A merchant running a PrestaShop-based multi-vendor marketplace for handmade goods emailed me in a mild panic after reading a headline about the Digital Services Act "targeting Big Tech with billion-euro fines." She'd assumed a regulation aimed at Meta and Amazon had nothing to do with her thirty-vendor craft site. It does — just not in the way the headlines suggest, and definitely not at the same intensity.
The DSA is one of the most misunderstood pieces of EU digital regulation among smaller merchants, mostly because press coverage focuses almost entirely on the obligations that apply to Very Large Online Platforms — the Amazons and Metas of the world with 45 million-plus EU users. Most PrestaShop stores will never come close to that tier. But the DSA has a tiered structure, and depending on what kind of store you run, you likely owe something under it.
The tiers that actually matter for merchants
Regulation (EU) 2022/2065, the Digital Services Act, applies obligations in layers, with each layer inheriting the duties of the one below it.
| Your store type | DSA tier | What it actually means for you |
|---|---|---|
| Single-brand store selling only your own products | Hosting service (baseline) | Minimal direct duties — mainly around illegal-content notice handling if you host user content like reviews |
| Store with a review/UGC section, forum, or comments | Hosting service, content-moderation duties apply | Need a notice-and-action mechanism for illegal content (not just any complaint — specifically illegal content) |
| Multi-vendor marketplace connecting third-party sellers with consumers | Online marketplace | Full "know your business customer" and marketplace-specific duties apply |
| 45M+ monthly EU users | Very Large Online Platform | Heaviest tier — systemic risk assessments, independent audits, this is not where PrestaShop merchants live |
If you run a standard single-vendor PrestaShop store with product reviews enabled, you're in the "hosting service with light content duties" bucket. If you run a marketplace model — vendors listing their own products, you taking a commission — you're an online marketplace under DSA, and that's a meaningfully bigger set of obligations.
If you run (or are considering) a marketplace model
Marketplace-specific duties under the DSA include:
- Trader traceability ("know your business customer"). Before letting a third-party seller list products, you must collect and verify: their name, address, contact details, a copy of ID or equivalent registration document, and their bank/payment account details. You can't let a trader onboard anonymously.
- Marketplace transparency. Traders must be clearly identifiable to consumers as commercial sellers (not disguised as private individuals), and your platform needs to make it easy for a buyer to see who they're actually buying from.
- Compliance-by-design efforts. You're expected to make a reasonable effort to check the information traders provide is reliable, though the DSA doesn't require you to independently verify every claim — spot-checking against official registries is the common practical approach.
- Notice-and-action for illegal products or content. Anyone must be able to flag an illegal product listing (counterfeit goods, unsafe products, prohibited items) through an easy, accessible mechanism, and you need a process to act on those notices promptly and explain your decision.
Notice-and-action: what it looks like day to day
Even for a single-vendor store with just a reviews feature, the DSA's notice-and-action requirement applies to illegal content specifically — not every complaint. A one-star review calling your product "overpriced" isn't illegal content and doesn't trigger DSA notice-and-action; a review containing defamatory claims, hate speech, or promoting counterfeit alternatives might. The mechanism needs to be:
- Easy to find and use — not buried three clicks deep in a contact form
- Able to identify what content is being flagged and why (which specific law is allegedly being violated)
- Followed by a decision communicated back to whoever submitted it and to the content's author
For most PrestaShop stores this can be a straightforward "report this review/listing" flow feeding into a documented review process, not a full moderation team. The obligation scales with your risk profile — a small store with occasional reviews needs a lightweight process; a busy marketplace needs a more structured one.
What the DSA explicitly bans
Regardless of tier, a few practices are flatly prohibited for anyone operating an online platform in scope:
- Dark patterns — interface designs that deceive or manipulate users into decisions they wouldn't otherwise make (pre-ticked consent boxes, artificially urgent countdown timers with no real basis, confusing cancel-subscription flows designed to be harder than sign-up)
- Advertising based on profiling using special category data — sensitive data like health, religion, sexual orientation, or political opinion can't be used to target ads
- Advertising targeting minors based on profiling, where the platform is aware the user is a minor
The dark-patterns ban is worth pausing on because it's the one most likely to catch an otherwise-compliant store off guard — checkout flows with pre-selected upsells framed as "recommended," countdown timers on discounts that reset every visit, or subscription cancellation buried three settings-menus deep are all now squarely in scope, and the standard here isn't intent — it's effect on the average consumer's decision-making.
