The increasing amount of user-generated content poses a challenge for communication policies. While illegal content is regulated in the Spanish legal system, harmful content is not. Among this latter category, disinformation stands out due to its potential systemic risk, given the negative effect it can have on the exercise of fundamental rights. The destabilising role of information disorders has led to the deployment of a co-regulatory model promoted by European institutions, mainly through the Digital Services Act and the Code of Best Practices on disinformation. This framework combines binding measures with more flexible self-regulatory measures. Major platforms are now obliged to be more transparent, to make a firm commitment against disinformation and to apply protocols for moderating harmful content. This entails a complex balance of regulation that also provides a space for the protection of freedom of information, thus responding to European values.