DSA: extra obligations for very large online platforms (VLOPs)

Short answer: Platforms with more than 45 million monthly active users in the EU are designated by the European Commission as Very Large Online Platforms (VLOPs) or Very Large Online Search Engines (VLOSEs). They are subject to the heaviest obligations under the DSA (Articles 33–43) and are supervised directly by the Commission rather than a national authority. The current Commission list (updated 28 May 2026) counts 23 designated VLOPs and 2 VLOSEs, including WhatsApp (designated 26 January 2026) and excluding Stripchat (designation terminated 27 May 2025).

Threshold and designation (Article 33 DSA)

A platform is designated as a VLOP once it reaches more than 45 million monthly active users in the EU over the course of a year. Designation is carried out by the European Commission through a formal decision. Designated platforms have four months to achieve full compliance with all VLOP obligations. Well-known designated VLOPs include Facebook, Instagram, YouTube, TikTok, X, LinkedIn, Amazon Store, AliExpress, Booking.com and Zalando; the two VLOSEs are Google Search and Bing.

Systemic risk assessment and mitigation (Articles 34 and 35 DSA)

VLOPs must conduct a thorough assessment of systemic risks arising from their service at least once a year. Risks covered include the spread of illegal content, harm to fundamental rights (freedom of expression, media freedom, non-discrimination), threats to public health, negative effects on electoral processes, and harm to minors. On the basis of that assessment, platforms must implement reasonable mitigation measures and report on them.

Independent annual audit (Article 37 DSA)

VLOPs and VLOSEs are required to have their compliance assessed at least once a year by an independent auditor. Platforms must implement recommendations from the audit report and produce an audit implementation report. Both the risk assessment report and the audit report must be transmitted without undue delay to the Commission and the competent national Digital Services Coordinator (DSC).

Algorithmic transparency and advertising repository (Articles 38 and 39 DSA)

VLOPs must offer users at least one option in recommender systems that is not based on profiling (Article 38). They are also required to maintain a publicly accessible repository of all advertisements displayed, including targeting parameters — for the duration of the display period plus at least one year thereafter (Article 39).

Researcher data access and crisis protocol (Articles 40 and 36 DSA)

Vetted researchers and the Commission may request access to platform data to analyse systemic risks (Article 40). In the event of serious societal crises, the Commission may impose additional emergency measures (Article 36).

Supervision and enforcement

The European Commission is the exclusive supervisor for VLOPs and VLOSEs. In the event of an infringement, it may impose a fine of up to 6% of global annual turnover (Article 74 DSA). In the case of repeated infringements, temporary restriction of access to the EU market may be imposed.