In brief
- The Digital Services Act (DSA) imposes tiered obligations on online platforms and intermediaries operating in the EU to tackle illegal content, including IP-infringing material.
- In May and July 2026, the European Commission fined Temu €200 million and AliExpress €550 million respectively for failing to properly identify and mitigate systemic risks of illegal products on both platforms, reflecting the most significant DSA enforcement actions to date.
- The DSA provides a range of valuable enforcement tools, including risk assessment obligations on Very Large Online Platforms, 'know your business customer' requirements, trusted flagger status, and notice and action procedures.
- The UK's Online Safety Act 2023 expressly excludes from its scope IP infringement, and so traditional enforcement avenues such as website blocking injunctions and platform-specific brand protection programmes remain the focus in the UK.
The Digital Services Act (DSA), which entered into force on 16 November 2022, has effected a significant overhaul of the regulatory regime governing online services in the EU. By imposing stricter obligations on online platforms and intermediaries, the DSA aims to address the challenges posed by the growth of the digital economy, specifically in relation to illegal and harmful content. Recent decisions by the European Commission to fine Temu and AliExpress for breaching their risk assessment obligations under the DSA highlight the growing burden placed on digital platforms to reduce the risk of illegal content online, and the Commission's scrutiny of such assessments under the legislative framework. With dupe culture on the rise and counterfeit goods increasingly accessible globally, this article examines the DSA and its value as an enforcement tool for IP rights holders.
European Commission fines Temu €200 million
On 28 May 2026, the European Commission fined Temu €200 million for failing to diligently identify, analyse and assess the systemic risk of illegal products being sold on its platform, and the resulting harm to EU consumers.
The DSA imposes several obligations on online platforms and intermediaries, which increase cumulatively depending on the size and breadth of activities. Temu was designated as a Very Large Online Platform (VLOP) in 2024 by virtue of having more than 45 million monthly active users in the EU. As a result of this designation, Temu is subject to the most stringent obligations, including a duty to identify and mitigate systemic risks arising in connection with the platform. Following an investigation, the Commission found that:
- Temu's risk assessment relied on generic information in relation to risks arising in the e-commerce industry as a whole, rather than risks specific to Temu's own service;
- it seriously underestimated how often EU consumers were likely to encounter illegal items on the platform, with evidence obtained from a mystery shopping exercise revealing that a high percentage of chargers and baby toys failed basic safety tests or posed medium to high level safety risks; and
- it did not adequately assess how the design of its service (which included product promotion programmes involving influencers, and recommender systems) could exacerbate the dissemination risks of illegal products.
Temu now has until 28 August 2026 to submit an action plan to the Commission, outlining the remedial measures it intends to take.
European Commission fines AliExpress €550 million
On 20 July 2026, the Commission subsequently fined AliExpress €550 million for breaching its obligation to assess and mitigate the risk of illegal, unsafe or counterfeit products being disseminated on the platform. The fine represents the largest penalty imposed by the Commission under the DSA to date.
AliExpress was previously allocated VLOP status in the Commission's first suite of designations in 2023. The Commission later commenced an investigation into whether AliExpress had breached its obligations under the DSA in 2024, specifically in relation to the assessment and mitigation of risks; content moderation and the handling of internal complaints; transparency of advertising and recommender systems; traceability of traders on the platform and suspected failures to ensure that information provided by traders was reliable; and data access for researchers. Further to its investigation, the Commission found that:
- AliExpress did not properly evaluate whether it had sufficient staff to review potentially illegal products and overestimated the effectiveness of its detection and removal system, with many illegal products appearing on the platform, and even if detected, remaining available for several weeks;
- its assessment regarding the extent to which recommender and advertising systems exacerbated the promotion and sale of illegal products on the platform was inadequate, with many illegal products being recommended or advertised to consumers;
- it did not properly measure how well its moderation systems prevented the risk of illegal products appearing or reappearing;
- it did not adequately enforce its penalty policy against traders selling illegal products;
- traders could circumvent compliance checks to place non-compliant products on the platform by mislabelling and listing them in the incorrect product category; and
- illegal products represent a significant risk on AliExpress' platform, with its brand authorisation system (intended to prevent the sale of counterfeit goods) categorised by the Commission as ineffective and understaffed.
The fine was calculated by the Commission having regard to several factors including the nature of the infringements, their duration, and their gravity. AliExpress has until 20 October 2026 to submit an action plan to the Commission in response, and has indicated its intention to appeal the fine, which it described as 'disproportionate'.
Following several investigations against online platforms in relation to their risk assessment obligations (explored further below), the Commission's recent decisions illustrate that risk assessments are a cornerstone of the DSA.
Digital Services Act
The DSA applies to intermediary services provided in the EU (regardless of where the provider is based), including, for example, online platforms, marketplaces and search engines, cloud providers, app stores, social networks, and content-sharing platforms, and providers of conduit, caching and hosting services.
All intermediary services have an obligation to combat illegal content under the DSA, though the extent of this obligation is dependent on the type of service provider. The requirements increase cumulatively depending on the breadth of activities, with mere conduit and caching providers having the fewest obligations, and VLOPs and Very Large Online Search Engines (VLOSEs) (being platforms and search engines with over 45 million users in the EU each month) subject to the most stringent obligations. "Illegal content" is defined broadly under the DSA as information which is itself illegal or which relates to an illegal activity, having regard to EU law and the laws of each Member State, regardless of subject matter or nature. The definition of illegal content encapsulates content which infringes intellectual property.
