Operates an app store, in the European Union

Regulation (EU) 2019/1020, Article 7(2) · Read the law's page

• It reaches you if you are an information society service provider (a provider of a service as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535) and a product is or was offered for sale online through your services, as on an online marketplace: when a market surveillance authority asks you to, in a specific case, cooperate with it to facilitate any action to eliminate or, if that is not possible, to mitigate the risks the product presents.

Regulation (EU) 2022/1925 · Read the law's page

• If you provide a core platform service and meet the thresholds in Article 3(2), notify the Commission without delay and in any event within 2 months after the thresholds are met, with the information identified in Article 3(2) for each core platform service that meets them (Article 3(3)).
• If the Commission designates you as a gatekeeper, comply with Articles 5, 6 and 7 for each core platform service listed in the designation decision within 6 months after it is listed, and ensure and demonstrate compliance with them (Article 3(10) and Article 8(1)).
• Do not combine or cross-use the personal data of end users across your core platform services or other services, or sign end users in to other services to combine it, unless the end user has been presented with the specific choice and has given consent within the meaning of Regulation (EU) 2016/679, and do not repeat a refused consent request for the same purpose more than once within one year (Article 5(2)).
• Do not prevent business users from offering the same products or services at different prices or conditions through other channels, and do not require end users or business users to use, offer or interoperate with your identification service, web browser engine or payment service (Article 5(3) and (7)).
• Allow and technically enable end users to easily un-install software applications on your operating system and to easily change the default settings of your operating system, virtual assistant and web browser, and allow and technically enable the installation and effective use of third-party software applications and software application stores that use or interoperate with your operating system (Article 6(3) and (4)).
• Do not treat your own services and products more favorably in ranking and related indexing and crawling than similar services or products of a third party, and apply transparent, fair and non-discriminatory conditions to the ranking (Article 6(5)).
• Give providers of services and of hardware, free of charge, effective interoperability with the same hardware and software features accessed or controlled via your operating system or virtual assistant that are available to your own services or hardware (Article 6(7)).
• Give end users effective portability of the data they provide or generate in using your core platform service, with free tools and continuous real-time access, and give business users, at their request and free of charge, effective, high-quality, continuous and real-time access to the data generated in the use of your core platform services (Article 6(9) and (10)).
• Apply fair, reasonable and non-discriminatory general conditions of access for business users to your software application stores, online search engines and online social networking services, and publish those conditions with an alternative dispute settlement mechanism (Article 6(12)).
• If you provide a number-independent interpersonal communications service listed in the designation decision, make its basic functionalities interoperable, on request and free of charge, with the services of another provider offering or intending to offer such services in the Union, preserve the level of security including end-to-end encryption, and publish a reference offer with the technical details and general terms and conditions (Article 7).
• Provide the Commission, within 6 months after designation and at least annually after that, with a report on the measures you have implemented to comply with Articles 5, 6 and 7, and publish a non-confidential summary of it (Article 11).
• Inform the Commission of any intended concentration where the merging entities or the target provide core platform services or other services in the digital sector or enable the collection of data, before the concentration is implemented, whether or not it is notifiable under merger rules (Article 14).
• Submit to the Commission, within 6 months after designation, an independently audited description of the techniques you apply for profiling of consumers, and publish an overview of it, updated at least annually (Article 15).

