DSA checklist for forum operators: the obligations that apply to your forum

Published 25 October 2026

As of: 25 October 2026. Not legal advice. This article summarises obligations from the text of the regulation. Whether and how they apply to your forum depends on your situation. If in doubt, ask a qualified professional.

Does the DSA apply to my forum?

Very likely, yes. The Digital Services Act (Regulation (EU) 2022/2065, DSA) has applied in full to all intermediary services in the EU since 17 February 2024. A forum stores posts on behalf of its users, which makes it a hosting service. Because it disseminates those posts to the public, it is usually also an online platform.

In Germany, the Digitale-Dienste-Gesetz (DDG) has supplemented the DSA since 14 May 2024. The Bundesnetzagentur is the Digital Services Coordinator in charge of supervision. Other member states have their own coordinators.

It is not settled whether a purely private forum without income or advertising is covered, because the DSA applies to services “normally provided for remuneration”. Banner ads or donations can already change that. The basic obligations are manageable, so it is usually worth simply implementing them.

Which obligations apply to every forum?

Point of contact for authorities (Art. 11)

A single point of contact for member state authorities, the European Commission and the European Board for Digital Services is designated.
It can be reached electronically, in practice by email.
The details are published, easy to find and up to date.
The languages in which you can be contacted are stated, including at least one official language of your member state.

Point of contact for recipients of the service (Art. 12)

Users can contact you directly and rapidly by electronic means.
Contact does not rely solely on automated tools such as a chatbot.
The details are published and easily accessible.

The point of contact for authorities and for users may be the same.

Moderation details in your terms and conditions (Art. 14)

Your terms or forum rules describe which content you restrict.
They describe the policies, procedures, measures and tools used for content moderation, including automated tools such as spam filters, and whether humans review decisions.
They describe how users can complain about a decision.
They are written in clear, plain language and are publicly available.

Notice and action mechanism (Art. 16)

Any individual or entity must be able to notify allegedly illegal content, not just registered members.

There is an easy to access, electronic notice mechanism that guests can use too.
The notice asks for: an explanation of why the content is illegal, the exact URL, the notifier’s name and email address, and a statement that the information is accurate and complete, given in good faith.
Name and email address are not required for notices about child sexual abuse.
Notifiers who give contact details receive a confirmation of receipt without undue delay.
Notices are processed in a timely, diligent, non-arbitrary and objective manner.
The notifier is told the decision and the available means of redress.
If automated means were used for processing or deciding, the notification says so.

Statement of reasons for restrictions (Art. 17)

When you restrict content or users, you must give those affected a statement of reasons. This covers removing or disabling content, restricting its visibility, and suspending or terminating accounts.

Those affected receive a clear and specific statement of reasons at the latest when the restriction is imposed.
It states the type of restriction and, where relevant, its territorial scope and duration.
It states the facts and circumstances relied on, and whether the decision followed a notice.
It states whether automated means were used.
It names the legal ground (for illegal content) or the rule in your terms that was broken.
It explains the available means of redress.

The obligation only applies if you know the electronic contact details of the person affected. It does not apply to deceptive high-volume commercial content, i.e. typical spam (Art. 17(2)).

Notification of suspicions of criminal offences (Art. 18)

You know whom to contact: if you become aware of information giving rise to a suspicion of a criminal offence involving a threat to the life or safety of persons, you promptly inform the law enforcement or judicial authorities of the member state concerned.

Which exemptions apply to small forums?

Micro and small enterprises benefit from significant exemptions. These are operators with fewer than 50 employees and an annual turnover or balance sheet total of no more than €10 million (Recommendation 2003/361/EC). That covers almost all forums.

No annual transparency report (Art. 15(2)).
The additional obligations for online platforms in Art. 20 to 28 do not apply (Art. 19), including the internal complaint-handling system and submitting statements of reasons to the European Commission’s transparency database.
Art. 24(3) still applies: on request, you must provide the authority with information on your number of active recipients.

Larger operators, such as company or publisher forums, also need an internal complaint-handling system (Art. 20) and a transparency report (Art. 15 and 24), among other things.

The obligations under Art. 11, 12, 14, 16, 17 and 18 apply to everyone, including micro enterprises.

What about cookies?

Cookies are not a DSA topic, but they often come up at the same time. In the EU they are governed by the ePrivacy Directive, in Germany by § 25 TDDDG: storing or reading information on the user’s device requires consent, unless it is strictly necessary for the service the user has explicitly requested. A forum’s login and session cookies are usually strictly necessary, analytics and advertising cookies are not.

What does XenForo cover on its own?

Out of the box, XenForo does not fully cover any of the obligations above:

Only logged-in members can report content, guests cannot. The details required by Art. 16 are not requested, and there is no confirmation of receipt.
When editing or deleting posts and profile posts, moderators can optionally send the author an alert with free text, without the details required by Art. 17 and without a log. When rejecting content from the moderation queue, banning or warning users, even that is missing.
There is no point of contact with language information. You have to maintain a contact page and the forum rules yourself.

I am currently developing ComplyGuard, a XenForo add-on for this. It has not been released yet.