How the DMA & DSA laws will impact your business

The European Parliament has approved two new laws that will place tough constraints on how big tech brands such as Apple, Amazon, Alphabet, and Meta tackle competition and handle user data. The Digital Markets Act (DMA) and Digital Services Act (DSA) aim to create a safer digital space where the fundamental rights of users are protected, and to establish a level playing field for businesses in the European Single Market and globally.

This is the first official legislation around the globe that aims to regulate big tech in such a big way. The new rules are an important step in defending European values in the online space. They respect international human rights norms, and help better protect democracy, equality and the rule of law.

The new laws apply in the EU single market, without discrimination, including to those online intermediaries established outside of the European Union that offer their services in the EU.

The Digital Markets Act (DMA) focuses more on the so-called ‘gatekeepers’ in digital markets such as search engines, social networking sites, web browsers, cloud computing services and virtual assistants. The criteria is even stricter than with DSA; similarly, most businesses will not be impacted directly, but will indirectly have to work with the consequences.

The DMA establishes a set of narrow defined criteria for qualifying large online platforms as ‘gatekeepers’. You are considered to be a gatekeeper when:

• You have a yearly revenue of €7,5 billion, a market value of €75 billion, or you have over 45 billion unique monthly visitors on your platform. (Note that the European Commission can also appoint gatekeepers themselves, so companies like Booking, Zalando or Just Eat Takeaway may not meet these criteria just yet, but could be added to the list in the future). 
• Furthermore, you need to have an impact on the market, be an important gatekeeper for business users to reach end users and have a firm position in the market

The DMA places far greater restrictions on tech giants in regards to how they utilise their gatekeeper platforms, in a bid to even the playing field for competition. For example, it introduces a ban on: sharing data between services without expressed consumer consent; on ranking the gatekeeper’s own products or services in a more favourable manner compared to those of third parties, and tracking end users outside of the gatekeepers’ core platform service for the purpose of targeted advertising, without effective consent having been granted. The DMA’s competition rules could impact services such as iMessage, Amazon’s ability to self-preference on ecommerce, and Google and Meta’s advertisement data gathering practices.


These competition rules will likely go into effect in 2024, and those found to be non-compliant could face fines of up to 10% of the company’s worldwide annual turnover, rising to 20% for repeated infringements and penalty payments of up to 5% of the company’s worldwide daily turnover.

The DMA stipulates that gatekeepers must not:

• Treat services and products offered by the gatekeeper itself more favourably in ranking than similar services or products offered by third parties on the gatekeeper’s platform.
• Prevent consumers from linking up to businesses outside their platforms.
• Prevent users from uninstalling any pre-installed software or app if they wish to do so.
• Track end users outside of the gatekeepers’ core platform service for the purpose of targeted advertising, without effective consent having been granted.

More specifically, the DMA states that different messenger services are to be connected to each other, meaning that you can send a message from Facebook Messenger to Signal, or from iMessage to Telegram. This part of the DMA is heavily criticised, as the technical feasibility of connecting these services together is low; there is no protocol like there is for email (smtp) or phone (ss7). However, legislation isn’t meant to be a technical requirement, and this type of legislation will keep everyone on their toes.

Lastly, the DMA mentions that users outside of the gatekeeper’s platform can no longer be tracked without effective consent. The interesting twist here is ‘consent’. Under GDPR, consent was already necessary to track users online. You can therefore argue that nothing will really change. For many of these platforms, it’s already practically impossible to continue using their services without giving the right levels of consent. However, we need to see this in the context of the DSA as well. The combination of DSA and DMA could potentially mean that online platforms like Meta’s Facebook and Google, will no longer be able to create these enormous datasets based on personal and interaction data that can be used for targeting ads. 

The DMA also requires gatekeepers to be more transparent towards their business users. For example, this means that Meta and Google will need to provide more information on the ads and campaigns their business users run. So, your business won’t have to rely on inaccurate or intransparent reports, but instead have access to in-depth data that is created via your campaigns. 

Additionally, gatekeepers are no longer allowed to self-preference their products on their platforms (e.g. if you’re searching for a voice assistant on google search, Google isn’t allowed to place their Google Home in the first ranking). An obvious bonus for any smaller companies offering similar solutions. 

There’s no doubt that this is an historic moment in digital regulation; the introduction of these new laws has set Europe as the first, single digital market in the free-world. While, in practice, GDPR and Intelligent Tracking Prevention (ITP) have already limited the possibilities to target users specifically based on their data, the introduction of DMA and DSA brings clear regulatory monitoring and punishments for non-compliance.

While the implications of the new legislation will be most intensely felt by the tech giants, the ripple effects will undoubtedly be felt across all organisations utilising their platforms. Plus, it’s only a matter of time before smaller parties will also have to follow these regulations, so be advised to start following the same ‘consent rules’ that the tech giants are being given now.