European Digital Law: Online Platforms, Digital Markets, and Digital Services

European Digital Law: Online Platforms, Digital Markets, and Digital Services

1. Introduction: The Emergence of a European Digital Legal Framework

Digital technologies have transformed the way individuals communicate, obtain information, purchase goods, conduct business, access public services, and participate in economic and social life. Online platforms have become essential intermediaries between consumers, traders, service providers, advertisers, publishers, and public institutions. Search engines influence access to information; social networks shape public communication; online marketplaces facilitate commercial transactions; app stores determine how software reaches users; and cloud services increasingly support the infrastructure of modern businesses.

These developments have created legal questions that traditional regulatory frameworks were not designed to address fully. A platform may simultaneously act as an intermediary, an advertising service, a marketplace operator, a data controller, and a competitor to the businesses using its infrastructure. Its contractual conditions and technological design may influence commercial opportunities, access to information, consumer choice, privacy, and freedom of expression.

The European Union has responded by developing a comprehensive framework of digital regulation. Rather than relying on a single legislative instrument, EU digital law consists of several interconnected regimes addressing different dimensions of the digital economy.

Two regulations occupy a central position:

• Regulation (EU) 2022/2065, the Digital Services Act (DSA), establishes responsibilities and accountability requirements for providers of intermediary services and online platforms.
• Regulation (EU) 2022/1925, the Digital Markets Act (DMA), regulates certain large digital platforms designated as gatekeepers, seeking to make digital markets fairer and more contestable.

These instruments operate alongside the General Data Protection Regulation (GDPR), the e-Commerce Directive, the Platform-to-Business Regulation, the Data Act, consumer protection legislation, and the Artificial Intelligence Act.

The distinction between the DSA and DMA is fundamental. The DSA primarily concerns the responsibilities of digital intermediaries towards users, society, and public authorities. The DMA addresses the structural economic power of designated gatekeepers and the conditions under which businesses and consumers access digital markets.

Together, they establish a legal framework intended to preserve the functioning of the internal market while protecting fundamental rights, promoting competition, and increasing accountability in the digital environment.

2. Treaty Foundations and Regulatory Competence

EU digital regulation is principally based on the Union’s internal market competence.

Article 26 of the Treaty on the Functioning of the European Union (TFEU) provides the foundation for the establishment and functioning of the internal market. Article 114 TFEU authorises the adoption of measures approximating national laws where necessary for the establishment and functioning of that market.

Digital services are frequently supplied across national borders. A platform established in one Member State may provide services to users throughout the Union, while its infrastructure, employees, advertisers, customers, and business partners may be located in several different jurisdictions.

Without harmonised rules, providers could face substantially different national requirements concerning intermediary liability, content moderation, advertising transparency, consumer protection, and commercial relationships. Such fragmentation could increase compliance costs and create obstacles to cross-border services.

The EU therefore uses regulations to establish directly applicable rules across Member States. The DSA and DMA are particularly important examples of this approach.

The regulatory framework must also respect the fundamental rights protected by the EU Charter of Fundamental Rights. Relevant provisions include:

• Article 7: respect for private and family life.
• Article 8: protection of personal data.
• Article 11: freedom of expression and information.
• Article 16: freedom to conduct a business.
• Article 21: non-discrimination.
• Article 24: rights of the child.
• Article 47: right to an effective remedy and a fair trial.

Digital regulation consequently involves a balance between several legitimate interests. Measures against illegal content must not unnecessarily restrict lawful expression. Commercial regulation must protect users without imposing disproportionate burdens on businesses. Data-driven innovation must operate consistently with privacy and data protection requirements.

The Charter does not automatically apply to every private relationship involving technology. Under Article 51, its provisions bind EU institutions and bodies and apply to Member States when they are implementing or otherwise acting within the scope of EU law. Nevertheless, EU legislation regulating private digital services is required to respect the fundamental rights framework.

3. The Historical Framework: The E-Commerce Directive

Before the adoption of the DSA, the principal European instrument governing online intermediary services was Directive 2000/31/EC, commonly known as the E-Commerce Directive.

The Directive established important principles concerning the cross-border provision of information society services, electronic commerce, commercial communications, electronic contracts, and intermediary liability.

Its intermediary liability regime distinguished between three categories of activity.

Mere conduit. Article 12 addresses the transmission of information through a communication network or the provision of access to such a network. A provider may benefit from an exemption from liability where it does not initiate the transmission, select its recipient, or select or modify the transmitted information.

Caching. Article 13 concerns the automatic, intermediate, and temporary storage of information for the purpose of making its onward transmission more efficient. The exemption depends on compliance with the statutory conditions.

Hosting. Article 14 concerns the storage of information supplied by a recipient of the service. A hosting provider may benefit from an exemption where it lacks the relevant knowledge of illegal activity or information and, upon obtaining the required knowledge or awareness, acts expeditiously to remove or disable access to it.

Article 15 prohibits Member States from imposing a general obligation on intermediary providers to monitor information they transmit or store or actively to seek facts indicating illegal activity.

These provisions helped establish the principle that an intermediary should not automatically be treated as the publisher or author of every item of third-party content passing through its systems.

The DSA preserves and develops this liability architecture. It does not simply abolish the earlier regime. Instead, it introduces a broader set of due-diligence obligations, transparency requirements, procedural safeguards, and supervisory mechanisms.

