By Daniel de Almeida Afonso · Last updated: October 7, 2026
The Digital Markets Act (DMA) is the EU law that sets rules for the largest digital platforms, called gatekeepers. Since it began to apply in May 2023, the European Commission has designated seven gatekeepers, fined three of them, and opened a review that now points toward cloud and AI. This guide explains what the law requires, who it covers, how the privacy and consent rules work in practice, and what has been enforced so far.
What is the Digital Markets Act?
The DMA is Regulation (EU) 2022/1925. Its goal is to keep digital markets fair and contestable. In plain terms, it limits what the biggest platforms can do with their market power, so smaller rivals and new entrants have a real chance to compete.
The key dates are short:
- 14 September 2022: the Regulation was adopted.
- 1 November 2022: it entered into force.
- 2 May 2023: it became applicable.
- 6 September 2023: the Commission designated the first gatekeepers.
The Commission enforces the DMA directly. National regulators do not issue DMA fines. The official hub for decisions and guidance is the Commission's Digital Markets Act site.
Why the EU introduced it
Competition law normally acts after the harm is done, and digital cases can take years. By then, network effects may already have locked in the winner. The DMA is "ex ante" regulation: it sets the rules up front, so a gatekeeper has to follow them from the moment it is designated, without waiting for a case to be proven against it.
The Commission's concerns were practical. A handful of platforms controlled how businesses reach customers. They could set terms unilaterally, favour their own services, and make it costly for users to switch. Small and mid-sized firms had the least bargaining power. The DMA also applies to any company that meets the criteria, wherever it is headquartered, as long as it serves users in the EU.
Who is a gatekeeper?
A gatekeeper is a company that provides a "core platform service" and meets three tests. It has a significant impact on the EU internal market. It operates a service that is an important gateway between businesses and consumers. It holds an entrenched and durable position.
The law presumes a company meets these tests if it passes quantitative thresholds in Article 3(2):
- Size: annual EU turnover of at least €7.5 billion in each of the last three financial years, or a market capitalisation (or equivalent fair market value) of at least €75 billion in the last financial year. In both cases the company must provide the same core platform service in at least three EU Member States.
- Reach: at least 45 million monthly active end users in the EU and at least 10,000 yearly active business users in the EU.
- Durability: the user thresholds were met in each of the last three financial years.
A company that meets the thresholds must notify the Commission. It can argue that, exceptionally, it still does not meet the three tests, and the Commission decides within 45 working days. The Commission can also designate a company that falls short of the numbers after a market investigation.
Core platform services include online intermediation services, search engines, social networks, video-sharing platforms, messaging services, operating systems, web browsers, virtual assistants, cloud computing, and online advertising services.
Which companies are designated gatekeepers in 2026?
Seven companies hold gatekeeper status, according to the Commission's gatekeeper list:
- Alphabet: Google Search, Google Play, Google Maps, Google Shopping, YouTube, Chrome, Android and its advertising service.
- Amazon: its Marketplace and Amazon Advertising.
- Apple: the App Store, iOS, Safari and iPadOS (added in April 2024).
- ByteDance: TikTok.
- Meta: Facebook, Instagram, WhatsApp, Messenger and Meta Ads.
- Microsoft: Windows PC OS and LinkedIn.
- Booking: Booking.com (designated in May 2024).
The Commission lists 23 designated core platform services in total. Facebook Marketplace was removed in April 2025, after Meta showed it fell below the business-user threshold.
Two designation decisions are still open. In November 2025, the Commission opened market investigations into whether Amazon Web Services and Microsoft Azure should be designated for cloud computing. On 25 June 2026, it told both companies it had reached a preliminary position that they should be. Sources disagree on when final decisions will land, and we could not confirm a final decision as of this update.
What gatekeepers must and must not do
The DMA works as a list of dos and don'ts, set out in Articles 5, 6 and 7. The lists apply per core platform service, and some Article 6 obligations can be further specified by the Commission.
Gatekeepers must:
- Give business users free, effective, high-quality, continuous and real-time access to the data their own activity generates (Article 6(10)). Personal data is included only where the end user has opted in.
- Give end users free and effective portability of their data, including continuous real-time access (Article 6(9)).
- Give advertisers and publishers the tools and information to verify ad performance.
- Let business users promote offers and contract with customers outside the platform (Article 5(4)).
