If you’re selling into the European Union through Amazon, Zalando, or your own Shopify storefront, the EU Digital Services Act (DSA) is no longer a legal abstraction. As of early 2026, the European Commission has levied its first significant fines against non-compliant marketplace operators, and downstream pressure is landing squarely on third-party sellers. Amazon EU has already suspended over 14,000 product listings in Q1 2026 for DSA-related documentation failures, according to internal seller communications reviewed by Ecommerce Times.
The good news: compliance is achievable, and sellers who build clean processes now will hold a structural advantage as competitors scramble. This guide walks you through every operational step, with specific tool recommendations and real merchant tactics that are already working in the field.
What Exactly Does the DSA Require from Ecommerce Sellers?
The DSA distinguishes between platform operators and traders — but both categories carry obligations. As a seller operating on a Very Large Online Platform (VLOP) like Amazon EU, eBay Europe, or Zalando, you are classified as a trader and must comply with traceability requirements under Article 30. That means submitting verified business identity data, including VAT numbers, registered business address, and a named point of contact for regulatory correspondence.
For DTC brands running their own Shopify storefronts and targeting EU consumers, Article 14 of the DSA requires clear notice-and-action mechanisms — essentially, you need a published process for users to flag illegal content or products, and you must act on those notices within defined timeframes.
- Article 30 compliance: Verified trader identity on all marketplace listings
- Article 14 compliance: Accessible notice-and-action mechanism on owned storefronts
- Article 26 compliance: Advertising transparency for any targeted ads served to EU users
- GPSR alignment: The General Product Safety Regulation, live since December 2024, now intersects with DSA enforcement — product documentation must be accessible digitally
“Most mid-market Shopify sellers think the DSA is a platform problem, not their problem,” says Sarah Lichtenberg, head of EU market strategy at global compliance consultancy Ecomply.io. “That’s the exact mindset that’s getting listings pulled right now. The obligation chain runs all the way down to the individual seller.”
“The obligation chain runs all the way down to the individual seller. If you’re generating more than €10,000 in annual EU revenue and you haven’t done a DSA audit, you’re operating with real legal exposure.” — Sarah Lichtenberg, Ecomply.io
Step 1: Run a Full DSA Compliance Audit Before You Do Anything Else
Before investing in tools or legal counsel, map your current EU exposure. This doesn’t need to be expensive — a structured internal audit takes roughly 6–8 hours if you have access to your own sales data.
Audit checklist:
- Pull all EU revenue by channel (Amazon EU, eBay UK/EU, Shopify, wholesale via Faire) from the last 12 months
- Identify which channels are classified as VLOPs — Amazon.de, Amazon.fr, Zalando, and eBay.de all qualify
- Confirm your Article 30 data is submitted and verified on each VLOP you use
- Review your Shopify storefront for a published notice-and-action page (this can be as simple as a dedicated contact form with documented SLA)
- Audit your ad targeting settings in Meta Ads Manager and Google Ads — DSA Article 26 requires that EU users can see why they were shown a specific ad
Tools like Middesk (for business verification documentation) and Compliant (a newer EU-focused compliance SaaS) can automate much of the Article 30 data submission process across multiple marketplaces simultaneously. Several larger Amazon EU sellers have also started using Jungle Scout’s compliance module, which rolled out in Q4 2025 and includes DSA documentation tracking alongside standard listing analytics.
Step 2: Get Your Marketplace Trader Identity Documentation in Order
This is the step most sellers are failing on. Amazon EU’s seller compliance team has been issuing notices that require sellers to resubmit identity documentation that was previously accepted under older EU ecommerce directives. The new DSA standard is stricter.
You’ll need, at minimum: a valid EU VAT number or proof of EU fiscal representative appointment, a registered business address within the EU or a verified EU-based responsible person designation, and a business bank account that matches your registered entity name.
Non-EU sellers — including U.S.-based brands selling into Europe — have an additional layer of complexity: they must appoint an EU Authorized Representative under the DSA if they lack a registered EU entity. Services like Eurosender’s compliance arm and the Berlin-based firm EURAD handle these appointments for roughly €800–€2,400 annually depending on product category and volume.
“We had 47 listings suspended in February because our German VAT registration had lapsed during a corporate restructuring. The fix took three weeks and cost us roughly €38,000 in lost EU revenue. Document your entity structure like your business depends on it — because it does.” — Marcus Hellweg, founder of outdoor gear brand TrailState, Munich
Pro tip: Set calendar reminders 90 days before any EU VAT registration renewal date. Lapsed registrations are now triggering automatic listing suppression on Amazon EU within 72 hours of expiration.
