The European Union’s Digital Services Act (DSA), a tough new piece of regulation that imposes new rules around content moderation and online advertising, is about to expand to cover huge swathes of the internet. Starting tomorrow, February 17th, the rules will apply to every online platform with users in the EU, in addition to the 19 Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) that have had to comply with the rules since last August.

The expansion means the DSA’s obligations will expand to cover thousands of online platforms. The Associated Press notes that this will include household names like eBay and OnlyFans, which didn’t hit the 45 million monthly active user threshold in the EU for VLOP status. Only small services with fewer than 50 employees and annual turnover of under €10 million (around $10.8 million) are exempt.

The DSA’s obligations include a ban on targeting underage users with ads based on their personal data, and targeting anyone based on sensitive data like sexual preferences or religious beliefs. When it comes to content moderation, sites will have to provide a reason to users when their content or account has been moderated, and offer them a way of complaining and challenging the decision. There are also rules around giving users the ability to flag illegal goods and services found on a platform.

“From tomorrow, the Digital Services Act rules apply to all online platforms accessed by users in the EU,” said the European Commission’s Margrethe Vestager. “Users, Member States and platforms can now use the tools under the DSA to shape a safer and more transparent online world.”

The 19 existing VLOPs and VLOSEs which currently have to comply with the regulation include the likes of Facebook, Instagram, X, Wikipedia, YouTube, and Google Search. In late December, the Commission added three more VLOPs to its list (Pornhub, XVideos, and Stripchat), which will have until April before they have to comply with the DSA’s strictest rules for big platforms (though they’ll have to comply with the broader general requirements as of tomorrow).

The DSA also includes rules for hosting services like cloud providers, which’ll be required to offer a way for people to notify them about the presence of illegal content on their service. Even intermediary services like internet service providers will have obligations like producing transparency reports.

Although the DSA is still a new piece of regulation, we’ve already seen the EU use it to open a formal investigation into X over, among other things, concerns it may have facilitated “the dissemination of illegal content in the context of Hamas’ terrorist attacks against Israel.” EU regulators have the ability to fine companies up to 6 percent of their worldwide annual turnover for breaking the DSA’s rules, and even block services as a last resort.

While this deadline has been a long time coming, there are concerns that EU member states aren’t ready to enforce the DSA’s rules more broadly. Earlier this week, Politico reported that only a third of EU countries have nominated their local regulators (named Digital Services Coordinators), who will be expected to handle user complaints and generally enforce the DSA in each member state.