What Is the EU Digital Markets Act — and Who Counts as a Gatekeeper?

The Digital Markets Act is competition policy’s biggest structural experiment since merger control was invented: it converts two decades of platform case law into a standing rulebook enforced ex ante. Whether you run a designated gatekeeper, build on one, or compete against one, the DMA now shapes product design, data flows and commercial terms across the EU digital economy. This guide explains who is caught, what the obligations actually require, and how enforcement works — opening the digital-markets pillar of our Global Competition & Antitrust hub.

Why did the EU abandon case-by-case enforcement for gatekeepers?

Because the case law worked doctrinally and failed practically. Google Shopping took seven years from complaint to decision and another seven in appeals; by the time remedies arrived, the comparison-shopping rivals were dead. Android, AdSense, Amazon Marketplace, Apple Music — the same pattern: theories vindicated, markets unrestored. The DMA’s premise is that digital tipping outruns adjudication, so contestability must be protected by standing rules rather than post-mortem findings.

The design borrows from both competition law and regulation: obligations distilled from litigated abuses (self-preferencing from Shopping, anti-steering from Apple, data-combination limits from the German Facebook case, sideloading from Android) — but applied without proof of dominance, effects or consumer harm in the individual case. Critics call this over-inclusive; the legislator answered that the six designated groups had each been through a decade of individual proof already. The Google docket is, in that sense, the DMA’s legislative history.

Who qualifies as a gatekeeper — and how does designation work?

Three cumulative criteria, each with quantitative presumptions: significant impact on the internal market (€7.5 billion EEA turnover in each of the last three years, or €75 billion average market capitalisation); operating a core platform service (search, intermediation/marketplaces, app stores, social networks, video sharing, messaging, ads, browsers, operating systems, cloud, virtual assistants) that is an important gateway — presumed at 45 million monthly EU end users and 10,000 yearly EU business users; and an entrenched, durable position (thresholds met across three years).

Companies meeting the numbers must self-report; the Commission designates within 45 working days; rebuttal arguments are narrowly entertained (a few succeeded — Gmail and Outlook escaped as non-gateway services despite the numbers, and X’s ads business was examined and not designated). The Commission can also designate below thresholds after a market investigation, and “emerging gatekeepers” can receive partial obligations. Designation is service-specific: Apple is regulated for iOS, the App Store and Safari — not for everything Apple does — and each service’s compliance is assessed separately, which is why the gatekeeper list is best read as a matrix, not a roster of names.

What do the core obligations actually require?

Article 5’s self-executing rules: no combining personal data across services (or with third-party data) without genuine consent; no wide or narrow parity clauses preventing business users offering better terms elsewhere; free steering — business users may promote and conclude offers outside the platform; no forcing use of the gatekeeper’s identity, payment or browser services; no bundling core services as access conditions; and no anti-complaint retaliation.

Article 6’s specifiable duties carry the engineering weight: no self-preferencing in rankings; sideloading and third-party app stores on operating systems; uninstallable defaults and choice screens; interoperability with OS/hardware features on FRAND terms; real-time data portability for end users and continuous data access for business users; advertising transparency (pricing, metrics, verification data); and search-query data sharing with rival engines. Article 7 adds horizontal messaging interoperability on request. Together they constitute the most detailed conduct code ever applied to private firms outside utilities — and the reason gatekeeper compliance is now a product-engineering discipline, not a legal memo.

How does DMA enforcement differ from an Article 102 case?

Speed and specification. There is no market definition fight, no dominance battle, no effects trial: the Commission opens a non-compliance investigation, must generally conclude within 12 months, and can adopt specification decisions that dictate the technical implementation of an obligation — as it did in March 2025, ordering Apple’s interoperability mechanics for connected devices in engineering detail. The burden architecture inverts the litigation era: gatekeepers must demonstrate compliance, publish compliance reports, and maintain independent compliance functions.

