In September and October 2022 respectively, the European Union adopted two new regulations to govern digital platforms: the Digital Markets Act (“DMA”)[1] and the Digital Services Act (“DSA”).[2] Together, they form the Digital Services Act package.

The DSA, which came into force on 25 August 2023, concerns online intermediary service providers (hosts, providers and online platforms) and “contribute to the proper functioning of the internal market for intermediary services by setting out harmonised rules for a safe, predictable and trusted online environment that facilitates innovation and in which fundamental rights enshrined in the Charter, including the principle of consumer protection, are effectively protected”.[3]

The DMA, which came into force on 2 May 2023, concerns gatekeepers as well as their core platform services, and aims to “contribute to the proper functioning of the internal market by laying down harmonised rules ensuring for all businesses, contestable and fair markets in the digital sector across the Union where gatekeepers are present, to the benefit of business users and end users”.[4]

The latter provides a framework for a priori control of digital platforms, complementing the a posteriori framework provided by competition law, by creating the status of “gatekeeper” (I) to which are attached new obligations and prohibitions (II) that fall under the authority of the European Commission (III). These new restrictions materialize the objectives of protecting users and promoting a more balanced competition between companies in the digital market.

I. The European Commission defined the list of “gatekeepers” subject to the Digital Markets Act with the objective of revitalizing competition to the benefit of consumers

The DMA is applicable to “core platform services” when they are provided or offered by “gatekeepers” to business users or end users established or located in the European Union, irrespective of the place of establishment or residence of the gatekeepers and irrespective of the law otherwise applicable to the provision of service.[5]

Listed among “digital services”, “core platform services” have a certain number of features that can be leveraged by the companies providing them, such as severe economies of scale or very important network effects.

The DMA does not provide for a general definition of these services but rather provides for a list of services that may be considered as such, i.e.: online intermediation services, online search engines, online social networking services, video-sharing platform services, number-independent interpersonal communications services, operating systems, web browsers, virtual assistants, cloud computing services and online advertising services.[6] This list may evolve as a result of a legislative proposal from the European Commission to add or remove some of these services, presented to the European Parliament and the Council following a market investigation[7] carried out on its own initiative or at the request of three or more Member States.[8]

“Gatekeepers” are companies providing one or more of the said core platform services,[9] but also meeting several cumulative conditions, namely:

• Having a significant impact on the internal market: (i) provide the same core platform service in at least three Member States of the European Union and (ii) achieve an annual Union turnover of at least 7,5 billion euros in each of the last three financial years or an average market capitalization or its equivalent fair market value in the last financial yearof at least 75 billion euros;
• Providing a core platform service which is an important gateway for business users to reach end users: provide a core platform service that in the last financial year has at least 45 million monthly active end users established or located in the Union and at least 10 000 yearly active business users established in the Union;
• Enjoying an entrenched and durable position in its operations or enjoying such a position in the near future, which means meeting both above conditions in each of the last three financial years.[10]

The aim of the DMA is therefore to enable a more balanced competition between digital platforms and other players on the digital market as well as end-users, since gatekeepers, who effectively are the biggest players on the digital market, are likely to hold a dominant position on this market. In fine, the European Commission seeks to limit users’ dependence on core platform services provided by gatekeepers[11].

In order to enable the European Commission to designate gatekeepers, the DMA requires companies that meet the above conditions (i) to notify the Commission without delay and in any case within a maximum of two months of meeting these conditions and to provide the Commission with the relevant information in this regard and (ii) to notify the Commission of new core platform services that meet the last two above conditions within a maximum of two months of meeting them.[12]

The European Commission then has a maximum of 45 working days from the date the relevant information is sent to designate the companies identified as gatekeepers.[13] It should be noted that, when there is no voluntary designation, the Commission can also carry out a market investigation on its own initiative or at the request of three or more Member States,[14] in order to check whether a company should be considered as a gatekeeper or whether core platform services should be added to the designation decision of a gatekeeper.[15] It is then possible that the Commission designates a company that meets the above-mentioned conditions but does not meet each of the thresholds based on other considerations defined in the DMA (for example, size, number of business users or network and scale effects it benefits from).[16]

In compliance with these rules, on 6 September 2023 the European Commission published the list of companies meeting the conditions for gatekeepers. The list includes 6 gatekeepers (Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft) as well as 22 core platform services, including social networks (Facebook, LinkedIn, TikTok, Instagram), instant messaging (WhatsApp, Messenger), web browsers (Apple Safari, Google Chrome), as well as operating systems (Google Android, iOS, Windows PC OS) or online shopping platforms (Google Shopping, Amazon Marketplace, Meta Marketplace).[17]

The list of gatekeepers and core platform services must be reviewed by the Commission at least every three years, it being specified that any designation decision may be amended or repealed at any moment by the Commission, upon request or on its own initiative, in the event of substantial changes or incomplete, incorrect, or misleading information.[18]

II. “Gatekeepers” defined by the European Commission have six months from their designation to comply with their new obligations under the Digital Markets Act

From the date of their designation by the European Commission, gatekeepers have six months, in this case until March 2024, to comply with the obligations set out in Articles 5, 6, 7 and 15 of the DMA,[19] and provide the Commission with a report describing the measures developed to ensure compliance with the obligations set out in Articles 5, 6 and 7 of the DMA, which they must then update at least once a year.[20]

They must also immediately inform the European Commission of any proposed mergers and acquisitions involving companies that provide core platform services, services in the digital sector or enable the collection of data,[21] and introduce a compliance function responsible mainly for organizing, monitoring, and supervising the DMA’s application.[22]

Gatekeepers may, in exceptional cases and under certain conditions, be suspended by the European Commission from complying with some of these obligations and prohibitions when they demonstrate that they would endanger the economic viability of their operations in the European Union,[23] or be exempted for grounds of public health or public security.[24]

Conversely, depending on new market practices, the European Commission may, on its own initiative or at the request of three or more Member States,[25] open a market investigation to complement the obligations laid down in the DMA in order to address these new practices effectively.[26]

III. The Commission may exercise its powers of investigation, control and sanction against gatekeepers

In order to carry out its tasks, and in particular to monitor and ensure compliance by gatekeepers with their obligations under the DMA, the European Commission has extensive powers, such as investigative powers (e.g., requests for information, interviews, taking of statements and company inspections),[27] monitoring powers (e.g., access to documents implementing the obligations and appointment of independent experts or auditors),[28] and above all powers to impose sanctions on gatekeepers in case of non-compliance with their obligations.

As part of its power to impose sanctions, the Commission may, within five years of the date on which the infringement was committed or ceased,[29] impose fines of up to 10% of total worldwide turnover in the previous financial year and, in the event of a repeat offence within eight years of the first sanction decision, up to 20% of total worldwide turnover in the previous financial year or, under certain conditions, fines of up to 1% of total worldwide turnover in the previous financial year.[30]

Moreover, the Commission may, within the same time limit, impose periodic penalty payments of up to 5% of average worldwide daily turnover recorded over the previous financial year to compel offending companies to comply with the measures, decisions and injunctions taken by the Commission.[31]

Appeals may be brought before the Court of Justice of the European Union, which may then cancel, reduce or increase the fine or periodic penalty payment imposed.[32]

The Commission may also impose behavioral or structural remedies where it finds, following a market investigation initiated on its own initiative or at the request of one or more Member States,[33] that a gatekeeper has demonstrated systematic non-compliance, i.e. that it has been subject to at least three sanction decisions for non-compliance with the obligations set out in Articles 5, 6 and 7 of the DMA over an eight-year period and that it has maintained, strengthened or extended its gatekeeper position.[34]