Step 3: Build a Notice-and-Action System for Your Owned Storefront
If you operate a Shopify store that ships to EU customers, you need a functioning notice-and-action mechanism. The DSA doesn’t prescribe the exact format, but enforcement guidance from the European Commission specifies that it must be “easily accessible, user-friendly, and electronically accessible.”
In practical terms, a compliant implementation looks like this:
- A dedicated page (e.g., /eu-compliance or /report-content) linked from your footer
- A form that captures: reporter identity, the specific product or content being flagged, the legal basis for the report (e.g., counterfeit concern, illegal product claim), and contact information
- A documented internal SLA — the EC guidance suggests 7 days as a reasonable response benchmark for smaller traders
- A logged record of all notices received and actions taken, retained for at least 18 months
Shopify merchants can build this cleanly using a combination of Typeform (for the intake form) and a Notion or Airtable database for logging. More sophisticated operators are using Gorgias’s compliance ticket tagging system, which several EU-focused agencies began recommending to clients in early 2026 after Gorgias added a DSA notice category to its ticket classification engine.
Step 4: Audit Your Advertising Transparency for EU Users
This is the DSA requirement that most DTC brands haven’t addressed at all. Article 26 mandates that any advertising shown to EU users must be clearly labeled as advertising, must identify the entity that paid for it, and must not use sensitive personal data categories (health, religion, political views) for targeting.
For most Shopify brands running Meta and Google ads, the practical implications are manageable:
- Meta’s “Why am I seeing this ad?” disclosure is automatically applied — but you still need to ensure your advertiser identity in Meta Business Manager matches your registered EU entity
- Google’s EU ad transparency settings must be enabled for any campaigns targeting EU traffic — check under Campaign Settings > Additional Settings > Ad Transparency
- Retargeting segments built on EU user data must exclude sensitive category inferences — audit your Custom Audience definitions in Meta and remove any segments built from health-related browsing behavior or purchase history
“We found three retargeting audiences in our Meta account that were built on supplement purchase history — exactly the kind of sensitive inference the DSA prohibits,” says Priya Anand, growth director at London-based wellness brand Soluna. “We deleted them immediately. It’s not just a compliance issue, it’s a reputational risk.”
Step 5: Appoint an Internal DSA Compliance Owner and Build a Quarterly Review Cycle
The sellers who are navigating DSA compliance most effectively in 2026 have done one thing differently from their peers: they’ve named a specific person — not a law firm, not an agency — as the internal owner of DSA compliance. This doesn’t need to be a full-time role, but it needs to be someone with decision-making authority over listings, advertising, and customer-facing policy.
Build a quarterly review cycle that covers:
- Marketplace trader identity documentation status across all EU channels
- Notice-and-action log review — any patterns in reports received
- Advertising audience audit — verify no sensitive-category targeting has crept back in via automated audience expansion
- GPSR product documentation check — digital safety data sheets must be current and accessible for all physical products
- Legal updates — the EC is issuing supplementary guidance on DSA implementation quarterly; subscribe to the official Digital Single Market newsletter and Ecomply.io’s monthly briefing
“The brands that are treating DSA as a quarterly ops task rather than a one-time legal project are the ones that won’t get blindsided when enforcement ramps up in H2 2026. The Commission has been signaling stricter action against smaller traders since March.” — Sarah Lichtenberg, Ecomply.io
What Are the Real Penalties for Non-Compliance in 2026?
The DSA’s penalty framework is significant. For VLOP operators, fines can reach 6% of global annual turnover. For traders operating on those platforms, the enforcement mechanism is primarily listing suspension and potential removal from the marketplace — which, for a seller generating €500K+ annually from Amazon EU, is the functional equivalent of a seven-figure penalty.
The European Commission fined three marketplace operators in Q1 2026 under the DSA’s VLOP provisions — none of the fines have been publicly disclosed in full as of this writing, but enforcement sources suggest the amounts are in the €40–€80 million range. That precedent is accelerating platform-level compliance pressure that is cascading to sellers in the form of stricter verification requirements and faster listing suspensions.
For DTC Shopify sellers operating independently, the primary enforcement mechanism is complaint-driven — a competitor or consumer watchdog files a complaint with a national Digital Services Coordinator (each EU member state has one), which triggers an investigation. The Irish DSC (relevant for brands using Irish-registered entities) and the German Bundesnetzagentur have both signaled active enforcement pipelines for 2026.
The operational bottom line: DSA compliance is not optional, and the window for getting ahead of enforcement is closing. Sellers who complete the five steps in this guide before Q3 2026 will be positioned to operate cleanly across EU channels while competitors face suspension cycles and legal distraction. Build the process, name the owner, and review it every quarter. That’s the entire game.