Regulation (EU) 2022/2065, Arts. 30-32 · Read the law's page

• If you provide an online platform allowing consumers to conclude distance contracts with traders and qualify as a micro or small enterprise as defined in Recommendation 2003/361/EC, Section 4 of Chapter III (Articles 29 to 32) does not apply to you, and that exclusion continues for 12 months after you lose the status unless you are a very large online platform. If the Commission designates you a very large online platform, the Section applies to you whether or not you are a micro or small enterprise.
• Ensure that traders can only use your platform to promote messages on or to offer products or services to consumers located in the Union if, before they use your services for those purposes, you have obtained, where applicable to the trader: its name, address, telephone number and email address; a copy of its identification document or other electronic identification as defined by Article 3 of Regulation (EU) No 910/2014; its payment account details; its trade register and registration number, where it is registered in a trade register or similar public register; and a self-certification committing to offer only products or services that comply with the applicable rules of Union law.
• Before allowing the trader to use your services, make best efforts to assess whether that information is reliable and complete, through any freely accessible official online database or online interface made available by a Member State or the Union, or through requests to the trader for supporting documents from reliable sources. For traders already using your services for those purposes on 17 February 2024, make best efforts to obtain the information within 12 months and suspend your services to any trader that has not provided all of it by then, until it has.
• If you obtain sufficient indications or have reason to believe that any of that information is inaccurate, incomplete or not up-to-date, request that the trader remedy the situation without delay or within the period set by Union and national law, and if the trader fails to correct or complete it, swiftly suspend your service to that trader in relation to the offering of products or services to consumers located in the Union until the request has been fully complied with.
• Store the information obtained in a secure manner for six months after the end of the contractual relationship with the trader, then delete it. Disclose it to third parties only where required by the applicable law, including orders under Article 10 and orders issued by Member States' competent authorities or the Commission for the performance of their tasks under the Regulation.
• Make the trader's name, address, telephone number and email address, trade register details and self-certification available on your online platform to recipients of the service in a clear, easily accessible and comprehensible manner, at least on the online interface where the information on the product or service is presented.
• Design and organise your online interface so that traders can comply with their obligations on pre-contractual information, compliance and product safety information under Union law, including by providing the name, address, telephone number and email address of the economic operator, the information needed to identify the products or services promoted or offered to consumers in the Union, any sign identifying the trader such as a trademark, symbol or logo, and, where applicable, the labelling and marking information required by Union rules on product safety and product compliance.
• Make best efforts to assess whether traders have provided that information before allowing them to offer products or services on your platform. After allowing them, make reasonable efforts to check randomly, in any official, freely accessible and machine-readable online database or online interface, whether the products or services offered have been identified as illegal.
• If you become aware, irrespective of the means used, that a trader has offered an illegal product or service to consumers located in the Union through your services, inform, insofar as you have their contact details, the consumers who purchased it through your services of the fact that it is illegal, the identity of the trader and any relevant means of redress. Limit this to purchases made within the six months preceding the moment you became aware of the illegality.
• If you do not have the contact details of all the consumers concerned, make publicly available and easily accessible on your online interface the information concerning the illegal product or service, the identity of the trader and any relevant means of redress.

Regulation (EU) 2024/1781, Article 35 · Read the law's page

• It reaches you if you provide an online marketplace, an intermediary service whose online interface allows customers to conclude distance contracts with economic operators for the sale of products covered by delegated acts adopted pursuant to Article 4: comply with Articles 11 and 30 of Regulation (EU) 2022/2065 for the purposes of the Regulation.
• At the request of a market surveillance authority and in specific cases, cooperate with it to facilitate any action taken to eliminate or, if that is not possible, to mitigate the non-compliance of a product that is or was offered for sale online through your services.
• If a market surveillance authority orders you, in accordance with Article 9 of Regulation (EU) 2022/2065, to act against one or more specific items of content referring to a product covered by a relevant delegated act that does not comply, including by removing them, act on the order. That content is illegal content within the meaning of Article 3, point (h), of that Regulation.
• Establish a single contact point for direct communication with Member States' market surveillance authorities in relation to compliance with the Regulation. It may be the same contact point as the one under Article 22(1) of Regulation (EU) 2023/988 or Article 11(1) of Regulation (EU) 2022/2065.