- Let users uninstall pre-installed apps, change default settings and see choice screens for browsers, search engines and virtual assistants (Article 6(3)).
- Allow third-party apps and app stores to be installed and used, subject to strictly necessary and proportionate security measures (Article 6(4)).
- Give rival search engines access to ranking, query, click and view data on fair, reasonable and non-discriminatory terms, with personal data anonymised (Article 6(11)).
Gatekeepers must not:
- Rank their own products above similar third-party offers, in ranking and related indexing and crawling (self-preferencing, Article 6(5)).
- Stop business users from linking to or steering customers toward other channels (anti-steering, Article 5(4)).
- Require users to use one of the gatekeeper's services to access another (tying, Article 5(7) and 5(8)).
- Combine or cross-use personal data across services without valid consent (Article 5(2)).
Gatekeepers must also tell the Commission about planned acquisitions in the digital sector (Article 14). This is an information duty, not a merger veto.
Messaging interoperability
Article 7 applies to number-independent messaging services, which in practice means WhatsApp and Messenger. On request and free of charge, a gatekeeper must let rival services connect to its basic functions while keeping the existing level of security, including end-to-end encryption. The duties phase in. One-to-one messaging and file sharing come first. Group messaging follows within two years of designation, and voice and video calls within four years.
What compliance looks like for a gatekeeper
Within six months of designation, a gatekeeper must submit a compliance report describing how it meets each obligation, and it must update the report every year. The Commission can then open non-compliance proceedings, ask for information, run inspections and require interim measures.
The privacy and consent rules in the DMA
The DMA overlaps with data protection law in one place that matters to privacy teams. Article 5(2) restricts how a gatekeeper uses personal data from its core platform services.
Without valid consent, a gatekeeper may not:
- Process end users' data from third-party sites that use its services in order to serve targeted ads.
- Combine personal data from one core platform service with data from another service, or from a third party.
- Cross-use personal data between its services.
- Sign users in to other services in order to combine data.
The consent standard is the GDPR definition. That means consent must be freely given, specific, informed and unambiguous. If a user refuses, the gatekeeper cannot keep asking. It may repeat the request no more than once a year.
This is why the DMA matters for consent design. The Commission treats a binary "agree or pay" prompt as a possible failure of free consent. For the GDPR side of the same debate, see our guide on consent-or-pay models under the GDPR. The DMA and the GDPR run in parallel. A DMA decision does not replace a data protection authority's own assessment.
What has been enforced so far
The Commission has moved from designation to fines. The decisions below are the ones we could verify against Commission sources.
| Date | Company | Finding | Fine |
|---|---|---|---|
| 23 April 2025 | Apple | Anti-steering breach in the App Store | €500 million |
| 23 April 2025 | Meta | "Consent or pay" model breached Article 5(2) | €200 million |
| 23 July 2026 | Alphabet | Self-preferencing in Google Search, and anti-steering on Google Play | €890 million (€460m and €430m) |
The Meta decision is the one most relevant to consent. The Commission found that Meta's November 2023 model did not offer a service that uses less personal data but is otherwise equivalent. Meta later changed its model. Since January 2026, EU users can choose between full personalised ads and a "less personalised" option. The Commission acknowledged the change and said it will monitor results. The threat of periodic penalty payments remains available, and consumer groups argue the new model still falls short.
In the Google decision, the Commission ordered Google to bring both infringements to an end.
Not every large fine against a big tech company is a DMA fine. Competition cases under Articles 101 and 102 of the Treaty, and GDPR fines from data protection authorities, are separate procedures. When you read a headline, check which law was used.
How big can the penalties be?
The DMA sets three levels of financial consequence:
- Fines of up to 10% of total worldwide annual turnover.
- Fines of up to 20% for repeated infringements of the same kind.
- Periodic penalty payments of up to 5% of average daily worldwide turnover, to force compliance.
For systematic non-compliance, the Commission can also impose behavioural or structural remedies. The law defines this as at least three non-compliance decisions against the same gatekeeper within eight years, after a market investigation. Structural remedies can include requiring a business to be sold or separated. The actual 2025 and 2026 fines sit well below the 10% ceiling, so the ceiling is best read as a limit and not a prediction. For comparison with the GDPR's own penalty tiers, see GDPR fines and penalties explained.
The first DMA review: fit for purpose, with AI and cloud next
The law required the Commission to review the DMA by 3 May 2026. The review report, published in late April 2026, concluded that the DMA is delivering results but has not reached its full potential. It found it too early for legislative changes and proposed targeted procedural improvements instead.
