Big tech regulation in the EU runs on two laws: the Digital Markets Act sets competition duties for designated gatekeepers, and the Digital Services Act sets risk and transparency duties for online platforms. The European Commission leads enforcement, with fines tied to global turnover.
Both laws sit inside the wider field explained in what is technology policy. This guide takes the mechanics first, then the EU and US contrast, then the practical decisions for companies and users.
Why the EU wrote two separate laws
The Commission published the legislative proposals for both laws on 15 December 2020, as the EDRi document pool records, and the EU adopted them in July 2022, according to the German Marshall Fund overview. The split follows the two problems being addressed.
The Digital Markets Act (DMA) regulates gatekeepers, which are large online platforms that control access to digital markets. The Digital Services Act (DSA) regulates online intermediaries and platforms such as marketplaces, social networks and content-sharing platforms. One law targets market power. The other targets how platforms manage content and systemic risk.
The DMA is an ex ante framework, so its duties apply up front rather than after a finished dispute. It does not replace existing competition law, which means antitrust enforcement stays available alongside it. A firm can therefore face the gatekeeper rulebook and ordinary competition scrutiny at the same time.
How the Digital Markets Act works
The DMA operates in three stages: a company is designated, it must follow conduct duties, and the Commission enforces them with penalties. Knowing which stage applies to a business is the quickest way to see what the law asks of it.
Designation as a gatekeeper
The thresholds combine financial size and reach. According to GMF, companies with a market capitalization of at least €75 billion and an annual turnover of €7.5 billion may be designated. The user-based tests are at least 45 million monthly active EU users, more than 10,000 active EU business users per year, and core platform services in at least three EU countries.
Because the tests count EU users and EU business users, they reach firms wherever they are headquartered. In the same overview, which dates from October 2025, seven companies are designated: Alphabet, Amazon, Apple, ByteDance, Meta, Microsoft and Booking.
Conduct duties
Gatekeepers may not rank their own services above those of their rivals, which is the self-preferencing ban. They must also let users uninstall pre-installed apps, change default settings and sideload apps. The ranking rule matters most where a gatekeeper both runs a platform and competes on it. The user-choice rules turn device and app settings into compliance surfaces.
Enforcement and penalties
The Commission enforces the DMA through a joint team from DG COMP and DG CONNECT, with support from national competition authorities. It can fine companies up to 10% of global annual revenue, rising to 20% for repeat offences. These figures are ceilings on what the Commission can impose, not typical penalties, so they are better read as a signal of how seriously repeated non-compliance is treated than as a budget line.
How the Digital Services Act works
The DSA is a duty-of-care regime for platforms, with obligations that grow with a service’s reach. Its heaviest rules fall on very large online platforms (VLOPs) and very large online search engines (VLOSEs). To qualify, a service must have at least 45 million monthly active EU users, according to GMF. AlgorithmWatch reports that over 20 platforms had been formally designated by the Commission, on a page updated on 5 March 2026.
The core obligations are practical rather than abstract:
- Systemic risk assessment. VLOPs and VLOSEs must formally assess how their products, including algorithmic systems, create systemic risks.
- Advertising limits. The DSA bans targeting advertisements to children.
- Transparency reporting. Platforms must produce annual reports on their content moderation efforts.
Supervision depends on size. The Commission has direct supervision and enforcement powers over VLOPs and VLOSEs and can impose fines of up to 6% of their global turnover. Small firms are treated differently: GMF notes that companies with fewer than 50 employees and a turnover or balance sheet total of €10 million or less are generally exempt from most DSA obligations. The sensible first question for any service is therefore whether it falls under that exemption or crosses the very-large threshold.
The two laws side by side
| Law | Who it covers | Main duties | Maximum fine | Lead enforcer | Planning use |
|---|---|---|---|---|---|
| Digital Markets Act | Gatekeepers: large platforms controlling access to digital markets | No self-preferencing; user choice to uninstall, change defaults and sideload | Up to 10% of global annual revenue; up to 20% for repeat offences | Commission, via DG COMP and DG CONNECT, with national competition authorities | Check designation status first, then review ranking logic and default settings |
| Digital Services Act | Online intermediaries and platforms; the heaviest rules apply from 45 million monthly active EU users | Systemic risk assessment, no targeted ads to children, annual moderation reports | Up to 6% of global turnover | Commission for the largest platforms | Confirm size category, then build risk assessment and reporting routines |
Figures come from the German Marshall Fund overview for the DMA and from AlgorithmWatch for the DSA fine and supervision.
EU and US approaches compared
The EU approach is to write designation thresholds and fixed duties into statute, then enforce them centrally with fines scaled to global revenue. GMF also links this to the Brussels effect, the idea that EU regulations can set global standards. For a multinational, that means EU duties can shape product decisions well beyond Europe.
The US stance toward these rules is, in the available evidence, political and commercial rather than a parallel statute. GMF reports that Trump cited digital regulation as designed to harm, or discriminate against, American technology. It also says that enforcement and the future of the DMA and the DSA served as an irritant in recent US-EU trade talks.
The practical consequence is that enforcement against large US-based firms now intersects with trade diplomacy. Compliance planning should rest on the legal text and the Commission’s designations, not on a guess about how the trade dispute resolves. Network-access rules are a separate question again, covered in Net Neutrality Explained: What It Is, Why It Matters, And How It Affects Your Internet Access (2026) – Technopolicy.
What the rules mean for companies and users
The right response depends on which side of each law a business sits on. These decision points cover the main cases:
- Possible gatekeepers. Test the company against the designation thresholds before redesigning anything. If designated, treat ranking and default settings as legal surfaces that engineering and legal must review together.
- Very large platforms. Make the systemic risk assessment a standing process that covers recommender and other algorithmic systems, and align it with the yearly moderation reporting cycle.
- Smaller services. Check the DSA exemption conditions before assuming full obligations apply. A firm that is under the small-enterprise limits is generally exempt from most duties.
- Firms covered by both laws. A company that is both a gatekeeper and a very large platform could face both regimes, so keep one coordinated owner for EU compliance rather than two separate teams.
- Rivals and challengers. The self-preferencing ban and user-choice duties are what open room for competitors, so product teams in rival businesses should track which gatekeeper settings change.
For users, the visible effects are choice and protection: control over pre-installed apps and defaults on gatekeeper services, and no advertising targeted at children on platforms covered by the DSA. Adjacent fields are being shaped in parallel. For a very different frontier, see quantum computing policy.
Frequently asked questions
When did the Digital Services Act start applying?
According to AlgorithmWatch, the law became effective in February 2024, and certain rules had applied to the largest platforms since August 2023.
Who supervises smaller services under the DSA?
Each EU member state has a Digital Services Coordinator to supervise smaller services, while the Commission supervises the largest platforms and search engines directly, as AlgorithmWatch explains.
Does the DSA make platforms monitor all user content?
No. The law reinforces an EU-wide ban on general content monitoring, per AlgorithmWatch, so its duties centre on risk assessment, transparency and reporting.
