DSA Terms of service check — check missing duties in your terms

Eight blocking Digital Services Act gaps sat in the terms.md of a four-person clip-hosting app, and nobody had touched the file since 2 November 2023.

That date is most of the story. The EU Digital Services Act - Regulation (EU) 2022/2065 - has applied to every provider of an intermediary or hosting service offered to users in the Union since 17 February 2024, not only to the very large platforms. If people can upload, post, comment or message on the thing you built, the regulation puts named clauses in your terms of service and names the articles they come from. A terms file dated before that day was, by definition, not written against those duties.

So I put eighteen DSA rules into a VS Code extension and ran them over two files. The first, clean.md, answers all eighteen: 0 findings. The second, dirty.md, is the kind of file most repositories contain - short, friendly, competently drafted for 2023 - and it comes back with 12 findings, 8 of them blocking.

The eight blocking ones were these. No single point of contact for Member State authorities, the Commission and the Board (Art. 11). No separate point of contact for users (Art. 12). No statement that a user can reach a human rather than only an automated channel (Art. 12(1)). No legal representative in a Member State and no claim of establishment in the Union - the file said Delaware (Art. 13). No electronic notice-and-action mechanism for reporting illegal content (Art. 16). No promise of a statement of reasons when something is removed, demoted or suspended (Art. 17). No mention of the user's right to a certified out-of-court dispute settlement body (Art. 21). And the version date itself, 2023-11-02, sitting on the third line, older than the regulation it was supposed to satisfy.

Four more came back as warnings: the languages you accept from authorities (Art. 11(3)), a plain-language claim (Art. 14(1)), confirmation of receipt to whoever files a notice (Art. 16(4)), and a suspension-after-prior-warning policy for repeat abuse (Art. 23).

None of that is exotic; each of the eight is a paragraph you could write in an afternoon. They are missing because absence is invisible: you reread your terms and they look complete, because everything you can see is there.

That is also why asking a chatbot does not solve it. A language model will draft you fluent, plausible terms and never volunteer that Article 16 is absent, because what is not in the document is not in front of it. A markdown linter has the same blind spot from the other side: it checks heading levels, not statute.

Two of the eighteen rules are conditional. Art. 26 - label the ad, name who paid, explain the targeting parameters - fires only when the file mentions advertising. Art. 28(2), the ban on profiling-based ads where the service is open to minors, fires only when the file mentions minors or children. A plain B2B tool is never nagged about either.

The stakes are asymmetric in a way that makes the afternoon worth spending. DSA fines reach 6% of worldwide annual turnover, and a national Digital Services Coordinator can start from one user's complaint. On the other side, EU technology counsel bills roughly $250 to $500 an hour to read the same six pages.

The gap list is free, for the file you have open and for anyone who pastes their terms into the web page: all eighteen rules, every article number, no watermark and no cut-off. What the full version adds is scope - every legal page and every language version in the workspace in one pass, exported as a dated report with article citations you can hand to a lawyer.