Digital Markets Act (DMA)

The DMA is ex ante regulation: once an undertaking is designated, a list of prohibitions and obligations applies immediately, with no requirement to demonstrate anticompetitive effect in the individual case.

DMA Article 3 designates gatekeepers by quantitative presumption: substantial EU turnover or market capitalisation, at least 45 million monthly active end users and 10,000 yearly active business users in the Union, sustained over three financial years.

The Commission is the sole enforcer of the DMA; national competition authorities may investigate possible non-compliance and report to support the Commission (Art. 38(7)), and national courts may apply the DMA in proceedings before them (Art. 39).

On 8 July 2026 the General Court dismissed Apple's gatekeeper-designation challenges in full, confirming the App Store and iOS obligations and closing the route by which designated gatekeepers could contest interoperability obligations at the designation stage.

Every designated gatekeeper undertaking is US- or Chinese-headquartered — Booking.com is run from the Netherlands, but the designated undertaking is the US-based Booking Holdings Inc. The US administration has objected: a February 2025 presidential memorandum ordered scrutiny of foreign digital rules, and the White House named the DMA and DSA among them; in July 2026 US lawmakers pressed for a Section 301 trade investigation into both. Enforcement has proceeded regardless.

The DMA operates alongside Articles 101 and 102 TFEU, not instead of them: in September 2025 Google received a separate EUR 2.95 billion antitrust fine.

Article 5 DMA prohibits a gatekeeper from combining personal data across services without consent (5(2)), requires it to let business users communicate and promote offers to end users free of charge and conclude contracts with them (5(4)), bars it from preventing users raising non-compliance with public authorities (5(6)), and bars it from requiring use of its identification service, web browser engine or payment service (5(7)).

Article 6 DMA holds the obligations susceptible of further specification, including allowing third-party app stores and sideloading (6(4)), no self-preferencing in ranking (6(5)), free and effective interoperability with the hardware and software features available to the gatekeeper's own services (6(7)), data portability (6(9)) and business-user access to their data (6(10)).

Article 7 DMA imposes interoperability obligations on gatekeepers' number-independent interpersonal communications services.

A gatekeeper must report on its compliance within six months of designation and update the report at least annually (Article 11), is bound by an anti-circumvention duty (Article 13), must inform the Commission of intended concentrations (Article 14) and must submit an independently audited description of its consumer-profiling techniques (Article 15).

As at 14 October 2026 seven undertakings are designated as gatekeepers — Alphabet, Amazon, Apple, Booking, ByteDance, Meta and Microsoft — for 23 core platform services.

Meta's binary pay-or-consent model was found not to provide the genuinely equivalent, less data-intensive alternative DMA Article 5(2) requires.

In December 2025 the Commission acknowledged Meta's undertaking to give EU users, from January 2026, a choice between fully personalised advertising and a less-personalised option that shares less of their data.

In September 2024 the Commission opened two Article 6(7) specification proceedings on Apple's interoperability obligation for iOS and iPadOS, and on 19 March 2025 adopted two specification decisions: one setting out how Apple must open nine iOS connectivity features to third-party connected devices, the other how it must handle developers' interoperability requests.

On 16 July 2026 the Commission adopted a binding specification decision under Article 6(7) DMA requiring Google to give rival AI assistants on Android access to the features its own AI services use, including activation by voice command and acting in apps on the user's behalf, with safeguards for privacy, device integrity and security; users are to see the changes from July 2027.

A second specification decision of 16 July 2026, under Article 6(11) DMA, sets how Google must share anonymised search data with rival search engines: AI chatbots offering search functionalities are eligible, Google may first assess serious cybersecurity and data-protection risks for each recipient, the data are priced by a set formula, and sharing must start from January 2027.

The Commission's DMA review concluded that future work should concentrate on enforcing what exists rather than expanding scope, despite substantial stakeholder demand to extend interoperability to social media, cloud and AI infrastructure.

When Meta restricted rival AI assistants' access to WhatsApp, the Commission acted under Article 102 TFEU rather than the DMA: it opened an antitrust investigation on 4 December 2025, issued a Statement of Objections in February 2026 and ordered interim measures on 9 June 2026.

On 23 July 2026 the Commission fined Google EUR 890 million for breaches of the Digital Markets Act, concerning self-preferencing in Search and anti-steering in Google Play.

One of the two decisions of 23 July 2026 fined Google EUR 460 million for self-preferencing its own services in Google Search, in breach of DMA Article 6(5).

The other decision of 23 July 2026 fined Google EUR 430 million for restricting businesses on Google Play from steering consumers to other purchase channels, in breach of DMA Article 5(4).

On 25 June 2026 the Commission reached a preliminary position that Amazon Web Services and Microsoft Azure should be designated as gatekeepers under the DMA. No designation decision had been adopted as at the verification date.

Google's two DMA fines of 23 July 2026 total EUR 890 million, the largest amount the Commission has imposed under the DMA to date; each fine alone is smaller than Apple's EUR 500 million of April 2025.

Almost the entire EU digital rulebook rests on Article 114 TFEU (internal-market harmonisation) rather than on a speech, safety or morality competence, and that choice shapes each instrument's form.

The instruments following the GDPR reproduce the same institutional shape — a specialised vocabulary, principles, case-specific rights and a supervisory apparatus — a pattern described as act-ification and GDPR mimesis.

The recurring objection across every instrument is a capacity-ambition gap: broad obligations assigned either to a single Commission directorate with a few hundred staff or to twenty-seven national authorities of radically unequal resource.

The operative standards of the EU digital rulebook — systemic risk, high-impact capabilities, effective interoperability, genuinely equivalent alternative — are almost all open-textured, so the law's effective content is set by Commission guidelines, delegated acts, codes of practice and harmonised standards rather than by the legislature.

A single recommender system can engage the GDPR, the DSA, the AI Act and, for a gatekeeper, the DMA at once, so the rational compliance strategy is one control set mapped to several regimes.

Because every designated gatekeeper undertaking and nearly every VLOP is non-European, the rulebook is a foreign-policy object: this shapes the timing of decisions, the choice between fines and commitments, and the political viability of expanding scope.

The April 2025 Apple decision establishes that the DMA Art. 5(4) standard is proactive enablement rather than mere non-obstruction, that formal compliance fails where user choices are not genuinely meaningful, and that compliance cannot be averaged across business terms.

The main substantive criticism of the DMA is now its scope gap: cloud computing is already a core platform service under Article 2, but neither AWS nor Azure met the quantitative designation thresholds, and generative AI is not listed; the Commission opened market investigations into AWS and Azure on 18 November 2025 and reached a preliminary position in favour of designation on 25 June 2026.

In enforcing DMA Article 6(7) the Commission is not merely prohibiting conduct but prescribing product architecture, which resembles utility regulation.

Consumer benefit from the DMA is real but modest: EU iPhone users can set rival browsers and payment apps as defaults, install applications outside the App Store, and use third-party payment solutions — narrower than the rhetoric implied, at high administrative cost.

This body of law restrains corporate power far more effectively than it restrains state power, and on the record available the enforcement asymmetry between corporate and state addressees is hard to dispute.