The EU's notice-and-action rule now reaches your directory, even without a European office
A rule you did not sign up for still applies to you
Most operators outside the European Union read a headline about EU platform regulation, note that their company has no office there, and move on. That instinct is wrong for one specific law, the Digital Services Act, and it is worth understanding exactly why before an EU regulator's letter is the thing that explains it.
The regulation's own scope article does not ask where a company is incorporated. It applies to a service offered to people in the Union, full stop, regardless of where the provider is established. The test for when that connection is real enough to count sits in the definitions article: either a significant number of the service's users are in one or more member states relative to that state's population, or the business is shown to be targeting that market, through signals like using a member state's language or currency, letting people order in it, or running local advertising aimed at it. A directory that accepts advertisers and visitors from Germany or France, prices in euros, or runs a German- or French-language version of the site is not a marginal case. It is squarely inside the test.
This is not a theoretical exposure with no real enforcement behind it. 2026 is the year regulators have moved from warning letters to opening formal proceedings and issuing information requests against platforms over exactly the kind of illegal-content handling this article covers, and the direction of travel is toward more scrutiny, not less. An operator does not need to have EU ambitions for this law to already apply; the law is not asking about ambitions, only about where the users already are.
The good news, and the actual point of this article, is that the obligation set is much narrower than the words "EU platform regulation" suggest. Most of what makes the Digital Services Act sound enormous is written for platforms with tens of millions of users. A small classifieds operator owes a short, specific list of things, and knowing exactly which ones saves months of over-building a compliance program nobody asked for.
What the notice-and-action mechanism actually has to do
The core obligation, in Article 16, is a mechanism: an easy-to-access, user-friendly way for anyone, not just a registered user, to flag a specific piece of content on the site as illegal. It has to accept notices purely electronically, and it has to be built to capture what a decision-maker actually needs: a clear explanation of why the content is claimed to be illegal, the exact location of it (a URL, not a description), the notifier's contact details, and a good-faith statement. A contact form buried three clicks deep that only accepts general inquiries does not meet this bar.
Once a notice comes in, two things follow. First, if the notifier gave contact information, the operator has to send an acknowledgment of receipt without undue delay. Second, the operator has to decide, and has to tell the notifier what was decided and why, in plain language, along with the routes available to challenge that decision. This second piece is Article 17's statement-of-reasons duty, and it is not optional paperwork: a properly submitted notice is treated, for legal purposes, as giving the operator actual knowledge of the content it describes, which is exactly the kind of knowledge that determines liability if the content turns out to be illegal and stays up.
What this means in practice is that "we took it down" is not the same obligation as "we told the person why, on the record." An operator who deletes a flagged listing quietly, with no reply to whoever flagged it, has done half the job the law describes. The missing half is the part that would actually protect the business if the same decision were ever second-guessed later, since a documented, reasoned decision is the record that shows the operator acted diligently rather than arbitrarily.
None of this requires new staff or new software bought from a vendor. A structured form with the four required fields, a shared inbox or lightweight ticketing view where each notice gets a timestamped decision and a templated reply, and someone who checks it daily, covers the legal minimum for a directory that is not yet processing thousands of listings a day. The mistake to avoid is treating this as a future problem to solve once the business is bigger; the obligation exists the day the site has any EU users at all, at any size.
Why being small gets you out of some of this, and not this part
The Digital Services Act does carve out real relief for small operators, and it is worth knowing precisely where that relief starts and stops, because getting it backwards in either direction costs something. Article 19 exempts providers of online platforms that qualify as a micro or small enterprise, defined the same way EU law defines it everywhere else: a small enterprise has fewer than 50 staff and either annual turnover or balance-sheet total no higher than ten million euros, and a micro enterprise has fewer than 10 staff and either figure no higher than two million euros. Most directories running on a platform like this one qualify without needing to check twice.
But that exemption is scoped, by its own text, to a specific block of the regulation, the section covering the extra obligations written for larger online platforms: an internal system for handling complaints about the operator's own moderation decisions, access to out-of-court dispute settlement, a fast-track channel for "trusted flaggers," and transparency reporting about advertising and any recommender system the platform runs. A small directory that has none of these built does not need to build them.
