DMA: Milestones and changes for platforms and their clients until 2026

The Digital Markets Act (DMA) sets obligations for specific companies operating core platform services and designated as gatekeepers by the European Commission. Its goal is to make these markets more contestable and fair. It does not apply indiscriminately to all tech firms nor automatically turn a large company into a gatekeeper: designation applies to specific services following the regulation's criteria.

The first practical step for a company using a platform is to check which service is designated, not just look at the provider's name. Alphabet, Amazon, Apple, ByteDance, Meta, and Microsoft were the first six companies designated in September 2023; their obligations covered the services specified in the Commission's decisions. Designations and scope can evolve, so a commercial relationship with one of these companies does not mean every product is subject to the DMA.

The rule also does not replace the General Data Protection Regulation (GDPR). In data matters, both frameworks can impact the same activity: the DMA imposes specific obligations on gatekeepers, while the GDPR continues to regulate personal data processing. For compliance officers, the consequence is to coordinate competition and privacy analysis rather than treating consent or data access as isolated issues.

The European Parliament and the Council approved the DMA in 2022. The regulation was published in the Official Journal of the European Union on October 12 of that year and entered into force on November 1. This date did not mark the immediate start of all obligations for each company: the timeline included implementation stages and a specific process to identify gatekeepers and their services.

In September 2023, the Commission designated six companies: Alphabet, Amazon, Apple, ByteDance, Meta, and Microsoft. This designation triggered a six-month period for the concerned services to adjust to applicable obligations. The relevant regulatory date for many changes was March 6, 2024, not the general entry-into-force date of the regulation.

The distinction between company and service matters in daily management. A company may provide multiple services, but the scope depends on which were included in designation decisions and corresponding obligations. Contracts, data flows, and integrations should identify the platform and service involved; a matrix by provider without this level of detail can hide distinct obligations.

From March 6, 2024, designated gatekeepers had to comply with relevant obligations and submit reports describing their measures. The DMA covers behaviors such as favoring own services, limiting certain commercial communications with users, or combining personal data between services without required consent. Each obligation has its own conditions and scope.

Google announced changes on March 5, 2024, preparing for compliance in the European Economic Area. These included choice screens for certain settings, options to decide on linking some services, and adjustments to search results. It also noted changes for developers, including billing programs and links to external offers in Google Play. These are measures communicated by Google, not an independent evaluation that each definitively satisfies all regulatory requirements.

For businesses relying on search, advertising, app stores, or analytics, changes can alter how they acquire customers and measure results. Google warned that search adjustments could modify traffic received by certain intermediaries and direct providers. The operational implication is to review both attribution and acquisition channels, without assuming that pre-March 2024 positions or user journeys will remain the same.

Companies selling through platforms should review, at minimum, whether they can communicate with clients outside the service, what data they receive to measure campaigns, which payment or distribution options are enabled, and what conditions govern each integration. The analysis should not be limited to the provider's general policy: the effective configuration of the service and the European market determines which options are available in each case.

The DMA does not turn every data processing into a matter resolved by a single consent box. Article 5(2) limits the use of personal data between services of a gatekeeper, among other situations, when the required choice has not been offered and corresponding consent obtained. The GDPR remains applicable, so an option presented to the user must also be evaluated under data protection rules.

In April 2025, the Commission adopted a decision on Meta and Article 5(2) of the DMA, related to its advertising model and the choice offered to users. Meta appealed this decision before the General Court of the European Union; the appeal was published in the Official Journal in October 2025. Filing an appeal does not equate to a judgment nor does it automatically annul the challenged decision. It is therefore important to distinguish between administrative decisions, pending appeals, and final judicial rulings.

An earlier judicial milestone often confused with this litigation is the Meta Platforms and others case, resolved by the Court of Justice of the European Union on July 4, 2023. That case dealt, among other aspects, with the application of the GDPR to Facebook and the legal basis for certain processing; it was not a 2025 judgment on the DMA nor a general exemption for Meta from the regulation. The date and legal framework of the ruling change its meaning for legal and commercial teams.

In April 2025, a CeCo analysis of the second year of reports observed differences between companies' compliance strategies and described procedures initiated by the Commission. This analysis is an independent interpretation, not an official Commission balance nor a decision declaring all corporate measures compliant. For a company using these platforms, it is more useful to separate effectively deployed changes from assessments of supervision effectiveness.

The DMA timeline contemplates a Commission review and the submission of a report to the European Parliament, the Council, and the European Economic and Social Committee before May 3, 2026. A scheduled review date does not by itself prove that the report has been published, nor does it credit the adoption of new interoperability guidelines. Nor should the 2026 date be treated as proof of a judgment on Meta Marketplace: the source describing that partial annulment is dated June 2026 and refers to another matter and another service.

As of June 2026, Tirant reported that the General Court partially annulled the designation of Meta Marketplace as a gatekeeper, but maintained that of Messenger. According to that coverage, the annulment was related to the evaluation of changes introduced in Marketplace and the reasoning of the Commission's decision. The result affects the designation of that specific service, it does not remove Meta's status as a designated company nor equate to an exemption from all its obligations under the DMA.

The DMA can translate into changes in distribution, measurement, payments, and data access for companies selling, advertising, or developing services on designated platforms. Not all user companies have direct gatekeeper obligations; nevertheless, they can be affected by modifications in platform rules. The priority is to identify specific dependencies and plan alternatives when a channel significantly influences sales or acquisition.

A useful internal review can be organized into four checks:

• Identify the specific service and verify if it appears in a current designation decision.
• Record what data, metrics, and measurement tools the provider offers and under what conditions.
• Check billing, distribution, client communication, and external offer link options.
• Update forecasts and acquisition processes if a modification can change traffic, conversion, or attribution.

Regulatory monitoring also requires separating three states: an already applicable obligation, an announced corporate measure, and an ongoing dispute. They are not equivalent. For compliance officers, the practical decision is to document which change affects their operation, who communicates it, and from when it applies; for commercial teams, it is to maintain more than one acquisition path and keep comparable measurements when platform rules change. The DMA does not guarantee by itself that an alternative is cheaper or that traffic will redistribute in a specific way.