The E-Commerce Directive therefore remains relevant, although substantial parts of its intermediary liability framework have been replaced or updated by the DSA. Its other provisions continue to operate where they have not been superseded.

Official text: Directive 2000/31/EC — E-Commerce Directive.

4. The Digital Services Act: Scope and Objectives

Regulation (EU) 2022/2065, the Digital Services Act, establishes a harmonised framework for intermediary services in the European Union.

It entered into force on 16 November 2022. Its provisions began applying to designated very large online platforms and search engines in 2023, while the general application date for the Regulation was 17 February 2024.

The DSA applies to intermediary services offered to recipients whose place of establishment or location is in the Union, irrespective of where the provider itself is established. Its territorial reach therefore extends beyond companies incorporated in EU Member States.

The Regulation covers several categories of intermediary service:

• Mere conduit services, such as certain internet access and transmission services.
• Caching services.
• Hosting services.
• Online platforms, which are hosting services that store and disseminate information to the public at a recipient’s request.
• Online marketplaces, social networks, content-sharing platforms, app stores, and certain online travel and accommodation services.

An online search engine is also subject to specific provisions under the DSA.

The Regulation recognises that intermediary services differ significantly in their functions and potential impact. Consequently, obligations are graduated according to the nature of the service, its size, and the risks associated with its operation.

Micro and small enterprises benefit from exemptions from certain additional obligations imposed on online platforms. However, the DSA is not a general exemption from all regulatory responsibilities for smaller businesses. Certain obligations, including the basic intermediary framework and relevant hosting duties, remain applicable.

The principal objectives of the DSA include:

1. Improving the handling of illegal content, goods, and services online.
2. Increasing transparency in content moderation and platform operations.
3. Protecting users against certain manipulative and misleading practices.
4. Improving the traceability of traders operating through online marketplaces.
5. Protecting minors and other vulnerable users.
6. Strengthening accountability for very large platforms and search engines.
7. Preserving fundamental rights, including freedom of expression and access to information.

The DSA is not a general prohibition on controversial or harmful speech. Its legal framework distinguishes between illegal content, which is determined by applicable Union or national law, and content that may be undesirable or contrary to a platform’s contractual rules but is not necessarily unlawful.

This distinction is essential because the Regulation establishes procedural obligations for platforms without transferring the general responsibility for determining the legality of every item of information to private companies.

5. Intermediary Liability and the Principle of Conditional Exemption

One of the most important features of the DSA is its approach to intermediary liability.

Articles 4, 5, and 6 maintain conditional exemptions for mere conduit, caching, and hosting activities. These exemptions limit the circumstances in which providers can be held liable for information supplied by recipients of their services.

For hosting providers, the exemption depends on the absence of the relevant knowledge or awareness of illegal content and the provider’s response after acquiring such knowledge.

The exemption is not unconditional immunity. It does not prevent a judicial or administrative authority from ordering a provider to terminate or prevent an infringement. Nor does it protect a provider from liability for its own unlawful conduct merely because it operates an intermediary service.

Article 7 further clarifies that providers do not automatically lose the benefit of the liability exemptions merely because they undertake voluntary investigations or other good-faith measures to detect, identify, and remove illegal content.

Article 8 preserves the prohibition on imposing general monitoring obligations.

This is particularly significant for social networks and hosting platforms. The DSA does not require every platform to examine every communication or publication in advance. Instead, it establishes specific procedures for addressing information reported as potentially illegal and imposes additional obligations on platforms according to their functions and scale.

The distinction between intermediary activity and the provider’s own conduct remains important. A marketplace that merely hosts third-party listings may be treated differently from a trader that directly sells goods through its own website. Similarly, the legal assessment of a platform’s own advertising, contractual representations, or commercial practices may differ from the assessment of third-party material stored on its service.

6. Notice-and-Action Mechanisms and Content Moderation

The DSA introduces a structured system through which users and other interested parties can notify hosting providers of allegedly illegal content.

Under Article 16, hosting providers must establish accessible and user-friendly mechanisms allowing individuals or entities to submit notices concerning specific items of information they consider illegal.

An effective notice should contain sufficient information to allow the provider to identify the material concerned and understand the reasons why it is alleged to be illegal. The system must allow the submission of notices by electronic means and should be designed to facilitate accurate and sufficiently substantiated reports.

A sufficiently precise notice may give rise to actual knowledge or awareness for the purposes of the hosting liability exemption, depending on the circumstances.

The provider must process notices in a timely, diligent, non-arbitrary, and objective manner. It must inform the notifying person of its decision and explain the available redress mechanisms.

The DSA also introduces the concept of trusted flaggers.

Under Article 22, trusted flaggers are entities designated by national Digital Services Coordinators because they possess particular expertise and competence in identifying and notifying illegal content. They must act independently from online platform providers and demonstrate diligence, accuracy, and objectivity.

Notices submitted by trusted flaggers within their designated areas of expertise must receive priority treatment.

Trusted flaggers do not acquire the authority to determine conclusively whether content is illegal. They submit notices that platforms must process under the Regulation. The responsibility for the provider’s decision remains with the provider, subject to applicable law and available review mechanisms.

The distinction protects the procedural structure of the system. It also reduces the risk that private reporting organisations will be treated as authorities empowered to issue binding legal determinations.

