The DMA for business users

The legal framework

The Digital Markets Act (DMA) is Regulation (EU) 2022/1925. It entered into force on 1 November 2022 and has applied since 2 May 2023. It sets fixed rules for a small number of very large digital companies, the gatekeepers. It does not ask you to prove that a practice harms competition in a given market: the listed practices are prohibited or required as such. For businesses that depend on those platforms, it is a rulebook you can point to.

Who is a business user

A business user is anyone acting in a commercial or professional capacity who uses a core platform service to provide goods or services to end users (Article 2(21)). A Belgian webshop that sells through a large online marketplace qualifies, and so does an app developer distributing through an app store. The DMA protects business users established in the EU and end users established or located in the EU, wherever the gatekeeper is based (Article 1(2)).

The core platform services are listed in Article 2(2): online intermediation services (including app stores), online search engines, online social networking, video-sharing platforms, number-independent messaging, operating systems, web browsers, virtual assistants, cloud computing and online advertising services provided by a company that offers one of the other services.

Who is a gatekeeper

Under Article 3, the Commission designates a company as a gatekeeper if it has a significant impact on the internal market, runs a core platform service that is an important gateway for business users to reach end users, and has an entrenched and durable position. It is presumed to meet those criteria when:

• its annual EU turnover is at least EUR 7.5 billion in each of the last three financial years, or its average market capitalisation reached at least EUR 75 billion in the last financial year, and it provides the same core platform service in at least three Member States;
• that service has at least 45 million monthly active end users in the EU and at least 10,000 yearly active business users established in the EU;
• the user thresholds were met in each of the last three financial years.

The designation decision lists the specific core platform services concerned (Article 3(9)), and the obligations apply only to those services. The gatekeeper has six months after a service is listed to comply (Article 3(10)). The Commission publishes and updates the list of gatekeepers and their services (Article 4(3)). Check that official list before relying on the DMA against a particular platform: the rules do not apply to a service that is not on it.

Article 5: obligations that apply as written

Article 5 contains the obligations most directly useful to business users:

• No parity clauses (Article 5(3)). The gatekeeper may not prevent you from offering the same products or services through other intermediaries or your own website at different prices or conditions.
• Steering your customers (Article 5(4)). You may communicate and promote offers, free of charge, to end users you acquired through the platform or elsewhere, and conclude contracts with them, whether or not you use the platform for that.
• Purchases made elsewhere (Article 5(5)). End users must be able to access and use content, subscriptions or features in your app that they bought from you outside the platform.
• Right to complain (Article 5(6)). The gatekeeper may not prevent or restrict you from raising non-compliance with any public authority, including national courts. Lawful complaint procedures in your agreement remain possible.
• No tying to the gatekeeper's services (Article 5(7) and (8)). The gatekeeper may not require you to use, offer or interoperate with its identification service, web browser engine or payment service (including in-app payment systems), and may not make access to one listed core platform service conditional on registering for another.
• Price transparency in advertising (Article 5(9) and (10)). Advertisers and publishers can ask for free daily information on prices, fees and the metrics used, for each ad.

Article 5(2) also restricts how the gatekeeper combines and cross-uses personal data of end users without their consent, which limits what it can learn about your customers across its services.

Article 6: obligations that may be further specified

Article 6 applies just as directly, but the Commission can specify how a gatekeeper must comply (Article 8). For business users the key paragraphs are:

• Your data is not the gatekeeper's competitive asset (Article 6(2)). It may not use non-public data generated or provided by business users, or by their customers, to compete with them. Click, search, view and voice data are expressly included.
• Alternative app distribution (Article 6(4)). Third-party apps and app stores must be installable and usable on the gatekeeper's operating system, subject to strictly necessary and duly justified security measures.
• No self-preferencing in ranking (Article 6(5)). The gatekeeper may not rank its own products or services more favourably than similar third-party ones, and must apply transparent, fair and non-discriminatory ranking conditions.
• Interoperability (Article 6(7)). Business users and providers of ancillary services get free, effective interoperability with the same operating system, hardware and software features the gatekeeper uses itself.
• Advertising measurement (Article 6(8)). Advertisers and publishers get free access to the gatekeeper's performance measuring tools and the data needed for independent verification.
• Access to your data (Article 6(10)). On request and free of charge, you get effective, high-quality, continuous and real-time access to aggregated and non-aggregated data provided or generated through your use of the service and your customers' engagement with your products. Personal data is included only where it is directly connected with that use and the end user has opted in.
• Fair access conditions (Article 6(12)). For listed app stores, search engines and social networks, general conditions of access must be fair, reasonable and non-discriminatory, and the gatekeeper must publish them with an alternative dispute settlement mechanism.
• Leaving (Article 6(13)). Termination conditions may not be disproportionate and must be exercisable without undue difficulty.