Regulation (EU) 2023/988, Article 22 · Read the law's page

• It reaches you if you provide an online marketplace, an intermediary service whose online interface lets consumers conclude distance contracts with traders for the sale of products: designate a single point of contact for direct electronic communication with Member States' market surveillance authorities on product safety issues, register with the Safety Gate Portal, and indicate your contact point there.
• Designate a single point of contact that lets consumers communicate directly and rapidly with you on product safety issues.
• Have internal processes for product safety in place so that you comply without undue delay with the Regulation's requirements, including mechanisms through which traders provide the manufacturer or responsible person information and their self-certification that they will offer only products that comply with the Regulation, with the identification information Article 30(1) of Regulation (EU) 2022/2065 requires where applicable.
• Take the necessary measures to receive and process an order from a market surveillance authority to remove content referring to an offer of a dangerous product from your online interface, to disable access to it or to display an explicit warning. Act without undue delay and in any event within two working days from receipt of the order, and tell the issuing authority by electronic means, using the contact details published in the Safety Gate Portal, what effect you gave it.
• Where an order so requires, remove, disable access to or warn on all identical content referring to an offer of the dangerous product for the period the order prescribes. The search is limited to the information the order identifies and needs no independent assessment of the content, provided the search and removal can be done proportionately by reliable automated tools.
• Take into account the regular information on dangerous products that market surveillance authorities notify through the Safety Gate Portal when you apply voluntary measures to detect, identify, remove or disable access to offers of dangerous products, using the Portal's interoperable interface where applicable. Tell the authority that notified you what action you took.
• For the purpose of compliance with Article 31(3) of Regulation (EU) 2022/2065 as regards product safety, use at least the Safety Gate Portal.
• Process each notice about a product safety issue that you receive under Article 16 of Regulation (EU) 2022/2065 without undue delay and in any event within three working days from receipt.
• Design and organize your online interface so that traders offering a product can provide, and consumers can see or easily reach on the product listing, for each product: the manufacturer's name, registered trade name or trade mark and its postal and electronic address; where the manufacturer is not established in the Union, the name, postal and electronic address of the responsible person; information identifying the product, including a picture, its type and any other product identifier; and any warning or safety information to be affixed on or to accompany the product, in a language consumers can easily understand.
• Suspend, for a reasonable period of time and after a prior warning, the provision of your services to traders that frequently offer products which do not comply with the Regulation.
• Notify directly and without undue delay all affected consumers that can be identified when a product they bought through your interface is subject to a safety recall or safety warning of which you have actual knowledge, and publish information on product safety recalls on your online interfaces.
• Cooperate with market surveillance authorities, traders and relevant economic operators on any action to eliminate or mitigate the risks of a product offered through your services: inform the relevant economic operator of a decision to remove or disable access to an offer of a dangerous product, cooperate in effective recalls without obstructing them, and cooperate on accidents notified to you.
• Immediately inform, through the Safety Business Gateway, the market surveillance authorities of the Member States where the product has been made available about dangerous products offered on your interfaces of which you have actual knowledge, giving the details of the risk, the quantity by Member State of products still circulating if available, and any corrective measure taken to your knowledge. Notify through the Safety Business Gateway, without undue delay, any accident you have been informed of that resulted in a serious risk or actual damage to a consumer's health or safety caused by a product made available on your marketplace, and inform the manufacturer.
• Cooperate with law enforcement agencies at Union and national level, including the European Anti-Fraud Office, through regular and structured exchange of information on offers you removed under Article 22. Allow market surveillance authorities access to your interfaces for their online tools to identify dangerous products, and respond to their data requests to help identify the supply chain of dangerous products where the information is not publicly available.
• Where you or online sellers have put in place technical obstacles to extracting data from your online interfaces, allow data scraping on a reasoned request of the market surveillance authorities, only for product safety purposes and on the identification parameters they provide.

Regulation (EU) 2024/1028, Article 6 · Read the law's page

• It reaches you if you provide an online short-term rental platform, an online platform within the meaning of Article 3, point (i), of Regulation (EU) 2022/2065 that allows guests to conclude distance contracts with hosts for the provision of short-term accommodation rental services, and you offer services to hosts providing those services in the Union, wherever you are established: when a competent authority issues an order under Article 6(3) or (6) requesting you to remove, or to disable access to, a listing relating to a unit, do so without undue delay.
• When a competent authority issues an order under Article 6(4) requesting you to provide further information so that it can verify the authenticity and validity of a registration number, provide that information. If the order requests you to remove, or to disable access to, a listing relating to the unit, do so without undue delay.
• Where a registration procedure applies and national law enables a competent authority to order you to provide requested information and to remove listings concerning units offered without a registration number or with an invalid registration number, or in cases involving the misuse of a registration number, comply with that order.

Regulation (EU) 2024/1028, Arts. 7-8 · Read the law's page

• It reaches you if you provide an online short-term rental platform, an online platform within the meaning of Article 3, point (i), of Regulation (EU) 2022/2065 that allows guests to conclude distance contracts with hosts for the provision of short-term accommodation rental services, and you offer services to hosts providing those services in the Union, wherever you are established: design and organize your online interface so that hosts must self-declare whether the unit is located in an area where a registration procedure has been established or applies.
• Where a host declares that its unit is in such an area, design and organize your online interface so that users can identify the unit through a registration number. Ensure that the host has provided a registration number before you allow the offering of the services for that unit, and that the host displays the number clearly as part of its listing.
• On receiving a host's self-declaration, and before you allow the host to use your services, make best efforts, using the lists Member States make available under Article 13(1), point (a), to assess whether the self-declaration is complete, where the assessment can be carried out proportionately by automated tools.
• After you allow a host to offer the services, make reasonable efforts to check at random, on a regular basis, the hosts' declarations about whether a registration procedure exists and, where one does, the validity of the registration number provided, using the functionalities of the single digital entry points.
• Inform the competent authorities and the hosts, without undue delay, of the results of those random checks concerning incorrect declarations of hosts, the misuse of a registration number or invalid registration numbers.
• Inform hosts adequately of the applicability in a given area of registration procedures, taking into consideration the lists Member States make available under Article 13 and the information in Annex I to Regulation (EU) 2018/1724.

