Major Digital Platform Regulations in the European Union

The European Union’s digital rulebook combines privacy, platform accountability, competition, artificial intelligence and cybersecurity measures. Together, these laws establish obligations for services operating in the EU, including some providers based outside it, and provide a framework for cross-border digital governance.

General Data Protection Regulation (GDPR)

Regulation (EU) 2016/679 was adopted on April 27, 2016, and became applicable on May 25, 2018. It governs the processing of personal data and can apply to organisations outside the EU that process data of people in the Union. Its principles require organisations to process data lawfully, fairly and transparently, for specified purposes, and only to the extent necessary.

• Data management: Personal data must be accurate, retained only as long as necessary, and protected through appropriate security measures. Organisations are accountable for demonstrating compliance.
• Individual rights: People can seek access, rectification, erasure, data portability, restriction of processing and object to processing.
• Consent and oversight: Where consent is the legal basis, it must be freely given, specific, informed and unambiguous. Certain organisations must appoint a Data Protection Officer (DPO).
• Breach notification and penalties: Relevant breaches must be reported to authorities within 72 hours; affected individuals must also be informed in some cases. Fines can reach €20 million or 4% of global annual turnover, whichever is higher.

Digital Services Act (DSA)

Regulation (EU) 2022/2065 entered into force on November 16, 2022; most provisions applied from February 17, 2024. It sets responsibilities for online intermediary services, including social networks, marketplaces, content-sharing platforms and app stores. Its objectives include protecting fundamental rights, improving user choice and safety, and reducing exposure to illegal content.

• Content and transparency: Platforms must provide clearer procedures for content moderation and explain decisions such as content removal or account suspension.
• Advertising and design: The DSA prohibits targeted advertising to children and targeting based on sensitive personal data. It also prohibits manipulative interface practices, commonly called dark patterns.
• Marketplaces: The “Know Your Trader” rule requires online marketplaces to verify sellers and display their contact information.
• Very large services: Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs), with more than 45 million monthly active users in the EU, face additional duties, including systemic-risk assessments, independent audits and data access for vetted researchers.

National Digital Services Coordinators and the European Commission share enforcement responsibilities; the Commission supervises VLOPs and VLOSEs. Non-compliance can attract fines of up to 6% of global turnover. The DSA therefore links platform accountability to transparency, risk management and protection of users, rather than treating online content rules as solely a matter for individual services.

Digital Markets Act (DMA)

Regulation (EU) 2022/1925 entered into force on November 1, 2022, and became applicable on May 2, 2023. It seeks fairer, more contestable digital markets by imposing obligations on designated “gatekeepers”—large platforms that control important access points between business users and consumers.

• Designation: Thresholds include EU annual turnover of at least €7.5 billion or market capitalisation of at least €75 billion, alongside 45 million monthly active end users and 10,000 yearly active business users in the EU.
• Core services: Covered services include online intermediation, search engines, app stores and messenger services.
• Conduct rules: Gatekeepers must allow users to uninstall certain pre-installed apps, enable specified interoperability and give business users access to relevant performance data. They are restricted from self-preferencing, combining personal data across services without consent and certain forms of pre-installation.

The Commission designated Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft in September 2023, and later added Booking.com. Most obligations for the first designees applied from March 6, 2024. Fines can reach 10% of worldwide turnover, rising to 20% for repeated infringements.

Artificial Intelligence Act

Regulation (EU) 2024/1689 entered into force on August 1, 2024. It takes a risk-based approach, with obligations introduced in phases.

• Unacceptable risk: Certain practices, including social scoring and subliminal manipulation, are prohibited; these prohibitions largely applied from February 2, 2025.
• High risk: Systems used in areas such as healthcare, employment and law enforcement face requirements concerning data quality, human oversight, transparency and cybersecurity.
• Other systems: Limited-risk systems, such as chatbots, must inform users when they are interacting with AI. Most minimal-risk systems have fewer obligations. General transparency rules apply from August 2, 2026.

Obligations for providers of general-purpose AI models began applying on August 2, 2025. Penalties for prohibited practices can reach €35 million or 7% of worldwide turnover.

Data Act and Cybersecurity Act

The Data Act, Regulation (EU) 2023/2854, entered into force on January 11, 2024; most provisions have applied since September 12, 2025. It sets rules for access to and use of data generated by connected products and related services.

• Data access: Users gain rights to access data from connected products and share it with third parties.
• Fair data economy: The Act facilitates switching between cloud data-processing services, addresses unfair data-sharing contract terms—particularly for SMEs—and allows public bodies to request private-sector data in exceptional circumstances such as public emergencies.

The Cybersecurity Act, Regulation (EU) 2019/881, strengthens the mandate of the European Union Agency for Cybersecurity (ENISA) and establishes an EU-wide certification framework for ICT products, services and processes. ENISA supports Member States and coordinates responses to large-scale cyberattacks; certification helps provide assurance about the cybersecurity features of digital products and services.

Key Prelims Takeaways

• GDPR: Personal-data protection, individual rights and organisational accountability.
• DSA: Intermediary and platform responsibilities, including content transparency and child protection.
• DMA: Gatekeeper obligations intended to make digital markets fairer and more contestable.
• AI Act: Risk-based rules, including prohibitions and requirements for high-risk systems.
• Data Act: Access to and use of connected-product data, alongside cloud-switching rules.
• Cybersecurity Act: ENISA’s strengthened role and EU cybersecurity certification.

Recent Context

On October 23, 2026, Greece approved a social-media ban for under-15s from January 1, 2027, covering existing and new accounts; parental consent will not exempt children. Age checks will use KidsWallet and privacy-preserving zero-knowledge proofs. Greece is coordinating with six EU states and the Commission; the measure could inform the proposed EU Kids Act.