Sanctions escalate by design: fines to 10% of worldwide turnover, 20% for repeated infringement, periodic penalties to 5% of daily turnover — and Article 18’s systematic non-compliance procedure, where three infringements in eight years unlock behavioural or structural remedies including divestiture, plus effective merger bans on the gatekeeper’s ecosystem. The first fines (Apple €500 million, Meta €200 million, April 2025) tested the machine; the enforcement arc — including the compliance-design fights over Apple’s Core Technology Fee and Meta’s pay-or-consent model — is tracked in our DMA enforcement guide.

What does the DMA mean for businesses that are not gatekeepers?

Opportunity, mostly — if claimed. App developers gained steering and external-payment rights, alternative distribution channels and interoperability hooks; merchants gained parity freedom and data-access rights against marketplaces; advertisers gained transparency entitlements; rival search engines gained query-data access; and complainants gained a regulator with deadlines. The DMA’s beneficiaries, however, must operationalise their rights: data-access requests, interoperability petitions and compliance-report challenges do not file themselves.

There is also second-order exposure. Gatekeepers’ compliance redesigns reshape dependent businesses’ economics (new fee structures like the Core Technology Fee, changed rankings, consent flows depressing ad targeting), and the DMA’s spread — Japan’s Smartphone Act, the UK’s DMCC regime, Türkiye’s pending DMA-style amendments, Brazil’s and India’s drafts — means multi-market platforms face a compliance matrix, not a single rulebook. Businesses building on platforms should assign ownership of “gatekeeper relations”: monitoring compliance reports, quantifying the value of new rights, and escalating breaches — the practical playbook our DMCC guide extends to the UK.

What are the open questions the next few years will decide?

Four live ones. Whether compliance-by-design or malicious compliance wins: the fee-and-friction architectures (Core Technology Fee, scare screens, pay-or-consent) test whether gatekeepers can price away the statute’s intent — the first fines say no, the appeals will say how firmly. Whether interoperability at engineering depth is administrable: the Apple specification decisions make the Commission a standards body, a role it has never held at this granularity.

Whether the DMA exports — the emerging national variants diverge in scope and could fragment platform regulation precisely as it globalises; and whether AI redraws the perimeter: virtual assistants are listed, foundation models are not, and the Commission has signalled review as AI interfaces become the new gateways, the frontier mapped in our AI and competition analysis. For gatekeepers and their counterparties alike, the strategic posture is the same: treat the DMA as a permanent operating condition under active construction, and invest in shaping its specification rather than merely absorbing it.

How should a gatekeeper-dependent business build its DMA playbook?

As a rights-exploitation program with an owner. Step one: map your dependencies against the obligation catalogue — which Article 5/6 rights touch your economics (steering, data access, ranking neutrality, portability, ad transparency), and what each is worth in revenue or cost terms. Step two: exercise systematically — file the data-access requests, implement steering flows, test alternative distribution — and document the gatekeeper’s responses, because the deltas between entitlement and delivery are your leverage.

Step three: engage the enforcement layer deliberately — compliance-report comments, evidence submissions to open proceedings, and coalition-building with similarly situated businesses (associations of developers, merchants and publishers have shaped every major DMA decision so far). The asymmetry to exploit: the Commission needs third-party evidence to prioritise, and structured, quantified submissions from real businesses move dockets that abstract complaints never reach. Firms that ran this playbook in the first cycle — notably in the steering and app-store fights — obtained rule changes worth percentage points of margin.

What has the DMA changed on the ground so far?

Measurably, if unevenly: browser choice screens moved default shares by visible points in several member states; alternative iOS distribution exists in the EU where it existed nowhere; steering flows delivered direct-purchase options in major apps; parity-clause removal freed hotel and travel pricing; and business users hold data feeds that simply did not exist in 2023. Against that, self-preferencing and ranking outcomes have shifted less than complainants hoped, and fee redesigns clawed back part of the openness — the gap the enforcement cycle is now working.

The honest interim verdict: the DMA has proven it can change product architecture at the deepest incumbents faster than any litigation ever did, while leaving open whether changed architecture becomes changed market shares. That second question — contestability in outcomes, not just in design — is the one the regime will be judged on, and the reason its five-year reviews and perimeter updates matter as much as its fines.

Frequently Asked Questions