if you recall what a value object / DTO is (i assume you do know what this pattern is used for), then you'll probably find different scenarios and aspects in which you want to think about using DTOs. One possible aspect is security, another one would be performance, decoupling a third.
so my point is: you can use DTOs wherever you need them, in the service-layer as well in the web layer.
and my real point is: don't use them unless you have a very good reason to do so. unmotivated DTOs is an anti-pattern.