Three points stand out:
- Cloud computing is a priority, with the AWS and Azure investigations as the test case.
- AI services were not added as a new category. The Commission is looking at how existing rules apply, and has opened two specification proceedings with Alphabet on AI interoperability and search data sharing.
- Coordination with other EU laws is flagged as an area to improve.
If you track the wider EU rulebook, our explainer on the EU Digital Omnibus and Article 88a covers a related change affecting cookie consent.
DMA vs DSA: what is the difference?
The Digital Services Act (DSA) and the DMA are often mentioned together because they were proposed as a package. They address different problems.
| Digital Markets Act | Digital Services Act | |
|---|---|---|
| Main aim | Fair, contestable markets | Safer online environment |
| Who it covers | Designated gatekeepers | Online intermediaries, with extra duties for very large platforms |
| Main topics | Self-preferencing, data use, interoperability | Illegal content, transparency, user protection |
| Max fine | 10% of worldwide turnover (20% if repeated) | 6% of worldwide turnover |
The DSA is not a competition law. It deals with illegal content, platform transparency and user safety. Our guide to the EU Digital Services Act covers it in full.
What the DMA means for your business
Most businesses are not gatekeepers, so most do not have DMA compliance duties. The law targets a short list of very large platforms. If you are a small or mid-sized company in the EU or elsewhere, you are not directly regulated.
You may still feel the effects. If you rely on a gatekeeper's platforms, three things can change:
- Distribution: app developers can steer users to other purchase channels and, in some cases, use other app stores.
- Data and advertising: gatekeepers must give advertisers and publishers more information, and limit data combination without consent.
- Search and marketplaces: ranking rules aim to stop gatekeepers favouring their own services over yours.
Three practical steps follow for a business that depends on gatekeeper platforms:
- List your dependencies. Note which gatekeeper services you rely on for sales, ads, app distribution or customer data.
- Use the data you are entitled to. If you are a business user, ask for the data access and ad-verification information the DMA requires, and check what you can export.
- Review your channels. Where anti-steering rules now allow it, test whether you can tell customers about direct purchase options.
For consumers, the practical results are more choice screens, easier uninstalling of pre-installed apps, and clearer consent prompts when a gatekeeper wants to combine data across services.
For privacy teams, the lesson is on the consent side. Regulators now look at how a choice is presented, not only whether a box was ticked. That same scrutiny applies to ordinary cookie banners. Our piece on cookie banner dark patterns shows what regulators flag.
Frequently asked questions
What is the Digital Markets Act in simple terms?
It is an EU law that sets rules for the largest digital platforms so smaller companies can compete and users get more choice. It applies only to companies the European Commission designates as gatekeepers.
Which companies are gatekeepers under the DMA?
Alphabet, Amazon, Apple, ByteDance, Meta, Microsoft and Booking, covering 23 core platform services. Cloud designations for AWS and Azure were at the preliminary stage as of this update.
Does the DMA apply to small businesses?
No. It regulates gatekeepers, not small or mid-sized companies. Small businesses are mostly affected as customers or business users of gatekeeper platforms.
How much can a DMA fine be?
Up to 10% of worldwide annual turnover, or 20% for repeat infringements. Periodic penalty payments can reach 5% of average daily turnover. Actual fines so far have been in the hundreds of millions of euros.
How does the DMA relate to the GDPR?
The DMA requires GDPR-standard consent before a gatekeeper combines personal data across its services. The two laws apply side by side, and enforcement runs through different bodies.
Can gatekeepers charge for DMA features?
Not for the core data duties. Business user data access, end user data portability and interoperability under Article 7 must be provided free of charge. Other obligations, such as app store access, have their own conditions, and the Commission decides case by case whether a fee structure complies.
Does the DMA apply to companies outside the EU?
Yes, if a company meets the gatekeeper criteria and provides core platform services to users in the EU. Headquarters location does not matter.
Is the DMA being changed?
Not substantially. The Commission's first review, published in April 2026, found the DMA fit for purpose and proposed procedural improvements. Cloud and AI are the main areas to watch.
Sources and notes
We checked designations, dates and fines against the Commission's DMA site and press materials. Cloud designation timing and the final outcome of the Meta compliance review were still developing when we updated this article. Check the Commission's DMA site for the latest decisions.