DSA compliance checklist for PrestaShop merchants
- [ ] Identify your tier: single-vendor with no UGC, single-vendor with reviews/UGC, or marketplace — this determines everything else
- [ ] If you allow reviews or comments, add a clear "report this content" mechanism tied to illegal-content grounds, not general dissatisfaction
- [ ] Document your notice-and-action process, including expected response time, even informally
- [ ] If running a marketplace, build trader verification into vendor onboarding — don't approve a seller account without ID/registration checks
- [ ] Audit your checkout and account-cancellation flows for anything that could read as a dark pattern — pre-ticked boxes, artificial urgency, hidden cancellation
- [ ] Confirm your terms and conditions are written in plain, accessible language, as the DSA expects — legalese-only T&Cs are increasingly a compliance gap in their own right
- [ ] If using ad targeting, confirm you're not using special-category data or known-minor status for profiling-based ads
Where this overlaps with your other EU obligations
DSA doesn't replace GDPR, consumer rights law, or GPSR — it layers on top, particularly around marketplace trader duties, which overlap with the product traceability requirements in our <a href="/blog/understanding-gpsr-requirements/">GPSR requirements guide</a>. If you're also weighing DSA against its sibling regulation targeting large gatekeeper platforms, see <a href="/blog/digital-markets-act-affect-your-store/">Digital Markets Act: does it affect your store?</a> — most merchants confuse the two, and the DMA genuinely doesn't apply to typical PrestaShop stores at all. For the full cross-regulation view including GDPR and consumer rights overlaps, our <a href="/blog/complete-eu-compliance-checklist-online-stores/">complete EU compliance checklist</a> is the place to see how DSA fits alongside everything else.
What to do about the DSA now
If you run any form of third-party seller marketplace, audit your current vendor onboarding flow this week against the trader-traceability list above — name, address, ID, payment details. If any of those four are missing from your onboarding form, that's your highest-priority gap, since it's the DSA duty most directly tied to marketplace status rather than general good practice.
Frequently asked questions
Does the DSA apply to a small single-brand PrestaShop store?
Yes, but lightly. Even a single-vendor store has baseline hosting-service obligations, mainly around handling notices of illegal content if you allow reviews or comments. The heavier marketplace and Very Large Online Platform duties don't apply unless you match those specific business models or user scale.
What counts as a "marketplace" under DSA versus a normal store?
A marketplace under DSA is a platform that lets third-party traders offer products directly to consumers, typically with the platform taking a commission or fee. If every product on your site is your own brand and you're the sole seller, you're not a marketplace for DSA purposes even if you use a multi-vendor-capable platform.
What is "know your business customer" and do I need it?
It's the DSA requirement for online marketplaces to collect and verify identifying information from every third-party trader before letting them sell — name, address, ID, and payment details. It applies specifically to marketplace-tier platforms, not single-vendor stores.
Are pre-ticked checkout boxes actually illegal now?
Under the DSA, dark patterns that manipulate consumer decisions are prohibited, and pre-ticked consent or upsell boxes are a commonly cited example. This sits alongside similar prohibitions already in EU consumer law, so it reinforces rather than introduces the restriction.
Does DSA fine merchants the same way it fines Big Tech platforms?
No. The largest fines under the DSA target Very Large Online Platforms for systemic non-compliance. Enforcement against smaller merchants typically comes through national Digital Services Coordinators and is proportionate to the size and risk profile of the business.
How is DSA different from GDPR?
GDPR governs how you collect and process personal data. DSA governs platform responsibilities around illegal content, marketplace trader transparency, and manipulative design patterns. They overlap in places — like ad targeting rules — but address different underlying problems.
Related reading
- Digital Markets Act: Does It Affect Your Store?
- Understanding GPSR Requirements
- Complete EU Compliance Checklist for Online Stores
- Omnibus Directive Compliance Guide
- GDPR Security Best Practices Beyond Compliance