7. Transparency, Reasons, and User Redress

Content moderation decisions can affect freedom of expression, access to information, and the commercial interests of individuals and businesses.

The DSA therefore requires platforms to provide meaningful information about certain decisions affecting user content and accounts.

Under Article 17, hosting providers must supply a clear and specific statement of reasons when they impose certain restrictions because information supplied by a recipient is considered illegal or incompatible with their terms and conditions.

Relevant decisions may include:

• Restrictions on the visibility of information.
• Removal or disabling of access to content.
• Suspension or termination of a service, account, or other facility.
• Restrictions on monetisation.
• Other measures affecting the recipient’s ability to use the service.

The statement of reasons should identify the nature of the restriction, the relevant factual circumstances, and, where appropriate, the legal or contractual basis for the decision. It should also explain available redress possibilities.

Article 20 requires online platforms, subject to the Regulation’s scope and exemptions, to provide an internal complaint-handling system. Recipients must be able to challenge certain moderation decisions for at least six months after the decision.

Article 21 provides for access to certified out-of-court dispute settlement bodies. These bodies can examine disputes concerning platform decisions, although their role does not eliminate the possibility of judicial proceedings.

The DSA also establishes transparency obligations concerning the number and nature of content moderation activities and the operation of complaint mechanisms.

The legal importance of these provisions extends beyond individual disputes. They seek to make platform governance more predictable and reviewable, reducing the possibility that users will be subjected to unexplained or arbitrary restrictions.

8. Online Marketplaces and Trader Traceability

Online marketplaces allow consumers to purchase goods and services from traders operating in different countries. They also create particular enforcement difficulties where sellers use false identities, disappear after transactions, or offer unsafe or unlawful products.

The DSA addresses this problem through additional obligations imposed on online platforms that allow consumers to conclude distance contracts with traders.

Article 30 requires covered marketplaces to obtain and make reasonable efforts to assess certain information concerning traders before allowing them to offer products or services to consumers through the platform.

This information includes identification and contact details, relevant payment account information, trade register details where applicable, and a self-certification by the trader concerning its intention to offer only products or services complying with applicable Union law.

Platforms must make reasonable efforts to assess the reliability and completeness of the information and provide mechanisms through which traders can update it.

Article 31 imposes requirements concerning the design and organisation of online interfaces to enable traders to comply with relevant pre-contractual information obligations and provide necessary product or service information.

Article 32 addresses situations in which a platform becomes aware that an illegal product or service has been offered to consumers through its service. Where the conditions of the provision are met, the platform must inform affected consumers about the relevant illegality and available redress possibilities.

These provisions complement rather than replace consumer protection law.

For example, the Consumer Rights Directive, the Sale of Goods Directive, and the General Product Safety Regulation continue to determine important aspects of trader obligations and product safety. The DSA adds platform-specific duties designed to improve traceability, cooperation, and transparency.

The legal distinction is important: the fact that a transaction takes place through an online marketplace does not automatically make the marketplace the seller. The allocation of responsibility depends on the actual commercial arrangement and the applicable legislation.

9. Advertising, Recommender Systems, and Platform Design

Online platforms frequently finance their services through advertising and use automated systems to determine which content users see.

These systems can influence purchasing decisions, access to information, political communication, and patterns of online behaviour. The DSA therefore establishes specific transparency and design obligations.

Advertising transparency

Under Article 26, online platforms must ensure that recipients can identify advertisements clearly and understand that the information is advertising.

Users must be provided with information identifying the person on whose behalf the advertisement is presented and, where different, the person paying for it. They must also receive meaningful information about the main parameters used to determine why the advertisement is displayed to them.

Article 26 prohibits online platforms from presenting advertisements based on profiling using special categories of personal data within the meaning of Article 9(1) GDPR.

Article 28 introduces additional protection for minors. Online platforms accessible to minors must not present advertisements based on profiling using personal data of the recipient where the platform knows with reasonable certainty that the recipient is a minor.

These provisions operate alongside the GDPR and other applicable advertising rules.

Recommender systems

Recommendation systems determine how content is selected and presented to users. They may rely on browsing history, previous interactions, location, preferences, and other signals.

Under Article 27, online platforms must explain in their terms and conditions the main parameters used in their recommender systems, including the criteria that are most significant in determining the information presented to recipients.

Where a platform offers several recommendation options, users must be able to select and modify their preferred options.

Very large online platforms and search engines are subject to an additional requirement: under Article 38, they must provide at least one recommender-system option that is not based on profiling.

The aim is to provide users with greater understanding and control over the mechanisms that shape their online experience.

Dark patterns

Article 25 prohibits online platforms from designing, organising, or operating their online interfaces in ways that deceive or manipulate recipients or otherwise materially distort or impair their ability to make free and informed decisions.

The prohibition addresses certain manipulative interface practices, commonly described as dark patterns.

Examples may include making it unnecessarily difficult to reject an optional choice, presenting misleading interface elements, or structuring a decision process in a way that undermines a user’s ability to make a genuine choice.

The provision does not prohibit every persuasive design technique or every commercially motivated interface. Its application depends on whether the design falls within the legal test established by the Regulation.

Other EU instruments, particularly the GDPR and consumer protection legislation, may also apply to the same interface. The legal assessment must therefore consider the specific conduct and the rights affected.

10. Very Large Online Platforms and Search Engines

The DSA recognises that the scale of a digital service may create risks that are not adequately addressed by ordinary intermediary obligations.