What that exemption does not reach is the notice-and-action mechanism itself, or the statement-of-reasons duty attached to it. Those sit in an earlier part of the regulation, written for any provider of hosting services, and nothing in the small-enterprise exemption refers back to it. This is not a loophole or an aggressive reading; it is how the exemption article is written, limited in its own text to the section it sits inside. A ten-person operation and a platform with fifty million users owe the exact same notice-and-action mechanism, even though almost everything else in the law scales with size.
The practical reading for an operator: skip the internal-complaints system, skip the out-of-court dispute panel, skip publishing an advertising-transparency report nobody is asking for, and do not spend a week building any of them defensively. Spend that week instead making sure the actual notice mechanism works the way Article 16 describes it, because that is the one piece of this law that does not care how big the business is.
Are you even an "online marketplace"? The answer changes what you owe
There is a second, separate set of obligations in the same regulation, aimed specifically at "online marketplaces," and it includes a real burden: verifying and holding identity and contact information for every business customer selling through the platform, sometimes called Know Your Business Customer. If that applied to a classifieds directory the way it applies to an e-commerce marketplace, it would mean identity-checking every paying advertiser as a business entity, on top of whatever identity verification the site already runs to keep listings genuine.
The regulation does not actually define "online marketplace" as a term. Instead, this extra obligation attaches to a specific functional description: a platform that allows consumers to conclude a distance contract with a trader, meaning the platform itself mediates the actual transaction, typically through an in-platform checkout. Legal commentary on this point is consistent: a platform where a business merely makes contact with a potential customer, without the platform running the purchase itself, falls outside that description, even if the platform is where the two sides found each other.
A classifieds directory that publishes advertisements and lets a visitor reach out to an advertiser, with the actual arrangement and any payment for the advertised service happening entirely off the platform, matches the pattern that commentary describes as outside the marketplace-specific rules. The directory is an "online platform" under the regulation, because it stores and publicly displays content at a user's request, and it owes what any online platform of its size owes. It is very likely not the narrower "marketplace" category that owes trader-verification duties on top of that.
This is a reading with strong support and no contrary authority found in law-firm commentary on the point, but it is still a reading, not a settled ruling, because this exact boundary has not yet been tested in court. An operator whose site does anything closer to an in-platform booking or payment flow for the advertised service should not assume this conclusion carries over without checking; that design choice is precisely the fact pattern that would push a directory back across the line. For a directory built the ordinary way, advertising only, transaction off-platform, it is worth having a lawyer confirm this reading for the specific site rather than treating it as automatic, but it is not worth building trader-verification infrastructure preemptively against a duty that, on the best current reading, does not apply.
What to actually build, in order
Start with the notice mechanism itself, since it is the one piece every operator owes regardless of size. Build or confirm a form, reachable from a visible link, that captures the location of the content, the reason it is claimed to be illegal, the notifier's contact details, and a good-faith statement, and route every submission somewhere that gets checked daily, not a general support inbox where it can sit for a week.
Write the two short reply templates before the first real notice arrives, not after. One template acknowledges receipt. The other states the decision, the reason for it in plain language, and where the notifier can go if they disagree, and both should be ready to send within a day of a notice landing, since "without undue delay" is the standard the operator will be judged against.
Keep a simple log of every notice and its outcome, even a spreadsheet: the date, what was flagged, what was decided, and when the reply went out. This is the record that would show a regulator, or a court, that decisions were timely, diligent and consistent rather than arbitrary, and it is also the resource that lets an operator confirm, six months from now, that the process is actually being followed.
Do not build the larger machinery, the internal complaints system, the out-of-court panel, the advertising-transparency report, unless a lawyer confirms the business has crossed the size threshold that requires it. That work has a real cost in staff time, and building it early does not buy any legal protection the smaller operator does not already have.
Finally, treat this as one layer of a stack that already includes the age-verification and identity obligations most adult directories are already built around, not a separate project. The notice-and-action mechanism is where a visitor reports content the operator's other checks missed, and the two systems work properly only when they are read together, by the same person, on the same day a report comes in.