COM(2026) 681 final · Read the law's page

• A provider of an online social networking service or video-sharing platform service would have to stop a person below the age of 15 from creating an account or using one, where the service poses a risk to the privacy, safety or security of a minor below that age; the proposal defines that risk by listed features, such as live streaming to an indeterminate audience, contact with people outside a user's existing connections, or a recommender system based on profiling.
• A provider that lets a guardian set up a limited account for a minor above 13 and below 15 would have to keep the tools for guardians always activated, let the guardian set a daily time limit of no more than one hour, and let the guardian pre-approve new contacts and cap the number of contacts.
• Within six months after the Regulation applies, a provider would have to establish whether holders of existing accounts are below 15, and disable the accounts of those established to be below 15 or whose age cannot be established.
• A provider bound by the minimum age would have to verify age exclusively through an EU age verification solution using an EU proof of age attestation, provided by a third party and certified under the EU Age Verification Scheme.
• A provider of an online social networking service, video-sharing platform service, online game, AI companion, general conversational chatbot or software application store would have to ensure a high level of privacy, safety and security of minors and design its service by default to the Chapter III requirements, departing from them only after establishing through age assurance that the user is an adult.
• A provider of a software application store would have to put in place an age-rating system for each application it offers, and would have to stop minors from accessing or buying applications that are inappropriate for their age under that system.
• A provider of an operating system that has obtained a user's age signal would have to enable sharing of that signal with in-scope providers, after obtaining the user's consent, when they need it to comply.
• A provider of an AI companion or general conversational chatbot would have to put in place proportionate and effective measures to protect minors, including enabling access for minors below 13 only through the tools for guardians.
• A provider using age assurance would have to use a solution that does not identify, locate, track or profile the person, and would have to process no more personal data than strictly necessary to assess whether the age threshold is met.
• A provider of an online social networking service or video-sharing platform service that is a designated very large online platform would have to notify the Commission of a compliance plan within four months of its designation, or within 30 days after the Regulation applies if already designated, and have the plan audited by independent auditors at its own expense.
• A provider would have to refrain from any behaviour, contractual, commercial or technical, that undermines compliance, and from using behavioural techniques or interface design to do so.

Directive (EU) 2024/2853 · Read the law's page

• The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
• If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
• Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
• If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
• Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
• Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).

Regulation (EU) 2024/1183, amending Regulation (EU) No 910/2014 (eIDAS) · Read the law's page

• This Regulation binds member states first, from 24 December 2026: under Article 5a(1) each member state must provide at least one European Digital Identity Wallet to its citizens, residents and businesses within 24 months of the entry into force of the implementing acts under Article 5a(23) and Article 5c(6), and those acts entered into force on 24 December 2024; the wallet-acceptance duties below rest on wallets provided under this Regulation.
• If you provide a very large online platform and require users to authenticate to access your service, also accept and facilitate the use of European Digital Identity Wallets for that authentication, only at the user's voluntary request and for the minimum data the service needs.
• If you are a private service, other than a microenterprise or small enterprise, that law or contract requires to use strong user authentication for online identification, also accept European Digital Identity Wallets, only at the user's voluntary request, no later than 36 months after the Commission's implementing acts entered into force, which is by 24 December 2027.
• If you need proof of age, you may accept a wallet attestation of attributes that includes age, qualified or non qualified; wallets must allow selective disclosure of data, so a user need not share more than the attribute you ask for.

Regulation (EU) 2025/2509, Article 14 · Read the law's page

• This duty takes effect on 1 August 2030 (Article 59, which applies the Regulation from that date). It reaches you if you provide an online marketplace, as defined in Article 3, point (14), of Regulation (EU) 2023/988, on which toys are sold or promoted: treat information referring to an offer of toys that are not in conformity with the Regulation as illegal content for the purposes of Regulation (EU) 2022/2065, subject to the measures established in that Regulation.
• Comply with the requirements of Articles 30 to 32 of Regulation (EU) 2022/2065 and Article 22 of Regulation (EU) 2023/988 for toys. Compliance is enforced within the enforcement structures set out in those Regulations.
• Design and organize your online interface, for the purposes of Article 31(2), point (c), of Regulation (EU) 2022/2065 and in addition to the information Article 22(9) of Regulation (EU) 2023/988 requires, so that economic operators can provide the CE marking referred to in Article 18(1), any warning to be clearly visible to the consumer before purchase in accordance with Article 6(3), and the data carrier or weblink through which the digital product passport is accessible.
• Treat a toy that does not comply with the particular safety requirements, or that complies with them but poses a risk to the health and safety of children or other persons, as a dangerous product for the purposes of compliance with Article 22 of Regulation (EU) 2023/988.