When must a marketplace notify buyers about an illegal product?

The Citead team, updated

In short. DSA Article 32 requires covered marketplaces that learn of illegal products or services to inform recent purchasers whose contact details they hold and publish accessible information if any affected buyers cannot be contacted.

Definition: As of October 2026, Article 32 of the Digital Services Act (https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022R2065) requires covered marketplaces to inform buyers when they become aware that a trader offered an illegal product or service through their platform. Direct notification covers purchases in the preceding six months where the marketplace holds the buyers' contact details.

Key facts

  • The DSA's Article 32 requires information about the illegality, the trader's identity and relevant means of redress.
  • The small-enterprise definition used by the DSA exemption comes from Recommendation 2003/361/EC, Annex Article 2: fewer than 50 persons and annual turnover and/or an annual balance sheet total no greater than EUR 10 million.
  • For product safety recalls and safety warnings, General Product Safety Regulation Article 35(1) requires direct notification of identifiable affected consumers without undue delay, according to the respective obligations of operators and marketplaces.

Which marketplaces fall within Article 32?

DSA Article 32 addresses online platforms allowing consumers to conclude distance contracts with traders. The trigger concerns illegal products or services offered by a trader through the platform to consumers located in the European Union.

Article 29 excludes providers qualifying as micro or small enterprises from this section. It also provides a 12-month transition after loss of that status, except for designated very large online platforms. Designated very large online platforms remain subject to the section irrespective of enterprise size.

The enterprise-size assessment can include other businesses: Recommendation 2003/361/EC, Annex Article 6 requires aggregation of data from partner and linked enterprises under its calculation rules.

What triggers notice, and which purchases count?

Under DSA Article 32(1), awareness triggers the duty regardless of the means by which the marketplace learns of the illegality. The provision expressly covers both products and services.

The purchase window runs backwards from the moment the provider becomes aware of the illegality. Direct notification concerns purchases made through its service within the preceding six months. Article 32 specifies no numerical deadline for sending the notification.

What must buyers receive, and what goes on the website?

DSA Article 32(1) requires the provider to tell affected purchasers that the product or service is illegal, identify the trader, and explain any relevant means of redress. Redress means ways of seeking a remedy. Direct contact applies insofar as the provider has the consumers' contact details.

Article 32(2) adds a publication duty when the provider lacks contact details for all affected consumers. The provider must make information about the illegal product or service, the trader's identity and relevant means of redress publicly available and easily accessible on its online interface. This duty applies even where the provider can contact some affected buyers directly.

How do product safety notices differ?

A product safety recall or safety warning can also engage the General Product Safety Regulation, Article 35. Paragraph 1 requires direct notice without undue delay to all identifiable affected consumers, in accordance with the operators' and marketplaces' respective obligations. It requires use of collected customer personal data for recalls and safety warnings.

Where all affected consumers cannot be contacted, paragraph 4 requires a clear and visible recall notice or safety warning through appropriate channels. Its examples include the company's website, social media, newsletters and retail outlets, where available. The information must be accessible to persons with disabilities.

FAQ

Does a public notice replace contacting buyers whose details I hold?

DSA Article 32 requires direct information insofar as the provider holds purchasers' contact details. Its public-information duty applies when contact details for all affected consumers are unavailable.

Do I count six months from the purchase or from awareness?

Under Article 32(1), the marketplace identifies purchases made within the six months preceding its awareness of the illegality. That date anchors the lookback period.

Does Article 32 require notice about illegal services too?

Yes. Article 32(1) expressly covers an illegal product or service offered by a trader through the platform.

Sources

  1. EUR-Lex, "Regulation (EU) 2022/2065 (Digital Services Act)", 19 October 2022
  2. EUR-Lex, "Commission Recommendation 2003/361/EC concerning the definition of micro, small and medium-sized enterprises", 6 May 2003
  3. EUR-Lex, "Regulation (EU) 2023/988 on general product safety", 10 May 2023

Check how a page reads to answer engines. Open the GEO score analyzer

Test a page and see what to fix first

The analysis usually takes less than 10 seconds and needs no account.

400,000+ pages scored in the public benchmark