European UnionDigital Markets Act (DMA), Regulation (EU) 2022/1925 (obligations of gatekeepers of core platform services)
In force since .
A transparency and process rule binding private bodies.
As of .
What it requires
- If you provide a core platform service and meet the thresholds in Article 3(2), notify the Commission without delay and in any event within 2 months after the thresholds are met, with the information identified in Article 3(2) for each core platform service that meets them (Article 3(3)).
- If the Commission designates you as a gatekeeper, comply with Articles 5, 6 and 7 for each core platform service listed in the designation decision within 6 months after it is listed, and ensure and demonstrate compliance with them (Article 3(10) and Article 8(1)).
- Do not combine or cross-use the personal data of end users across your core platform services or other services, or sign end users in to other services to combine it, unless the end user has been presented with the specific choice and has given consent within the meaning of Regulation (EU) 2016/679, and do not repeat a refused consent request for the same purpose more than once within one year (Article 5(2)).
- Do not prevent business users from offering the same products or services at different prices or conditions through other channels, and do not require end users or business users to use, offer or interoperate with your identification service, web browser engine or payment service (Article 5(3) and (7)).
- Allow and technically enable end users to easily un-install software applications on your operating system and to easily change the default settings of your operating system, virtual assistant and web browser, and allow and technically enable the installation and effective use of third-party software applications and software application stores that use or interoperate with your operating system (Article 6(3) and (4)).
- Do not treat your own services and products more favorably in ranking and related indexing and crawling than similar services or products of a third party, and apply transparent, fair and non-discriminatory conditions to the ranking (Article 6(5)).
- Give providers of services and of hardware, free of charge, effective interoperability with the same hardware and software features accessed or controlled via your operating system or virtual assistant that are available to your own services or hardware (Article 6(7)).
- Give end users effective portability of the data they provide or generate in using your core platform service, with free tools and continuous real-time access, and give business users, at their request and free of charge, effective, high-quality, continuous and real-time access to the data generated in the use of your core platform services (Article 6(9) and (10)).
- Apply fair, reasonable and non-discriminatory general conditions of access for business users to your software application stores, online search engines and online social networking services, and publish those conditions with an alternative dispute settlement mechanism (Article 6(12)).
- If you provide a number-independent interpersonal communications service listed in the designation decision, make its basic functionalities interoperable, on request and free of charge, with the services of another provider offering or intending to offer such services in the Union, preserve the level of security including end-to-end encryption, and publish a reference offer with the technical details and general terms and conditions (Article 7).
- Provide the Commission, within 6 months after designation and at least annually after that, with a report on the measures you have implemented to comply with Articles 5, 6 and 7, and publish a non-confidential summary of it (Article 11).
- Inform the Commission of any intended concentration where the merging entities or the target provide core platform services or other services in the digital sector or enable the collection of data, before the concentration is implemented, whether or not it is notifiable under merger rules (Article 14).
- Submit to the Commission, within 6 months after designation, an independently audited description of the techniques you apply for profiling of consumers, and publish an overview of it, updated at least annually (Article 15).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionYes
Penalty structure
Article 30(1) caps the fine for failing to comply with Articles 5, 6 and 7 at 10 % of total worldwide turnover in the preceding financial year, and Article 30(2) lifts the cap to 20 % for a repeat of the same or a similar infringement of the same core platform service within the 8 preceding years.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 10
Who enforces it
Enforcement body
The European Commission, which is the sole authority empowered to enforce the Regulation; Member States may empower their national competition authorities to investigate possible non-compliance.
What it reaches
Obligation class
Prohibition, Reporting, Disclosure, Data subject rights, Consent
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- provides a core platform service listed in Article 2, point (2), to business users established in the Union or end users established or located in the Union
- designated by the Commission as a gatekeeper pursuant to Article 3, which the Regulation presumes for a core platform service with at least 45 million monthly active end users established or located in the Union and at least 10 000 yearly active business users established in the Union; the duties attach to the core platform services listed in the designation decision
What this law does
The Digital Markets Act applies to core platform services that a gatekeeper provides to business users established in the Union or end users established or located in the Union, wherever the gatekeeper is established.
A core platform service is an online intermediation service, online search engine, online social networking service, video-sharing platform service, number-independent interpersonal communications service, operating system, web browser, virtual assistant or cloud computing service, or an online advertising service provided by an undertaking that provides one of those.
The Commission designates an undertaking as a gatekeeper if it has a significant impact on the internal market, provides a core platform service that is an important gateway for business users to reach end users, and enjoys an entrenched and durable position. An undertaking providing core platform services that meets all of the thresholds in Article 3(2) must notify the Commission without delay and in any event within 2 months after those thresholds are met.
The Commission designates an undertaking that meets all the thresholds in Article 3(2) without undue delay and at the latest within 45 working days after receiving the complete information. The gatekeeper must comply with Articles 5, 6 and 7 within 6 months after a core platform service has been listed in the designation decision.
Article 5 bars a gatekeeper from combining or cross-using an end user's personal data across its services, or signing end users in to other services to combine it, unless the end user has been presented with the specific choice and has given consent within the meaning of Regulation (EU) 2016/679. Article 5 also bars a gatekeeper from preventing business users from offering the same products or services through other channels at different prices or conditions.
Article 5 also bars a gatekeeper from requiring end users or business users to use, offer or interoperate with the gatekeeper's identification service, web browser engine or payment service. Article 6 requires a gatekeeper to allow end users to un-install software applications on its operating system, and to change the default settings of its operating system, virtual assistant and web browser.
Article 6 requires a gatekeeper to allow the installation and effective use of third-party software applications and software application stores that use or interoperate with its operating system. Article 6 bars a gatekeeper from treating its own services and products more favorably in ranking and related indexing and crawling than similar services or products of a third party.
Article 6 requires a gatekeeper to give providers of services and of hardware free-of-charge effective interoperability with the same hardware and software features accessed or controlled via its operating system or virtual assistant that are available to its own services or hardware. Article 6 requires a gatekeeper to give end users effective portability of the data they provide or generate, and to give business users access to the data generated in the use of its core platform services.
Article 6 requires a gatekeeper to apply fair, reasonable and non-discriminatory general conditions of access for business users to its software application stores, online search engines and online social networking services. Article 7 requires a gatekeeper that provides number-independent interpersonal communications services to make their basic functionalities interoperable, on request and free of charge, with those of another provider offering or intending to offer such services in the Union.
Article 7 requires the gatekeeper to publish a reference offer laying down the technical details and general terms and conditions of that interoperability. A gatekeeper must ensure and demonstrate compliance with Articles 5, 6 and 7. A gatekeeper must provide the Commission with a report on the measures it has implemented to comply with Articles 5, 6 and 7.
A gatekeeper must inform the Commission of any intended concentration where the merging entities or the target provide core platform services or other digital-sector services. A gatekeeper must submit an independently audited description of its consumer profiling techniques. The Commission may fine a gatekeeper that intentionally or negligently fails to comply with Articles 5, 6 and 7.
The ceiling on the fine is higher for a repeat of the same or a similar infringement in relation to the same core platform service within the 8 preceding years. The Commission may also impose periodic penalty payments to compel compliance. The Commission is the sole authority empowered to enforce the Regulation. Directive (EU) 2020/1828 applies to representative actions against gatekeeper infringements that harm the collective interests of consumers. The Regulation applies from .
When LexLint raises it
When your app profile says your app operates an app store, operates a social platform, provides cloud services or distributes a software product.