A platform with tens of millions of users may influence public communication, commercial behaviour, information distribution, and the circulation of illegal material on a scale that smaller services cannot match.

Under Article 33, the Commission may designate an online platform or search engine as a very large online platform (VLOP) or very large online search engine (VLOSE) where it has at least 45 million average monthly active recipients in the Union.

The threshold corresponds to approximately 10% of the EU population.

The designation is based on the relevant user figures and the applicable legal procedure. Once designated, the service becomes subject to additional obligations.

Systemic risk assessments

Article 34 requires VLOPs and VLOSEs to identify, analyse, and assess systemic risks arising from the design, functioning, and use of their services.

The Regulation identifies several categories of risk, including:

• Dissemination of illegal content.
• Actual or foreseeable negative effects on fundamental rights.
• Negative effects on civic discourse, electoral processes, and public security.
• Risks relating to public health and the protection of minors.
• Serious negative consequences for physical and mental well-being.
• Gender-based violence and other significant societal harms.

The assessment must consider the role of recommender systems, advertising systems, content moderation practices, and other relevant technological and organisational features.

The obligation is not a guarantee that harmful content will never appear. It requires a structured and documented assessment of risks and the adoption of appropriate mitigation measures.

Risk mitigation

Article 35 requires designated services to adopt reasonable, proportionate, and effective mitigation measures.

These may include changes to service design, terms and conditions, moderation procedures, recommender systems, advertising systems, and internal risk-management processes.

The measures must be assessed in light of their potential impact on fundamental rights.

A platform cannot simply claim that a particular measure improves safety without considering whether it disproportionately interferes with lawful expression, privacy, or other protected interests.

Independent audits and data access

Under Article 37, VLOPs and VLOSEs must undergo independent audits at least annually to assess compliance with the relevant obligations.

They must also prepare and publish reports concerning the audits and their responses to identified recommendations.

Article 40 establishes mechanisms for access to certain platform data by regulators and, subject to statutory conditions, vetted researchers conducting research that contributes to the detection, identification, and understanding of systemic risks in the Union.

These provisions are intended to make platform accountability more than a matter of voluntary corporate reporting.

11. Enforcement of the Digital Services Act

The DSA establishes a supervisory structure involving national authorities and the European Commission.

Each Member State must designate a Digital Services Coordinator (DSC), responsible for coordinating national implementation and enforcement.

The DSC may investigate matters within its competence, request information, supervise compliance, and exercise the powers granted by the Regulation and applicable national law.

The European Board for Digital Services supports cooperation and consistency between national coordinators.

The European Commission has direct supervisory and enforcement powers concerning VLOPs and VLOSEs. It can request information, conduct investigations, carry out inspections, and adopt interim measures where the statutory conditions are satisfied.

The Commission may impose fines of up to 6% of the provider’s total worldwide annual turnover for certain infringements of the DSA. Periodic penalty payments may also be imposed to compel compliance.

The national enforcement framework is particularly relevant in Bulgaria. On 1 October 2026, the Commission announced an additional letter of formal notice concerning Bulgaria’s implementation of the DSA. It identified continuing concerns about the designation and empowerment of national authorities and aspects of the national sanctioning framework. This illustrates that the effectiveness of a directly applicable EU regulation also depends on Member States establishing the supervisory arrangements required by the Regulation.

The DSA does not create an unlimited power for public authorities to regulate online expression. Enforcement must remain within the Regulation’s legal framework, respect procedural rights, and comply with the Charter.

12. The Digital Markets Act: Regulating Gatekeeper Power

Where the DSA focuses on intermediary responsibilities and the safety and accountability of digital services, the Digital Markets Act addresses a different problem: the structural power of major digital platforms.

Certain platforms occupy positions between businesses and consumers that make them difficult to bypass. They may control access to app distribution, online search, social networking, advertising, operating systems, or other essential digital services.

Their economic position can allow them to impose conditions on business users, restrict access to customers, favour their own services, or make it difficult for competitors to enter the market.

Traditional competition law remains essential for addressing anti-competitive conduct. However, conventional enforcement generally requires a detailed assessment of particular markets and conduct, which may be lengthy and technically complex.

The DMA introduces a complementary framework based on predefined obligations and prohibitions for designated gatekeepers.

Its principal objective is to make digital markets more contestable and fair.

Official legislation: Regulation (EU) 2022/1925 — Digital Markets Act.

13. Gatekeepers and Core Platform Services

The DMA does not apply to every large technology company. It applies to undertakings designated as gatekeepers in relation to specified core platform services.

Article 2 identifies core platform services, including:

• Online intermediation services.
• Online search engines.
• Online social networking services.
• Video-sharing platform services.
• Number-independent interpersonal communications services.
• Operating systems.
• Web browsers.
• Virtual assistants.
• Cloud computing services.
• Online advertising services.

The designation process is principally based on Article 3.

An undertaking is presumed to satisfy the quantitative criteria where:

1. It achieves annual Union turnover of at least €7.5 billion in each of the last three financial years, or has an average market capitalisation or equivalent fair market value of at least €75 billion in the last financial year.
2. It provides the same core platform service in at least three Member States.
3. The service has at least 45 million monthly active end users established or located in the Union and at least 10,000 yearly active business users established in the Union.

