The European Commission has confirmed 19 online platforms and search engines identified as ‘very large online platforms’ (VLOPs) and ‘very large online search engines’ (VLOSEs) for the purposes of the EU’s Digital Services Act (DSA). Such companies must comply with the most stringent rules of the DSA.

Online service providers, including Amazon Store, Instagram, Wikipedia, Google, Meta, Microsoft and others, have been designated as VLOPs and VLOSEs (check the full list here). The DSA identifies such companies based on their number of ‘average monthly active recipients’ (i.e., users) in the EU. This means that online platforms and search engines that provide services to 45 million (or more) monthly active EU users are considered VLOPs or VLOEs. The list was made based on the user data these online service providers had to publish by February 17 2023. Platforms and search engines must update these numbers every 6 months, as explained here.

Following their designation, companies must meet a full set of DSA obligations by August 25, 2023. For example, they will need to:

• establish a point of contact in the EU, and depending on the case, a legal representative
• report criminal offenses
• have user-friendly terms of conditions in the languages of the EU countries where they operate
• be more transparent regarding advertising, recommender systems and content moderation decisions
• ban targeted advertising when it comes to sensitive data (e.g. based on sexual orientation, religion, ethnicity)

VLOPs and VLOSEs must also identify and mitigate systemic risks and be subject to annual independent audits. In particular, they will have to put in place reasonable, proportionate and effective mitigating measures tailored to the specific systemic risks that have been identified. Examples of such measures include adapting advertising systems and taking steps to limit or adjust the display of advertisements in connection with the services provided.

It is important to note that irrespective of the self-designation of a platform, the Commission has the final word on whether it should be considered a VLOP or VLOSE. This means that other platforms could be designated while others could be removed. The Commission is already conducting checks on other online service providers, including Spotify and Airbnb, to confirm whether other companies will have to comply with the strictest requirements.

If your company is not a VLOP or VLOSE, the relevant DSA obligations will apply from 17 February 2024.