LegalBrandGuard
Scan

DSA Article 16: the argument that forces a host to act

Updated on August 5, 2026 · LegalBrandGuard · 3 min read

Quick answer

Article 16 of Regulation (EU) 2022/2065 (Digital Services Act) requires hosting providers to put in place a notice and action mechanism. A compliant notice gives the provider actual knowledge of the illegal content: it then loses the liability exemption granted under Article 6 if it does not act promptly.

Why this article shifts the balance of power

An ordinary cease-and-desist letter is a request. The recipient deals with it if it feels like it, and staying silent costs nothing. That is what makes the exercise so discouraging: you write, you wait, nothing happens.

Article 16 shifts that balance. It does more than require the host to set up a reporting mechanism: paragraph 3 specifies that a notice containing the required elements is deemed to give rise to actual knowledge within the meaning of Article 6.

Article 6 is the foundation of hosting providers' non-liability — the principle that they are not responsible for the content they carry as long as they are unaware of it. From the moment a compliant notice is received, that protection falls away if they have not acted promptly.

Ordinary cease-and-desist letterArticle 16 notice
NatureRequestAct with legal effect
Effect of silenceNoneLoss of the liability exemption
Obligation to respondNoYes, with reasons for the decision
Recourse if no actionJudicialDigital Services Coordinator

It also applies to providers outside Europe

This is the point most often misunderstood, and the most useful one in practice. The DSA is not limited to hosting providers established in the Union.

Article 2(1) uses a destination-based test: the Regulation applies to intermediary services provided to recipients of the service that are established or located in the Union, irrespective of where the providers of those services have their establishment.

In practice, a fake site accessible to French consumers brings within scope both a US CDN and a Hong Kong registrar. The argument therefore applies precisely where one might think there is no leverage at all.

The four elements that make a notice compliant

Without these elements, the notice is just one more letter. With them, it triggers the effects described above. They are set out in Article 16(2).

Required elementWhat it means in practice
Substantiated explanation of the illegalityThe grounds: reproduction of the trademark, confusion, fraudulent data collection
Exact electronic locationThe full URL of the content, not just the domain name
Name and contact details of the notifying partyIdentity of the trademark owner and a contact address
Statement of good faithA statement confirming the belief that the information is accurate and complete

The good-faith statement is not a formality

This is the element most often forgotten, and the only one that cannot be inferred from any other. Cloudflare, for instance, titled its checkbox “DSA certification of bona fide belief”, and states that it can be mandatory to trigger its notice and action procedure.

A notice without this statement can therefore be dismissed before it is even read on the merits.

What the host must do in return

Paragraphs 5 and 6 of Article 16 impose two obligations that are rarely invoked, yet worth citing directly in the letter itself.

  • Process the notice in a timely, diligent, non-arbitrary and objective manner.
  • Notify its decision to the notifying party, with the reasons and the available redress options.

In other words, a host subject to the DSA can no longer simply ignore a notice. Stating this explicitly in the notice changes the nature of the exchange.

Frequently asked questions

Does the DSA apply to a US or Asian hosting provider?+
Yes. Article 2(1) states that the Regulation applies to intermediary services provided to recipients of the service that are established or located in the Union, irrespective of where the providers of those services have their establishment. A site accessible to French consumers brings its host within scope, whether it is based in California or Hong Kong.
What does Article 16 add compared to an ordinary cease-and-desist letter?+
An ordinary cease-and-desist letter only has effect if the recipient chooses to respond to it. A notice compliant with Article 16 triggers actual knowledge within the meaning of Article 6: from the moment it is received, the provider loses the liability exemption if it does not act promptly. Inaction becomes a legal risk.
What must the notice contain to be compliant?+
Four elements, listed in Article 16(2): a sufficiently substantiated explanation of the reasons why the content is illegal, the exact electronic location of the content, the name and contact details of the notifying party, and a statement confirming the notifying party's good-faith belief that the information provided is accurate and complete.
Does the DSA replace Section 3.18 of the ICANN agreement?+
No, the two apply cumulatively and target different actors. Section 3.18 is a contractual commitment made by the registrar to ICANN, and failing to honor it is handled through an internal procedure. The DSA is a binding legal norm that targets the host and exposes it to public sanctions.
Is a lawyer needed to draft an Article 16 notice?+
The Regulation does not require any representation. The four required elements are factual, and the trademark owner holds all of them. Legal counsel remains useful if the fraudster disputes the notice or the matter turns contentious.

Check your own brand

Every cease-and-desist letter we produce is drafted as a qualifying notice within the meaning of Article 16, with the four required elements and the good-faith statement.

Scan my site for free

Sources

See also: finding the registrar and its abuse contact.

← Getting a fake site taken down