The quantitative criteria create a presumption of gatekeeper status, but designation is not simply an automatic consequence of crossing a numerical threshold.

The Commission examines the relevant undertaking and service under the Regulation. It may also designate an undertaking following a market investigation where the quantitative thresholds are not met but the qualitative criteria establish the relevant position.

The Commission has designated major technology companies including Alphabet, Amazon, Apple, ByteDance, Meta, Microsoft, and Booking. Designation concerns specific core platform services, not necessarily every product or activity of the company.

A designated gatekeeper generally has six months after designation to comply with the applicable obligations.

14. Principal Obligations and Prohibitions Under the DMA

The DMA establishes a set of obligations designed to limit practices that may undermine fairness and contestability in digital markets.

Restrictions on self-preferencing

Article 6 addresses certain forms of self-preferencing.

A gatekeeper operating an online intermediation service or search engine must not treat its own products or services more favourably in ranking than similar products or services offered by third parties.

The purpose is to prevent a platform from using its control over an essential distribution channel to give its own commercial activities an unjustified advantage.

The precise application depends on the relevant service, the conduct, and the statutory requirements.

Data combination and advertising

Article 5 restricts certain forms of combining personal data across services and using data obtained through third-party services for advertising purposes without the required consent.

These provisions operate alongside the GDPR. Compliance with one regime does not automatically establish compliance with the other.

The DMA seeks to prevent gatekeepers from using their position to combine data in ways that strengthen their competitive advantage without providing users with the choices required by law.

Choice and interoperability

The DMA seeks to reduce barriers that prevent users from switching services or using competing products.

Depending on the relevant core platform service, obligations may include allowing users to uninstall certain pre-installed software applications, change default settings, and use alternative applications or services.

Article 7 establishes interoperability obligations for designated number-independent interpersonal communications services.

These obligations are subject to technical requirements and a phased implementation structure. They are not a general requirement that every messaging application must be interoperable with every other digital service.

Business-user access to data

Article 6 includes obligations concerning access by business users to certain data generated through their activities on a gatekeeper’s platform.

Business users may need access to information concerning their products, customers, transactions, and performance in order to operate effectively and compete.

The DMA therefore addresses the informational imbalance that can arise when a platform controls the commercial environment through which other businesses reach consumers.

Restrictions on anti-steering

Gatekeepers must not prevent business users from communicating offers or promoting alternative channels through which consumers may purchase products or services, subject to the conditions of the Regulation.

This is particularly important in app distribution and digital payment environments.

A business should not automatically lose the ability to communicate with its customers merely because it uses a gatekeeper’s platform to reach them.

Acquisitions and concentration

Article 14 requires gatekeepers to inform the Commission of certain intended concentrations involving other undertakings, including acquisitions that may not reach the ordinary notification thresholds under the EU Merger Regulation.

The provision seeks to improve the Commission’s understanding of acquisition activity involving major digital platforms.

It does not mean that every acquisition by a gatekeeper is automatically prohibited or requires approval under the DMA.

15. DMA Enforcement and Sanctions

The European Commission is the principal enforcer of the DMA. Unlike the DSA’s general national supervisory structure, the DMA establishes a centralised enforcement model.

The Commission can investigate potential infringements, require information, conduct inspections, and adopt decisions finding non-compliance.

Under Article 30, fines for certain infringements may reach 10% of the undertaking’s total worldwide annual turnover. In cases of repeated infringement, the maximum may rise to 20%.

The Regulation also provides for periodic penalty payments and other enforcement measures.

Where a gatekeeper systematically infringes the DMA, the Commission may conduct a market investigation and consider additional remedies. The Regulation permits behavioural and, under specified conditions, structural remedies.

The DMA does not replace Articles 101 and 102 TFEU. Competition law continues to apply to digital markets, including to gatekeepers. The two regimes are complementary: the DMA imposes ex ante obligations on designated gatekeepers, while traditional competition law continues to address anti-competitive agreements, abuses of dominance, and other conduct within its scope.

16. The Platform-to-Business Regulation

An important part of the European digital framework is Regulation (EU) 2019/1150, commonly known as the Platform-to-Business Regulation (P2B Regulation).

It applies to certain online intermediation services and online search engines that facilitate commercial relationships between business users and consumers.

Its principal purpose is to improve fairness and transparency in the relationships between platforms and businesses that depend on them.

The Regulation addresses several recurring problems in platform-based commerce:

• Lack of transparency in contractual terms and conditions.
• Unclear ranking mechanisms.
• Sudden suspension or termination of business accounts.
• Unfair restrictions on business users’ commercial activities.
• Insufficient information concerning access to data.

Providers must ensure that their terms and conditions are written in plain and intelligible language and are readily available to business users.

They must provide information concerning the main parameters determining ranking and explain the relative importance of those parameters.

Where a platform restricts, suspends, or terminates a business user’s services, it must comply with the relevant notification and reasoning requirements.

The Regulation also addresses the possibility that a platform may offer goods or services that compete with those of its own business users. It requires transparency concerning differentiated treatment and access to relevant data.

The P2B Regulation does not create a general prohibition on platforms competing with businesses using their services. Instead, it establishes transparency and procedural safeguards intended to reduce unfairness and uncertainty.

The DSA and DMA have expanded the legal framework, but the P2B Regulation continues to play an important role in the contractual relationship between platforms and business users.

