DMA Gatekeeper Designation: Criteria, Obligations, and Penalties

DMA gatekeeper designation is the European Commission’s formal decision that a large digital platform meets the Digital Markets Act’s thresholds and must follow the regulation’s rules on data, competition, and platform openness. Designation applies to specific services rather than to a company as a whole, and once it takes effect the platform has six months to bring those services into compliance or face fines of up to 10% of worldwide annual turnover. Seven companies are currently designated, covering 23 individual services.

The Three Tests That Trigger Designation

Article 3 of the DMA sets three conditions a company must meet to be designated as a gatekeeper: significant impact on the EU internal market, control of an important gateway between businesses and consumers, and an entrenched and durable market position. Each condition has a quantitative threshold, and hitting the number creates a legal presumption that the condition is satisfied. The Commission does not need to prove the underlying condition independently once the numbers line up.¹

The financial test is met with either €7.5 billion in annual EU turnover or a €75 billion market capitalization. The gateway test requires more than 45 million monthly active end users in the EU and at least 10,000 yearly active business users established in the EU. The entrenchment test is presumed when the user thresholds have been met in each of the three preceding financial years.

The rules apply only to a defined list of service types, so hitting the numbers matters only if the underlying product is a “core platform service.” Ten categories qualify:

Online intermediation services, such as marketplaces and app stores
Online search engines
Social networking services
Video-sharing platforms
Number-independent interpersonal communication services, meaning messaging apps that run over the internet rather than phone networks
Operating systems
Web browsers
Virtual assistants
Cloud computing services
Online advertising services offered by a company that also runs one of the services above

A company might run dozens of products, but only those in these categories and passing the user thresholds get designated. That is why Alphabet has eight designated services while ByteDance has one.

How a Company Gets Designated

A company that meets all three thresholds has to notify the Commission within two months. It cannot wait to be found. The Commission then has 45 working days to decide whether formal designation is warranted.²

A company can try to rebut the presumption by arguing that the numbers do not reflect the reality of its particular service. The arguments have to speak directly to why the quantitative criteria misfire for that service; traditional competition-law points about market definition or efficiency gains do not count. If the arguments obviously fail, the Commission can reject them outright. If they have real merit, it opens a formal market investigation before deciding.¹

Designation is not automatic even for very large platforms. X was investigated in 2024 but not designated, because the Commission concluded its social networking service was not an important gateway for business users to reach consumers.³

Who Is Currently Designated

The first six gatekeepers were designated in September 2023: Alphabet, Amazon, Apple, ByteDance, Meta, and Microsoft. Booking was added in May 2024. As of 2026 the seven companies cover 23 designated core platform services.⁴

Alphabet: Google Play, Google Maps, Google Shopping, Google Search, YouTube, Android, Alphabet’s online advertising service, and Google Chrome
Amazon: Marketplace and Amazon Advertising
Apple: App Store, iOS, Safari, and iPadOS (added April 2024)
Booking: Booking.com (added May 2024)
ByteDance: TikTok
Meta: Facebook, Instagram, WhatsApp, Messenger, and Meta Ads. Facebook Marketplace was undesignated in April 2025.
Microsoft: LinkedIn and Windows PC OS

Because designation attaches to each service, a single company can carry multiple sets of obligations, and undesignation of one service does not touch the others.

What Designated Gatekeepers Cannot Do

Article 5 sets bright-line prohibitions that take effect on designation. There is no room to argue that a particular implementation is acceptable.

A gatekeeper cannot merge personal data from one of its services with data from another of its services, or with data from third parties, unless the user gives explicit consent meeting GDPR standards. If a user refuses or withdraws consent, the gatekeeper cannot ask again for the same purpose for at least one year.¹

Price parity clauses are banned. A hotel listed on a designated booking service is free to offer a lower price on its own website or on a competing platform. App developers cannot be stopped from telling their users about cheaper options outside the platform or steering them to direct purchases. The Commission’s €500 million fine against Apple in April 2025 turned on exactly this anti-steering obligation.⁵

Gatekeepers cannot require users to subscribe to extra core platform services as a condition of accessing one, and they cannot force business users to adopt the gatekeeper’s identification service, browser engine, or payment system to operate on the platform.

What Gatekeepers Have to Build or Open Up

Article 6 goes further, requiring active changes to how the platform works. Unlike the Article 5 prohibitions, these obligations can be specified in more detail through a regulatory dialogue if the gatekeeper’s first attempt falls short.

