Spotlight on Year 1 DSA Audit Outcomes: Emerging Themes for Platforms and Services – Deloitte Internet Regulation

In November and December 2024, the initial 19 Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) to be designated by the European Commission published their first Digital Services Act (DSA) independent audit reports. The DSA is a landmark piece of regulation which aims to protect online users in the EU from illegal and harmful activities, prevent the spread of mis/disinformation and ensure a safe and fair online environment.

For the first time, independent auditors have assessed the compliance of these 19 platforms and services against 178 obligations¹. The platforms and services, some provided by the same organisation, to publish DSA audit reports in 2024 are:

These DSA audit reports set out how platforms and services have performed against statutory obligations and offer valuable insight into the efforts made during the first year of compliance with the DSA - as well as recommendations for improvements in Year 2. This is a significant milestone in this nascent regulatory landscape and one that will continue to evolve as risks and challenges from digital services grow.

Deloitte’s multidisciplinary Internet Regulation team - comprising experts in legal and compliance, audit and controls and regulation - have mapped the results of every DSA audit report against all obligations. The results paint a rich picture of the state of compliance across industry. The audit reports ranged from 109 to 350 pages in length – totalling almost 3,000 pages.

The Deloitte report contains a detailed heatmap, showing the audit opinions of all platforms and services. We analyse in detail five key emerging themes from the first year, delving into the detail of auditor recommendations and areas identified for improvement in 2025. Some of the insights highlighted in our report include:

• Articles 11.1 (Points of contact) and 41.6 (Compliance function) achieved the most positive outcomes in the first year of the audit.
• Platforms have interpreted terms in different ways, leading to significant variations in some benchmarks.
• The number of out-of-scope obligations was high - 109 on average per platform or service - but this will reduce in Year 2.

This Deloitte report is a resource for leaders, compliance teams and product engineers across industry to understand and identify areas of focus for their compliance efforts in 2025. It contains insight for those platforms currently designated as a VLOP/VLOSE and those growing platforms that will soon reach the thresholds for these obligations as they plan their DSA compliance regimes. In 2025, six further platforms will be in scope of these audit regulations.

We intend to publish our insights into the DSA audit reports each year, building on analysis of the first year and releasing alongside broader internet and digital regulation thought leadership as the regulatory regime matures and develops. 

To request a copy of our 2024 ‘Deloitte Internet Regulation - Spotlight on the Year 1 DSA Audit Outcomes: Emerging Themes for Platforms and Services’ report please contact: internetregulation@deloitte.co.uk

_____________________________________________________________________________

Footnotes:

¹ For the purposes of this report we define an obligation as a sub-article within the DSA Articles. This figure includes all sub-articles, some of which platforms have determined not to be obligations and as such treated as out of scope. Some of these obligations are requirements for the European Commission and Digital Services Coordinators.