Under the provisions of the Digital Markets Act (DMA), the European Commission on Wednesday identified six gatekeepers for the first time, namely Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft.

These designated companies should be more transparent, provide users with more installation options, and provide interoperability with services from other competing companies.

In total, 22 main platform services provided by access controllers were identified. The six access controllers will now have six months to fully comply with the obligations set out in the Digital Markets Regulation for each of the identified core platform services they provide.

A list of 22 applications

What are the 22 services: TikTok, Facebook, Instagram, LinkedIn, Google Maps, Google Play, Google Shopping, Amazon Marketplace, iOS App Store, Meta Marketplace, Google, Amazon, Meta, Chrome, Safari, Google Android, iOS, Windows PC OS , WhatsApp, Facebook Messenger, Google search engine and YouTube platform.

The European Commission may designate digital platforms that provide a critical access point between businesses and consumers for the platform’s core services as “access controllers.”

There are three main quantitative criteria on the basis of which a company can be considered an access controller within the meaning of the definition in the Digital Markets Regulation: (i) when the company reaches a certain annual turnover in the European Economic Area and provides the main platform service in at least three EU Member States; (ii) when the company provides an essential platform service to more than 45 million monthly active end users based or located in the EU and to more than 10,000 active business users based in the EU annually, and (iii) when, when the company has met the second criterion for the past three years.

In parallel, the Commission launched four market investigations to examine in more detail the information provided by Microsoft and Apple, citing that, although these companies meet the necessary thresholds, some of their core platform services do not qualify as hotspots. accession:

Microsoft: Bing, Edge and Microsoft Advertising

Apple: iMessage

According to the Digital Markets Regulation, the aim of these investigations is to establish whether, on the basis of sufficiently reasoned objections presented by the companies concerned, it can be demonstrated that the services concerned should not be labeled. The investigation must be completed within a maximum of 5 months.

In addition, the Commission launched a market investigation to examine in more detail whether the iPadOS system developed by Apple should be labeled as an access controller, even though it does not meet the necessary thresholds. According to the Digital Markets Regulation, the investigation must be completed within a maximum of 12 months.

The panel also concluded that while Gmail, Outlook.com and Samsung’s Internet browser meet the thresholds set by the Digital Markets Regulation, thus satisfying the criteria for defining access controllers, Alphabet, Microsoft and Samsung have provided sufficiently substantiated arguments that these services do not qualify as access points for relevant core platform services. Therefore, the Commission decided not to designate Gmail, Outlook.com and the Samsung Internet browser as core platform services. As such, Samsung is not designated as an access controller for any critical platform service.

What’s next for assigned access controllers?

Designated access controllers now have six months to comply with the full list of obligations and prohibitions set out in the Digital Markets Regulation, which gives end-users and businesses using the services provided by access controllers a wider range of options and a lot of freedom.

However, some obligations will apply from the moment of designation, such as the obligation to inform the Commission of any planned concentration.

It is the responsibility of the designated companies to ensure compliance with the obligations included in this list and to demonstrate effective compliance with these obligations. To this end, relevant companies have 6 months to submit a detailed compliance report describing the measures taken to fulfill each of the obligations set out in the Digital Markets Regulation.

The Commission will monitor the effective implementation and compliance with these obligations. If an access controller fails to comply with the obligations set out in the Digital Markets Regulation, the Commission may impose fines of up to 10% of the total worldwide turnover of the relevant company or, in case of repeated violations, up to 20% of the relevant turnover.

In case of systematic violations, the Commission can also take additional corrective measures, for example, require the access controller to sell the commercial activity or parts of it or prohibit the access controller from buying additional services related to the systematic violation.

In future, other companies will also be able to submit notifications to the Commission under the Digital Markets Regulation based on their own assessment of whether the relevant thresholds have been met. In this context, the Commission continues to conduct constructive discussions with all interested companies.

The purpose of the Digital Markets Regulation is to prevent access controllers from imposing unfair conditions on companies and end users and to ensure the openness of important digital services.

In December 2020, the Commission presented, in addition to the Digital Markets Regulation, a proposal for a Digital Services Regulation aimed at addressing the negative consequences arising from certain behaviors of online platforms that act as controllers of access to the EU single market.

The Digital Markets Regulation, which entered into force in November 2022 and applies from May 2023, aims to ensure competitive and fair markets in the digital sector. It regulates the activities of access controllers, i.e. large online platforms that provide an important access point between user companies and consumers and that, because of their position, can create bottlenecks in the digital economy.

Companies that provide at least one of the ten core platform services listed in the Digital Markets Regulation are considered access controllers if they meet the criteria below.

These main platform services are: online intermediary services such as app stores, online search engines, social networking services, certain messaging services, video sharing platform services, virtual assistants, web browsers, cloud computing, operating systems, online marketplaces and advertising services. The same company can be designated as the access controller for several core services of the platform.

The Digital Markets Regulation sets out a number of specific obligations that access controllers must comply with, which include the prohibition of certain conduct, the obligations listed in the list of what is allowed and what is prohibited.

The Digital Markets Regulation also empowers the Commission to conduct market research to: (i) designate different companies as access controllers based on qualitative criteria; (ii) update the obligations of access controllers when necessary; (iii) develop corrective measures in response to systematic violations of the provisions of the Digital Markets Regulation.