Digital Services Act (DSA) and Digital Markets Act (DMA)
Two regulations aimed at platforms. The DSA regulates how platforms handle content and risk; the DMA regulates how the largest platforms compete. Both take a size-based approach: the bigger you are, the more you owe.
In one line
The DSA makes platforms accountable for illegal content, transparency and systemic risk; the DMA opens up gatekeepers — no self-preferencing, interoperability, and limits on combining personal data.
DSA — Regulation (EU) 2022/2065
| When | What |
|---|---|
| 2022-11-16 | entered into force |
| 2023-08-25 | obligations apply to designated VLOPs / VLOSEs (very large online platforms and search engines) |
| 2024-02-17 | applies to all other in-scope intermediary services |
Core duties:
- Notice and action, statement of reasons for moderation, internal complaint handling.
- Transparency of recommender systems (Article 27) — the main options used must be explained.
- Advertising: no targeted advertising to minors (Article 28); no advertising based on sensitive data.
- Systemic risk: VLOPs must run risk assessments, adopt mitigation measures, and undergo independent audits (Articles 34–35), with a crisis-response mechanism (Article 36).
- Researcher data access (Article 40).
- Penalties: up to 6% of total worldwide annual turnover.
DMA — Regulation (EU) 2022/1925
| When | What |
|---|---|
| 2022-11-01 | entered into force |
| 2024-03-07 | obligations became applicable; gatekeepers designated by the Commission |
Gatekeeper obligations include:
- No self-preferencing of own services; no anti-steering restrictions.
- Allow sideloading and alternative app stores.
- Messaging interoperability.
- No combining personal data across services without consent.
- FRAND access for business users.
- Penalties: Article 30 — up to 10% of total worldwide turnover in the preceding financial year; up to 20% for repeated infringement.
Overlap with the AI Act and the GDPR
- AI systems on platforms can trigger the AI Act's transparency duties, the DSA's content duties and the GDPR's data duties at once.
- The DMA's data-combination limits interact directly with GDPR consent.
Unverified / TODO
- List currently designated VLOPs/VLOSEs and gatekeepers with dates [gap:not_located] — designation decisions are separate official documents; the 2023-08-25 and 2024-03-07 dates are not in either regulation's text
- Summarise the DSA guidelines on recommender-system transparency
- Confirm the Article 30 repeat-infringement tier wording — Article 30(2): fines "up to 20 % of its total worldwide turnover", anchored below
Source quotes
Member States shall ensure that the maximum amount of fines that may be imposed for a failure to comply with an obligation laid down in this Regulation shall be 6 % of the annual worldwide turnover of the provider of intermediary services concerned in the preceding financial year.— DSA Article 52(3) — the 6 % ceiling in the DSA penalties article (snapshot:snapshots/eu/dsa.txt)This Regulation shall apply from 17 February 2024.— DSA Article 93(2) — the 2024-02-17 row of the timeline (snapshot:snapshots/eu/dsa.txt)the Commission may impose on a gatekeeper fines not exceeding 10 % of its total worldwide turnover in the preceding financial year— DMA Article 30(1) — the 10 % tier (snapshot:snapshots/eu/dma.txt)the Commission may impose on a gatekeeper fines up to 20 % of its total worldwide turnover in the preceding financial year where it finds that a gatekeeper has committed the same or a similar infringement— DMA Article 30(2) — the 20 % repeat-infringement tier the card's TODO asked to confirm (snapshot:snapshots/eu/dma.txt)It shall apply from 2 May 2023.— DMA Article 54 — the date the regulation applies from (snapshot:snapshots/eu/dma.txt)