DSA Privacy Madness for Solo Developers

What they voted for

The Digital Services Act (Regulation (EU) 2022/2065) is mostly about the giants: content moderation, very large platforms, algorithms. But tucked inside it are three short rules that land on everyone who sells an app.

• Article 30(1): the store must collect the seller's name, address, phone, email, a copy of their ID, their bank details, trade register details (if any) and a signed self-certification.
• Article 30(7): the store must show the name, address, phone and email to every user, "in a clear, easily accessible and comprehensible manner".
• Article 29: none of this applies to platforms that are micro or small enterprises.

Read those last two together. A tiny marketplace is protected from the paperwork. A tiny developer, working from the kitchen table, is not protected from strangers knowing where they live.

On Google Play, a personal developer account that charges anything, through a paid app or in-app purchases, displays "your full address". Apple, to its credit, accepts a P.O. box if you can prove it's yours.

"It's for accountability." Whose?

Accountability is a fair goal. Buyers should know who they're dealing with. So let's see who else has to publish where they sleep.

Accountability through verified identity is applied everywhere else. Only the smallest sellers get it through a published home address.

And notice the twist for a Spanish freelancer. Spain keeps your tax address confidential. The DSA takes that same address and requires it to be published worldwide. The only clean way out is to set up a company, and a company gets to publish an office address instead. Same business, same taxes, same verified identity. Different privacy.

The world's privacy sheriff

The EU is, rightly, the toughest privacy regulator on the planet:

• €1.2 billion for Meta in 2023 (Irish Data Protection Commission), over data transfers to the US.
• €50 million for Google from France's CNIL in 2019, and another €325 million in 2025.
• In 2018, GDPR forced domain registries to hide private owners' street, city, postcode and phone from public WHOIS.
• In 2022, the EU's top court closed public access to company-owner registers, calling it a "serious interference" with private life.
• In 2010, the same court struck down publishing the names of individual farm-subsidy recipients (Volker und Markus Schecke, C-92/09 and C-93/09), because targeted access would have done the job.

Same continent. Same kind of data. Opposite answer. Publishing a solo developer's home address sits awkwardly with the principles the EU applies to everyone else:

• Data minimisation (GDPR Article 5(1)(c)): letting buyers and authorities reach a seller doesn't require publishing a natural person's home address when the store already holds a verified one.
• Privacy by design and by default (GDPR Article 25): show as little personal data as possible. A home address on every listing is the opposite default.
• Private life and data protection (EU Charter Articles 7 and 8): any limit must be necessary and proportionate (Article 52(1)).

Honest footnote: this isn't illegal under GDPR as things stand, because GDPR allows processing that another law requires, and the DSA is that law. Whether the EU Court would strike down Article 30(7) the way it struck down public owner registers has never been tested. It's a serious argument, not a settled outcome.

They were warned

I found no public record that the negotiators ever debated the home-trader request and rejected it on the merits. It looks unaddressed rather than argued away. The fair way to put it: the people writing the law were told about the risk, and the law passed without a fix.

Why a public home address is a real risk

• It's permanent and global. A store listing can be read, scraped and archived by anyone, anywhere, long after the app is gone.
• It's easy to combine. Address plus legal name plus street imagery plus social media is a full profile of a household.
• Games attract hostility. Game developers have a long, well-documented history of harassment campaigns, doxxing and swatting included. A cheap, easy-to-share game raises your exposure.
• It protects buyers only in theory. Buyers already have the store's refund button and complaint process, and the store has the verified data for any authority. Nobody settles a refund on my doorstep. The published address adds one thing: a way to find the developer's front door.

And the kids?

A home address belongs to the whole household. Partners, children, elderly parents and flatmates never agreed to sell an app, never accepted the store's terms and get none of the benefit. EU law says children's data deserves extra protection (GDPR recital 38). Article 30 makes no allowance for households with children, for people at risk of harassment, or for anyone vulnerable.

Declining to publish the family home isn't "avoiding accountability". My identity, bank account and address are already verified by the store and available to any authority. Not broadcasting them is normal parental caution. It shouldn't cost me the right to earn a living.

Three bad options

For a solo developer who lives with family, the law leaves three doors:

1. Publish the address where your family sleeps.
2. Pay for a company and an office address, thousands of euros a year before you sell a single copy.
3. Stop charging for your work.