Official text: Regulation (EU) 2019/1150.

17. Data Protection and Digital Services

Digital platforms frequently collect and process personal data to provide services, personalise content, measure performance, detect fraud, and deliver advertising.

The GDPR remains the central EU instrument governing the processing of personal data.

Regulation (EU) 2016/679 establishes principles and obligations applicable to controllers and processors, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

A platform that determines the purposes and means of processing may qualify as a data controller. Other providers may act as processors, depending on their actual functions and contractual arrangements.

The legal basis for processing must be identified under Article 6 GDPR. Where consent is relied upon, it must satisfy the requirements of the Regulation.

Individuals also enjoy rights including access, rectification, erasure, restriction of processing, data portability, and, in certain circumstances, objection.

The GDPR is particularly relevant to targeted advertising, behavioural profiling, recommender systems, and the use of personal data across different services.

The DSA and DMA do not displace these rules. They introduce additional obligations applicable to particular digital activities.

For example, a gatekeeper may be required under the DMA to obtain valid consent before combining personal data across certain services. The fact that consent is obtained for DMA purposes does not eliminate the need to comply with the GDPR’s wider requirements.

Similarly, advertising transparency under the DSA does not itself establish a lawful basis for processing personal data.

The relationship between these instruments demonstrates a broader principle of EU digital law: a single technological practice may be subject to several complementary legal regimes.

18. The Data Act and Access to Data in the Digital Economy

Regulation (EU) 2023/2854, commonly known as the Data Act, establishes harmonised rules concerning fair access to and use of data.

It entered into force on 11 January 2024 and has applied since 12 September 2025, subject to specific transitional provisions.

The Regulation addresses the growing importance of data generated by connected products and related services.

Examples include data generated by connected vehicles, smart household appliances, industrial machinery, and other devices connected to digital networks.

The Data Act seeks to give users greater control over data generated through their use of connected products and to facilitate access to that data by third parties where the statutory conditions are satisfied.

Its framework addresses several areas:

• Access to data generated by connected products.
• Data sharing between businesses.
• Certain business-to-government data-sharing obligations in exceptional circumstances.
• Switching between data-processing services.
• Interoperability requirements.
• Unfair contractual terms concerning data access and use.
• Safeguards concerning international access to non-personal data held within the Union.

The Data Act also contains provisions intended to make switching between data-processing services, including cloud services, easier and less restrictive.

It is important to distinguish the Data Act from the GDPR. The Data Act concerns access to and use of data more broadly, including non-personal data. Where personal data is involved, the GDPR continues to apply.

The two instruments therefore operate together rather than as alternatives.

Official text: Regulation (EU) 2023/2854 — Data Act.

19. Artificial Intelligence and the Regulation of Digital Platforms

Artificial intelligence increasingly influences the operation of digital platforms. It is used for content recommendation, moderation, advertising, fraud detection, search results, customer service, and the generation of information.

Regulation (EU) 2024/1689, the Artificial Intelligence Act, introduces a harmonised legal framework for AI systems and models.

The Act entered into force on 1 August 2024 and applies progressively.

As of November 2026, its general application framework includes the following important milestones:

• Prohibited AI practices and AI literacy obligations have applied since 2 February 2025.
• Certain governance provisions and obligations concerning general-purpose AI models have applied since 2 August 2025.
• Most of the remaining general provisions, including relevant transparency requirements, became applicable on 2 August 2026.
• Under the amended timetable, certain high-risk AI system obligations are scheduled to apply from 2 December 2027, while requirements for high-risk AI systems embedded in regulated products are scheduled for 2 August 2028.

The precise application date depends on the relevant category and transitional provision.

The AI Act is particularly relevant where platforms use AI systems that fall within its scope. For example, transparency requirements may apply to certain systems that interact directly with individuals or generate synthetic content.

The DSA and AI Act must not be confused. The DSA regulates the responsibilities of intermediary services and platforms, including the systemic risks associated with their operation. The AI Act regulates the development, placing on the market, putting into service, and use of AI systems and models within its scope.

A platform may therefore be subject to both instruments where it operates an online service and deploys or provides AI systems regulated by the AI Act.

20. Consumer Protection in the Digital Environment

Digital platforms frequently facilitate transactions between consumers and traders. The legal framework therefore includes consumer protection legislation in addition to platform-specific regulations.

The Consumer Rights Directive 2011/83/EU establishes important information requirements and withdrawal rights for distance and off-premises contracts.

The Unfair Commercial Practices Directive 2005/29/EC prohibits misleading and aggressive commercial practices.

The Unfair Contract Terms Directive 93/13/EEC addresses contractual terms that create a significant imbalance in the parties’ rights and obligations to the detriment of consumers.

The Sale of Goods Directive 2019/771 and the Digital Content and Digital Services Directive 2019/770 establish rules concerning conformity and remedies for goods and digital products.

These instruments remain relevant when transactions take place through marketplaces, social networks, app stores, and other digital services.

The DSA adds platform-specific obligations, particularly concerning advertising, trader traceability, transparency, and interface design.

The General Product Safety Regulation (EU) 2023/988 also has particular importance for online marketplaces. It establishes product safety requirements and additional obligations for certain economic operators and online marketplaces.

The allocation of responsibility depends on the platform’s actual role. A marketplace may be an intermediary, while a trader using it may remain responsible for the product, the contractual offer, and compliance with consumer legislation.