Article 7: messaging interoperability

Article 7 obliges a gatekeeper with a listed messaging service to make its basic functions interoperable, free of charge and on request, with other providers offering or intending to offer such services in the EU. Text and file sharing between two users comes first, group messaging within two years of designation, and voice and video calls within four years. The gatekeeper publishes a reference offer, and must meet a reasonable request within three months. This matters mainly if you run, or plan, a messaging service yourself.

Anti-circumvention and enforcement

The gatekeeper may not undermine these duties through contract terms, technical measures or interface design, nor degrade the service for business users who use their rights (Article 13(4) and (6)). Where consent is needed for data processing, it must let business users obtain that consent directly, and may not make it harder for them than for its own services (Article 13(5)).

Enforcement lies with the Commission. Any business user may inform the Commission or a national competent authority about a practice that falls within the DMA, although neither is obliged to follow up (Article 27). Fines can reach 10 % of worldwide turnover, and 20 % for a repeat of the same or a similar infringement (Article 30). National courts can also apply the DMA; Article 39 sets out how they cooperate with the Commission and bars them from ruling against a Commission decision.

In practice

Example: a webshop selling through a marketplace

A Belgian maker of kitchenware sells through its own webshop and a large marketplace that is listed as a core platform service. The marketplace terms require that its price is never higher than elsewhere. If the marketplace is a designated service, that clause runs into Article 5(3). The company also wants to email marketplace buyers about its own loyalty programme. Article 5(4) allows it to promote offers to end users it acquired via the platform, but the company still needs a lawful basis under the GDPR for using their contact details.

Example: an app developer

A Flemish developer sells a language course app with a subscription. Under Article 5(7), a designated gatekeeper cannot require the developer to use its in-app payment system. Under Article 5(5), users who subscribed on the developer's website must be able to use their subscription inside the app. Under Article 6(10), the developer can request real-time data about how users engage with its app on the platform. The developer reads the gatekeeper's published conditions closely, since they set how those rights are exercised in practice.

Steps you can take

1. Check the official list. Confirm that the gatekeeper and the specific core platform service you use are designated. If not, the DMA does not help, though other rules may.
2. Map your contract. Compare your platform terms with Articles 5 and 6: price parity, restrictions on contacting customers, mandatory payment or login services, data use and termination.
3. Ask for your data in writing. Make a precise Article 6(10) request: which data, which format, how often.
4. Document refusals. Keep emails, screenshots of interfaces and changes in conditions. They support a complaint to the Commission or a claim before a national court.
5. Consider the internal route. For app stores, search engines and social networks, the published conditions must include an alternative dispute settlement mechanism (Article 6(12)), and Article 5(6) guarantees you can still go to an authority.

Frequently asked questions

Can a smaller platform rely on the DMA too?

No. The DMA applies only to designated gatekeepers and only for the core platform services listed in their designation decision. Smaller platforms are covered by other rules, such as the Digital Services Act.

Can I sue a gatekeeper in a national court?

The DMA anticipates proceedings before national courts and regulates their cooperation with the Commission in Article 39. Whether and how you can claim damages depends on national procedural law, so take advice before starting.

Does the gatekeeper have to give me personal data about my customers?

Only within limits. Article 6(10) covers personal data directly connected with your customers' use of your products on the platform, and only where they have opted in to that sharing. You then become responsible for that data under the GDPR.

Does the DMA stop a gatekeeper from removing my listing for infringing content?

No. The DMA governs the business relationship. Notices about illegal content are handled under the Digital Services Act, as explained in our article on the DSA as a brand-protection tool.

How this connects

The DMA turns a dependence on a large platform into rights you can invoke, but only if your contracts and data requests are precise. Our commercial contracts team reviews platform terms with our contract review playbook and follows up the rights you gain in the rights and obligations register. When you want to use or share the data you obtain under Article 6(10), see data licensing and sharing.

At a glance

• Provisions cited: Regulation (EU) 2022/1925, Articles 1, 2, 3, 4, 5, 6, 7, 8, 13, 27, 30, 39 and 54.
• Key dates: in force 01-11-2022; applies 02-05-2023; gatekeeper must comply within six months after a core platform service is listed in its designation decision.
• In this series: the DSA as a brand-protection tool; platform and marketplace duties under the DSA.
• Related reading: the EU Data Act.