Here's what that looks like in Spain, roughly, in 2026:

I picked the last one. Every ARKD BOX game is now free: no price, no ads, no in-app purchases. Mummy Scape and Kick or Treat were going to cost €0.99. MoonBeat was going to be paid. Tabletop Racing Simulator was going to have paid add-ons and come to tablets; now it stays in the browser.

That's the real cost of this rule, multiplied across Europe: small paid releases are how solo developers test whether an idea is worth more time. Take that step away and people quit, or stay hobbyists forever. Not great for a Union that says it wants more European creators and startups.

Who voted for it

Every EPP, Renew and Greens MEP present voted yes, and all but one Socialist. Opposition came almost entirely from the far-right ID group, and their objections were about content moderation and free speech, not your privacy. So no, nobody in that room was fighting for you.

The people who held the pen

The text was drafted by the European Commission in December 2020, under Thierry Breton (Internal Market) and Margrethe Vestager (Digital). In Parliament, the internal market committee (IMCO) led the work:

Committees that gave formal opinions, through their lead MEPs: Henna Virkkunen (industry), Geoffroy Didier (legal affairs), Patrick Breyer (civil liberties), Mikuláš Peksa (economic affairs), Sabine Verheyen (culture), Jadwiga Wiśniewska (women's rights) and Roman Haider (transport). All voted yes except Haider.

Fun fact: Henna Virkkunen is now the Commission's Executive Vice-President for tech sovereignty, the portfolio that enforces the DSA. The 2027 review lands on her desk.

In Spain, 49 MEPs voted yes, from PSOE/PSC, PP, Ciudadanos, PNV, Podemos, IU, Anticapitalistas, EH Bildu, ERC, Catalunya en Comú and Junts. Left, right and everything in between.

The full list: 539 yes votes

Name, country, group, national party and official contact channels: the European Parliament email, the EP profile and, where one was found, X and LinkedIn. Built from the Parliament's official roll-call record and checked against HowTheyVote.eu.

Download the CSV

The fix is boring, which is why it would work

• Verified, not published. For sellers who are natural persons, the store collects and checks the address. Courts, regulators and consumer bodies get it on request. The public sees a name or trade name and a contact channel. That's how domain records have worked since 2018, and the sky hasn't fallen.
• Or an exception that mirrors Article 29 for micro sellers, which is exactly what EGDF and ISFE asked for in 2021.

When to make noise

• By 18 February 2027 the Commission must report on how the DSA affects small and medium-sized businesses (Article 91).
• By 17 November 2027 the full evaluation must explicitly cover "the scope of the obligations on small and micro enterprises".

Nobody has proposed changing Article 30 yet. The Commission's November 2025 review called the DSA "fit for purpose". So if you're a developer, a freelancer, or part of an association that represents them, those two reports are the window. Write in. Share this page. Make some noise.

Same accountability. No stalkers.

Sources

• Regulation (EU) 2022/2065, the Digital Services Act (Articles 29, 30, 91)
• European Parliament roll-call votes, 5 July 2022
• HowTheyVote.eu: Digital Services Act final vote
• EP Legislative Observatory, procedure 2020/0361(COD)
• EGDF and ISFE position paper on the DSA, March 2021
• Etsy on the DSA, June 2021
• EDPS Opinion 1/2021 on the DSA
• Android Authority: Google forcing developers to publish home addresses (2014)
• Google Play: developer information shown to users
• Apple: DSA trader requirements
• TechCrunch: Apple purges apps from the EU App Store (2025)
• eucrim: CJEU, WM and Sovim (C-37/20)
• EU Fundamental Rights Agency: Volker und Markus Schecke
• ICANN Temporary Specification (WHOIS and GDPR)
• Irish DPC: Meta €1.2bn · CNIL: Google €50m · CNIL: Google €325m
• Example MEP declaration of private interests
• Commission DSA review, November 2025
• EU Inc. proposal, March 2026
• Billeo: freelancer social security in Spain, 2026 · Ayuda T Pymes: cost of an SL · Infoautónomos: tax address

Not legal advice. Last checked 16 October 2026. Spotted a mistake? Tell me and I'll fix it.