Obligations
The DSA introduces a suite of regulatory requirements which can assist with the protection and enforcement of intellectual property rights online.
For example, it imposes 'know your business customer' obligations on online platform providers which facilitate distance contracts between consumers and traders. Providers must obtain verified information about the traders operating on their platform (including, for example, name, address, identification documents and contact details), to support traceability of such traders. Additionally, all providers must respond to take down orders submitted by national authorities in respect of illegal content, and provide information about specific users of their services following disclosure orders from national authorities. Such obligations may also assist rights holders with enforcing their intellectual property rights against the sale of counterfeit goods, and improve the success of traceability and notice and take down mechanisms which previously may have been restricted by the use of false trading names or identities.
In addition, online platforms must monitor repeat infringers (including users which repeatedly upload illegal content to the platform) and consider suspension of accounts. Hosting service providers are required to implement user-friendly notice and action procedures, to allow users to easily notify the host of illegal content on the platform.
Risk assessments
VLOPs and VLOSEs must identify and mitigate systemic risks associated with their services and publish annual reports with the results of their assessment; their mitigation measures; and the resources dedicated to moderation of content and ensuring compliance with the DSA.
The Commission has investigated several online platforms in relation to suspected breaches of risk assessment obligations, including TikTok, Meta, and Shein, in addition to Temu and AliExpress. Risk assessments are a significant element of the DSA and are subject to particular scrutiny by the Commission, and VLOPs and VLOSEs have a heightened responsibility to mitigate the presence of illegal content online. To the extent that large platforms or search engines are systemically vulnerable to the presence of counterfeit or IP-infringing materials on their platforms, VLOPs and VLOSEs will be required to assess and mitigate this risk, assisting IP rights holders with the protection of their rights.
Trusted flaggers
Entities with (i) expertise in detecting, identifying and notifying the presence of illegal content; (ii) independence from any provider of online platforms; and (iii) which act in a timely, diligent and objective manner in respect of these activities can be designated with 'trusted flagger' status.
Status is designated by the Digital Services Coordinator of each EU member state, and a list of trusted flaggers is publicly available. Complaints about the presence of illegal content on a platform by a trusted flagger are prioritised by providers. Whilst the trusted flagger regime has parallels with voluntary regimes created independently by providers, the latter typically also encompasses content which is not permitted under the platform's guidelines (and which therefore may go beyond 'illegal content' as defined), whereas the trusted flagger regime is specifically focused on illegal content as defined under the legislation.
Certain trusted flaggers, for example Nexa Watch and FAPAV, have expertise in identifying and reporting intellectual property infringements.
The Commission has sought input on draft guidelines for trusted flaggers under a targeted consultation, aimed at clarifying eligibility conditions for trusted flagger status, and to provide further guidance on how the mechanism operates. The Commission intends to adopt the non-legally binding guidelines in the second half of 2026. This initiative follows its recent study on the trusted flagger mechanism, which identified eligibility issues tied to the application of individual entities (including intellectual property rights holders) for trusted flagger status. Some rights holders and entities may find it more difficult to fulfil the independence and objectivity criteria, and it is hoped that the Commission's forthcoming guidelines will address this.
To the extent that a growing number of rights holders or entities with expertise in identifying intellectual property infringements are afforded trusted flagger status, the mechanism provides a valuable tool in combating the presence of infringing material online.
Position in the UK
In the UK, as of 17 March 2025, platforms also have a legal duty to protect users from illegal content online under the Online Safety Act 2023 (OSA). However, unlike the broad definition of illegal content under the DSA, the OSA expressly excludes IP infringement from the definition. Instead, it focuses on 'priority offences', including, for example, child sexual exploitation and terrorism offences.
Rights holders must therefore rely on more traditional avenues of IP enforcement to combat infringing material online, which we explore in our previous article on the rise of dupe culture.
Platforms typically rely on notice and takedown mechanisms and a hosting safe harbour defence to avoid liability (under which hosting providers are exempt from liability for infringing goods if they did not know they hosted illegal content or information, and they acted expeditiously to remove or disable access to it once aware). However, platforms are required to have no actual or constructive knowledge to benefit from the safe harbour. With platforms becoming increasingly active in selecting, managing and promoting content, reliance on this exemption may become difficult.
Further, rights holders can apply for a website blocking injunction against intermediaries whose platforms or services are being used by third parties to infringe copyright. UK courts have considered this issue in the context of both copyright infringement (Twentieth Century Fox Film Corp v British Telecommunications) and trade mark infringement (Cartier International AG v British Sky Broadcasting Ltd). The potential for online platforms to be themselves liable for acts of infringement on their platforms, including the sale of counterfeit goods, has also been considered by the courts in recent years, including in the significant Christian Louboutin v Amazon decision, and by the UK Supreme Court recently in Lifestyle Equities v Amazon.
IP rights holders can also rely on a suite of tools developed by e-commerce platforms themselves. For example, Amazon's Brand Registry programme allows brands to actively monitor and remove infringing products. UK Government Guidance on Protecting Intellectual Property Rights on E-Commerce Stores provides helpful insights to brand owners on the suite of tools available to monitor and remove infringing content online.
How Mishcon de Reya can help
The Digital Services Act has opened up new opportunities for rights holders to tackle counterfeit and other IP-infringing content online. We advise clients on how to use such mechanisms as part of wider online enforcement strategies, including platform takedowns, seller identification and traceability, and cross-border enforcement programmes. For further information, please contact a member of the Intellectual Property team.