31 and 32, and as the Digital Services Coordinator.

Part 3 of the same Act designates the Competition and Consumer Protection Commission as competent authority in respect of Articles 30, 31 and 32, which are the online marketplace provisions.

There is a neat consequence of that split that is worth stating, because it disposes of a worry. Articles 30 to 32 are Section 4, and Section 4 is exactly what Article 29 switches off for a micro or small marketplace. So the CCPC's Digital Services Act remit does not reach a small Irish marketplace at all.

Who regulates what online in Ireland sets out the wider division, because there are more bodies involved than these two.

If the honest conclusion here is that the Digital Services Act is not yours, the next question is which of the online selling rules is.

For most Irish consumer-facing shops the answer is the European Accessibility Act. E-commerce services provided to consumers are named in Regulation 3(2)(g) of S.I. No. 636 of 2023, it has applied since 28 June 2025, and unlike the DSA it does not exempt small businesses from the substance. It exempts microenterprises only, under Regulation 5(4), and only on the service side. Whether it reaches you is two questions long.

The other is the one nobody frames as a rule at all: an online shop with a contact form and an analytics tag is processing personal data, and needs a privacy notice that says what actually happens.