What changed, and why
Mastodon gGmbH's new Terms of Service for mastodon.social and mastodon.online took effect August 31, 2026. The company says the rewrite followed "multiple exchanges with the German Federal Network Agency (Bundesnetzagentur) regarding DSA compliance during the first half of 2026," and that those exchanges shaped both the document and "our overall approach to Trust & Safety" (Mastodon Blog). This is a small, mostly donor-funded nonprofit-adjacent operator, not a platform with 45 million EU users — and Germany's Digital Services Coordinator (DSC) spent months talking to it anyway.
The backstory matters. Mastodon's July 2025 terms drew community backlash for reading like corporate boilerplate, including a forced-arbitration clause, and for confusing users about whether the terms bound the whole fediverse or just Mastodon gGmbH's own two servers. The August 2026 version drops the arbitration language, clarifies scope, and adds explicit terms on content ownership and how federation rights work. Community feedback in Mastodon's own consultation thread was largely positive: commenters welcomed the arbitration clause's removal and called the IP terms clear (GitHub Discussion #36368).
A regulator that leads with conversation
The Bundesnetzagentur became Germany's central DSA enforcement body on May 14, 2024, gaining authority to fine platforms up to 6% of annual turnover for "regular and systematic" violations — but it explicitly does not rule on whether individual content is illegal or order takedowns itself (Bundesnetzagentur). Its 2024 activity report shows the agency received 824 complaints and opened just four formal administrative proceedings all year, while separately certifying a dispute-resolution body and a trusted flagger (Bundesnetzagentur). Against that backdrop, an extended back-and-forth with Mastodon over ToS language and moderation posture — rather than a formal proceeding or a fine — looks like the DSC's default mode: dialogue first, enforcement as backstop. Germany's implementing law establishes the DSC as an independent contact point precisely so this kind of engagement is legible to both the platform and Brussels (heise online).
The case for the regulator's involvement
The strongest argument for this kind of oversight isn't about content — it's about process. The DSA's baseline obligations (clear terms of service, a working notice-and-action mechanism, and a statement of reasons before removing content or suspending an account) apply to every hosting provider established in the EU, regardless of size, precisely because a confusing or missing ToS is itself something users can complain about to the DSC. Mastodon's own users had already flagged the July 2025 terms as opaque and hostile before the regulator ever got involved. A regulatory nudge that produces a clearer, community-vetted document — with no fine, no takedown order, no litigation — is arguably proportionate regulation working as intended: it improved user-facing transparency without the DSC dictating a single moderation decision.
Where the proportionality argument strains
The harder question is what this pattern means for the rest of the fediverse. Mastodon gGmbH had the resources to retain outside counsel (decoded.legal) and run a monthslong dialogue with a national regulator on top of a public consultation. That produced a genuinely better document for two servers. But the DSA's baseline duties — Article 16 notice-and-action mechanisms and Article 17 statements of reasons — apply just as much to the thousands of single-admin Mastodon and Pleroma instances that make up the actual decentralized network, almost none of which have in-house legal support or the standing to get a regulator on a call. Mastodon gGmbH has also flagged that dedicated DSA "Service Rules" and formal DSA information aren't landing until December 2026 — meaning even the flagship instances are mid-compliance, four months past today's deadline for the underlying regulation's baseline obligations. If sustained regulatory engagement becomes a de facto requirement for credible DSA compliance, the practical effect favors well-capitalized instances and pushes smaller ones toward joining large servers or exiting EU-facing federation altogether — the opposite of what a fediverse built on distributed, low-cost self-hosting is supposed to enable.
The proportionate path
None of this argues for abandoning baseline transparency rules; Mastodon's own users wanted a clearer ToS, and they got one. The better response is for the DSC to formalize what it did informally here — template language, a small-provider compliance pathway, or the kind of plain-language guidance it already issues for consumers — so that the next instance admin doesn't need decoded.legal on retainer to meet the same bar Mastodon gGmbH just cleared.