Self-preferencing is out. A gatekeeper cannot rank its own products more favorably than competing offerings in search results, app stores, or other listings, and it cannot use non-public data generated by business users on the platform to compete against those same businesses.¹

Users must be able to uninstall any pre-loaded app, unless the app is essential to the device’s function and no third party could technically provide it as a standalone product. Users must be able to change default browsers, search engines, and virtual assistants with minimal friction, and gatekeepers must present a choice screen listing alternatives at first use.

Operating system gatekeepers must permit third-party apps and alternative app stores, and let those stores be accessed through channels other than the gatekeeper’s own. Downloaded stores must be able to prompt users to set them as the default. This is the provision that forced Apple to open iOS to alternative distribution in the EU.p>

End users get free tools to export the data they have provided or generated, including continuous, real-time access, which authorized third parties can plug into to move data directly between platforms.⁶ Business users get the same real-time access to data generated by their own activity on the platform.

Third-party services must be granted access to the same hardware and software features of the operating system that the gatekeeper’s own services use. If the gatekeeper’s payment app can reach the NFC chip, competing payment apps must get the same access.⁷

Advertising Transparency

Gatekeepers that operate online advertising services have specific transparency duties. Advertisers must receive daily, free information on the price and fees paid for each ad placement, the deductions and surcharges applied, and the metrics used to calculate them. Publishers get the mirror data on what they earned, the fees deducted, and the pricing metrics. Where the counterparty consents, each side also sees what the other paid or received; where consent is not given, daily averages are provided instead. Advertisers and publishers must also get access to performance measurement tools and the underlying data for independent verification.¹

Anti-Circumvention and Merger Notification

Article 13 blocks the obvious workarounds. Gatekeepers cannot split, fragment, or restructure services through contracts, technical design, or any other means to duck the thresholds, and they cannot undermine their obligations through manipulative interface design or by retaliating against users who exercise DMA rights. A gatekeeper that technically permits sideloading but hides it behind stacks of warnings and confirmation screens is likely violating Article 13 even if the feature exists on paper.¹

Gatekeepers must inform the Commission before completing any acquisition where the target provides core platform services, operates in the digital sector, or enables data collection. This applies even where the deal would not meet the ordinary EU Merger Regulation thresholds, giving the Commission an early view of consolidation aimed at buying out potential competitors before they grow.⁸

Compliance Timeline and Internal Duties

A designated gatekeeper has six months to comply with all obligations and to submit a detailed compliance report describing the technical and organizational measures it has put in place. The first six gatekeepers hit that deadline on March 7, 2024.⁹ Non-confidential summaries of the reports are published.¹⁰

Within the same six-month window, each gatekeeper has to submit an independently audited description of every technique it uses to profile consumers across its designated services, and update it at least annually.¹¹

Each gatekeeper must appoint a head of compliance, an independent senior manager with dedicated responsibility for DMA compliance, direct access to the company’s board, and enough authority and resources to function separately from the business teams whose conduct is being monitored.¹²

Penalties

The Commission can fine a gatekeeper up to 10% of its total worldwide annual turnover for breaching Articles 5, 6, or 7, and it can impose periodic penalty payments for each day a violation continues.¹³

The first non-compliance decisions came in April 2025. Apple was fined €500 million for restricting how app developers could inform users about offers available outside the App Store. Meta was fined €200 million for its “consent or pay” model, which the Commission found failed to give users a genuine choice about how their personal data would be used.⁵

For repeat offenders, the DMA reserves a heavier remedy. If the Commission has issued at least three non-compliance decisions against a gatekeeper within eight years, it can open a market investigation into systematic non-compliance. If that investigation confirms a pattern and finds the gatekeeper has maintained or strengthened its position because of it, the Commission can impose structural remedies, including ordering the sale of business units, provided any such measure is proportionate and necessary.¹

1
EUR-Lex. Regulation (EU) 2022/1925 – Digital Markets Act
2
European Commission. Potential Gatekeepers Notified the Commission and Provided Relevant Information
3
European Commission. Commission Concludes That Online Social Networking Service of X Should Not Be Designated Under Digital Markets Act
4
European Commission. Gatekeepers Portal
5
European Commission. Commission Finds Apple and Meta in Breach of the Digital Markets Act
6
European Commission. End User Data Portability
7
European Commission. Interoperability – Digital Markets Act
8
European Commission. Article 14 DMA Template – Information on Transactions
9
European Commission. Designated Gatekeepers Must Now Comply With All Obligations Under the Digital Markets Act
10
European Commission. Digital Markets Act – Compliance Reports
11
European Commission. Article 15 DMA Template – Consumer Profiling Report
12
European Commission. Template for Reporting Pursuant to Article 11 of Regulation (EU) 2022/1925
13
European Commission. Commission Finds Apple and Meta in Breach of the Digital Markets Act