Where the platform itself acts as a trader or otherwise assumes obligations under applicable law, its responsibilities may be broader.

21. Territorial Scope, Cross-Border Services, and the Internal Market

The EU digital framework is designed to support cross-border provision of digital services.

A provider established in one Member State may offer services to recipients throughout the Union. The legal framework seeks to prevent unnecessary fragmentation while ensuring that users receive the protections established by EU law.

The DSA contains specific rules concerning the territorial application of intermediary obligations and the designation of the Member State responsible for certain supervisory functions.

The DMA applies to designated gatekeepers in relation to core platform services provided to business users and end users in the Union, irrespective of the gatekeeper’s place of establishment.

The GDPR also has an important extraterritorial dimension. Under Article 3, it can apply to controllers and processors outside the Union where their activities involve offering goods or services to individuals in the Union or monitoring their behaviour within the Union.

These provisions reflect a broader characteristic of EU digital regulation: legal obligations are not necessarily limited to businesses incorporated within the European Union.

At the same time, the EU framework must be considered alongside international rules, national procedural law, and applicable conflict-of-law principles. The existence of an EU digital obligation does not eliminate every question concerning jurisdiction, enforcement abroad, or the recognition of foreign judgments.

22. Relationship Between the DSA, DMA, Competition Law, and Other Digital Instruments

The different instruments of EU digital law address distinct but overlapping problems.

The DSA regulates intermediary services, platform accountability, content moderation procedures, transparency, and systemic risks.

The DMA regulates designated gatekeepers and their conduct in specified core platform services.

The GDPR protects personal data and governs the lawfulness of processing.

The Data Act addresses access to and use of data, including data generated by connected products and services.

The AI Act regulates AI systems and models according to their functions and risk categories.

The P2B Regulation protects business users through transparency and contractual safeguards.

EU competition law, particularly Articles 101 and 102 TFEU, continues to prohibit anti-competitive agreements and abuses of dominant position.

These regimes should not be treated as mutually exclusive.

For example, a platform’s use of ranking algorithms may raise questions under the DMA, P2B Regulation, consumer protection law, and competition law. If the algorithm processes personal data, GDPR obligations may also arise. If the system qualifies as an AI system within the scope of the AI Act, that legislation may impose additional requirements.

The correct legal analysis therefore begins by identifying the actual activity, the parties involved, the nature of the service, and the legal interest affected.

A platform cannot determine its regulatory obligations solely by describing itself as a technology company or intermediary. The applicable rules depend on its functions and conduct.

23. Judicial Review and the Protection of Fundamental Rights

Digital regulation increasingly involves decisions made by private platforms that can have substantial consequences for individuals and businesses.

The removal of content, suspension of accounts, restrictions on monetisation, and changes to commercial access may affect fundamental rights and economic interests.

The DSA responds by introducing transparency, complaint-handling, and dispute-resolution mechanisms. The DMA provides procedural safeguards for gatekeepers subject to Commission investigations and decisions.

Both instruments remain subject to judicial review within the EU legal system.

Commission decisions under the DMA may be challenged before the EU Courts in accordance with the Treaties and the relevant procedural rules.

The DSA also provides for judicial remedies and supervision within the applicable national and Union legal framework.

The fundamental rights dimension requires particular care. Measures addressing illegal content must be sufficiently precise and proportionate. Restrictions on freedom of expression must be assessed in light of Article 11 of the Charter and other applicable legal guarantees.

The right to conduct a business under Article 16 must also be considered when regulatory obligations impose substantial restrictions on commercial activity.

The regulatory objective is not to remove all risk from digital communication or eliminate the commercial autonomy of platforms. It is to establish a system in which digital services operate under transparent and legally reviewable conditions.

24. Key Takeaways

1. EU digital law is a network of complementary legal instruments rather than a single regulatory regime.
2. The Digital Services Act (Regulation (EU) 2022/2065) establishes obligations for intermediary services and online platforms concerning illegal content, transparency, user redress, advertising, and systemic risks.
3. The DSA preserves conditional intermediary liability exemptions for mere conduit, caching, and hosting services while introducing additional due-diligence requirements.
4. Online platforms must provide mechanisms for reporting allegedly illegal content and, in relevant cases, explain moderation decisions and provide complaint-handling procedures.
5. Very large online platforms and search engines, generally those with at least 45 million average monthly active recipients in the Union, are subject to additional systemic risk obligations.
6. The Digital Markets Act (Regulation (EU) 2022/1925) regulates designated gatekeepers providing specified core platform services.
7. Gatekeeper obligations address self-preferencing, data combination, interoperability, business-user access to data, and restrictions on commercial activity.
8. The Platform-to-Business Regulation improves transparency and fairness in the contractual relationships between online platforms and business users.
9. The GDPR continues to govern personal data processing. The DSA and DMA do not replace its requirements.
10. The Data Act regulates fair access to and use of data, particularly data generated by connected products and related services.
11. The AI Act applies to AI systems and models within its scope, with obligations becoming applicable according to a phased timetable.
12. Consumer protection and product safety legislation continue to apply to transactions facilitated through online platforms.
13. EU digital regulation must be interpreted consistently with the Charter of Fundamental Rights, particularly the rights to privacy, data protection, freedom of expression, and effective judicial protection.

