DSA (Digital Services Act): Automating Illegal Content Reporting with n8n

February 17, 2024 came and went a while ago, and yet plenty of French site operators are still discovering that the Digital Services Act already applies to them. The instinct is to think "DSA" means "TikTok, Meta, Amazon" — the very large platforms facing the heaviest obligations. In reality, the regulation cascades down to any "hosting service provider" established or active in the EU, which includes an e-commerce site with customer reviews, a classifieds marketplace, a professional forum, or even a blog with open comments. If your site stores and distributes content supplied by third parties, Article 16 of the DSA already requires you to run a mechanism for reporting illegal content — not in two years, now. That's exactly the kind of structured, timestamped, partially automatable flow n8n is built for, on the same principle as our guides on NIS2 compliance or ISO 27001 / SOC 2 evidence.

What the DSA actually requires, and from whom

Three obligations concern nearly every site with user-generated content, regardless of size:

• Article 16 — notice mechanism: an electronic, easily accessible means letting anyone report content they consider illegal, including the minimum required elements (location of the content, grounds, notifier's contact details except for certain content).
• Article 17 — statement of reasons: every moderation decision taken in response to a notice must be justified and communicated to the person concerned, clearly and understandably.
• Article 20 — complaint handling: an internal complaint-management system allowing a moderation decision to be contested.

Only the annual public reporting obligation (Article 24) explicitly exempts micro and small enterprises. The notice mechanism itself has no size threshold: a small business hosting customer reviews must offer it just as a large marketplace does, with the same substantive quality of handling expected.

Why a spreadsheet and a shared inbox aren't enough

A widely cited reference on the topic, Digital Services Act: A Short Primer by Martin Husovec and Irene Roche Laguna (2022), points out that the DSA builds a system of conditional liability: a host stays protected as long as it diligently acts on notices it has knowledge of, but loses that protection the moment a sufficiently precise notice goes unaddressed. The risk isn't only regulatory, then — it's also contentious: a notice lost in a shared inbox can, in a later dispute over the same content, strip the host of the liability exemption it would have kept had it handled the first notice properly.

A recent empirical study, The DSA Transparency Database: Auditing Self-reported Moderation Actions by Social Media by Trujillo, Fagni, and Cresci (2023), analyzes over 353 million moderation decisions self-reported by large platforms and finds significant inconsistencies between announced and actual processing times, along with gaps between published transparency reports and the raw submitted data. The lesson holds at small scale too: without reliable, automatic timestamping at every step, it's nearly impossible to later prove a notice was handled "in a timely manner," as the regulation requires.

The n8n workflow: from notice to a logged decision

1. Structured intake of the notice

A multi-step form or a secured webhook embedded on the relevant pages (product listing, seller profile, ad) captures the minimum elements Article 16 requires: URL or identifier of the content, grounds, explanation, notifier's contact details. Each submission immediately creates a timestamped record — the same principle as the Supabase audit-logging workflow from the Compliance & Audit Pack, where every response is logged the moment it's received rather than at case closure.

2. AI pre-qualification, human decision

A Structured Output Parser or a text classifier can automatically sort notices by likely category (counterfeiting, hate speech, dangerous product, spam) and flag duplicates or clearly unfounded reports, to prioritize the queue. But the final legal qualification stays a human-validation step: the workflow prepares the case file and alerts the right person, it doesn't decide in their place.

3. Statement of reasons and notification

Once a decision is made (removal, restriction, or the content staying up), the workflow automatically generates the statement of reasons Article 17 requires — the same logic as the pack's AI summary report workflow, adapted here to a structured reply template (legal basis invoked, content concerned, avenues for redress) — and sends it to the notifier and, where relevant, to the content's author.

4. Follow-ups and deadlines

A case left "pending decision" for more than a few business days triggers an alert, on the same principle as the automated follow-up workflow: nothing should stay stuck simply because no one saw it. This follow-up mechanic is directly reusable from the workflows already used for handling GDPR requests, which follows the same logic of a regulatory deadline to meet.

What a workflow doesn't replace

An automated notice mechanism doesn't remove any of the DSA's substantive obligations: a clear moderation policy in your terms of service, an internal complaint system (Article 20), and, for entities in scope, cooperation with trusted flaggers. n8n structures the intake, traceability, and deadlines — the legal qualification and moderation strategy remain human decisions, ideally reviewed with specialized counsel when drafting the statement-of-reasons template.

Going further

The Compliance & Audit Pack (€149) provides the conversational building block, the timestamped Supabase audit trail, and the automated follow-ups that make up most of this workflow — adapted to your own notice mechanism rather than a GDPR questionnaire. For sites juggling GDPR requests alongside a high-volume contact inbox, the Complete FlowKit Bundle (€269) bundles every FlowKit pack, Inbox AI included, so no notice gets lost in the daily flow of email.