25. Frequently Asked Questions

1. What is European digital law?

European digital law is the body of EU legislation governing digital services, online platforms, electronic commerce, data processing, digital markets, artificial intelligence, and related technological activities. It includes the Digital Services Act, Digital Markets Act, GDPR, Data Act, AI Act, and several complementary instruments.

2. What is the difference between the Digital Services Act and the Digital Markets Act?

The Digital Services Act regulates intermediary services and online platforms, focusing on transparency, illegal content, user protection, and platform accountability. The Digital Markets Act regulates designated gatekeepers to improve fairness and contestability in digital markets.

3. Does the Digital Services Act apply to companies established outside the EU?

Yes. The DSA can apply to intermediary services offered to recipients whose place of establishment or location is in the Union, regardless of the provider’s place of establishment.

4. Does the DSA require platforms to remove all harmful content?

No. The Regulation distinguishes illegal content from content that may be harmful, controversial, or contrary to a platform’s contractual rules but is not necessarily unlawful. It establishes procedures and responsibilities for handling illegal content and other specified platform risks. It does not create a general obligation to remove every undesirable publication.

5. What is a very large online platform?

A very large online platform is an online platform designated by the Commission under the DSA because it has at least 45 million average monthly active recipients in the Union, subject to the applicable designation procedure. Very large online search engines are subject to a corresponding framework.

6. What is a gatekeeper under the Digital Markets Act?

A gatekeeper is an undertaking designated under the DMA because it has a significant impact on the internal market, provides an important gateway for business users to reach end users, and enjoys an entrenched and durable position, or is expected to do so in the near future.

7. Can a platform favour its own products over those of competitors?

The DMA prohibits designated gatekeepers from engaging in specified forms of self-preferencing. The precise scope depends on the relevant core platform service and the conditions established by the Regulation. Other forms of preferential treatment may also be examined under competition law.

8. Does the DSA replace the GDPR?

No. The DSA and GDPR regulate different aspects of digital activity. The DSA governs intermediary responsibilities and platform accountability, while the GDPR governs the processing of personal data. Both may apply to the same service or practice.

9. Can users challenge a platform’s decision to remove their content?

Yes. The DSA establishes transparency and redress mechanisms, including statements of reasons, internal complaint-handling systems, and access to certified out-of-court dispute settlement bodies in relevant cases. Judicial remedies may also be available.

10. Does the DMA replace EU competition law?

No. The DMA complements Articles 101 and 102 TFEU and the wider EU competition framework. Competition law continues to apply to digital markets, including markets involving designated gatekeepers.

11. Does the Data Act apply to personal data?

The Data Act can concern data that includes personal data, but it does not displace the GDPR. Where personal data is involved, the requirements of data protection law must also be satisfied.

12. Why does the EU regulate online platforms through several different regulations?

Different digital activities create different legal risks. Content moderation, market power, personal data processing, AI systems, and access to industrial data cannot be addressed adequately through one general instrument. The EU therefore uses specialised legislation that operates within a common internal market and fundamental rights framework.

26. Conclusion

European digital law represents a significant development in the legal regulation of the modern economy. Digital platforms are no longer treated merely as technical intermediaries operating outside traditional legal structures. Their responsibilities increasingly reflect their role in facilitating transactions, distributing information, organising commercial relationships, processing data, and influencing access to digital markets.

The Digital Services Act establishes a framework for platform accountability, transparency, content moderation procedures, and systemic risk management. The Digital Markets Act addresses the economic power of gatekeepers and seeks to prevent practices that undermine fair competition and market contestability.

These regulations operate alongside data protection, consumer protection, competition law, electronic commerce legislation, and the emerging framework for artificial intelligence and data access.

The resulting system is complex because the digital economy itself is complex. A single platform may perform several legally distinct functions and consequently be subject to multiple obligations. The legal analysis must therefore focus on the actual activity rather than the technological label attached to the business.

The central objective of EU digital regulation is to ensure that the digital internal market develops within a framework of legal certainty, fair commercial conditions, accountability, and respect for fundamental rights. Its long-term effectiveness will depend not only on the content of the legislation but also on consistent enforcement, judicial interpretation, technological adaptation, and cooperation between national authorities and EU institutions.

27. Primary Legal Sources and Further Reading

Treaties and fundamental rights

• Treaty on European Union and Treaty on the Functioning of the European Union
• Charter of Fundamental Rights of the European Union

Core digital legislation

• Directive 2000/31/EC — Electronic Commerce Directive
• Regulation (EU) 2022/2065 — Digital Services Act
• Regulation (EU) 2022/1925 — Digital Markets Act
• Regulation (EU) 2019/1150 — Platform-to-Business Regulation

Data and artificial intelligence

• Regulation (EU) 2016/679 — General Data Protection Regulation
• Regulation (EU) 2023/2854 — Data Act
• Regulation (EU) 2024/1689 — Artificial Intelligence Act

Consumer and product protection

• Directive 2011/83/EU — Consumer Rights Directive
• Directive 2005/29/EC — Unfair Commercial Practices Directive
• Directive 93/13/EEC — Unfair Contract Terms Directive
• Regulation (EU) 2023/988 — General Product Safety Regulation

Official institutional resources

• European Commission — Digital Services Act
• European Commission — Digital Markets Act
• European Commission — Data Act
• European Commission — Artificial Intelligence Act
• EUR-Lex — Access to European Union Law