A DMA gatekeeper is a company that the European Commission has designated under the Digital Markets Act (DMA) because it provides at least one core platform service that serves as an important gateway between businesses and consumers and holds an entrenched and durable position. Designation triggers a fixed list of obligations and prohibitions that apply without the need to prove harm case by case.
In platform regulation, the gatekeeper concept is the central tool of the DMA. Unlike competition law, which intervenes after an abuse is shown, the DMA works ex ante: it sets rules in advance for the few firms whose scale lets them act as private rule-makers for entire digital markets.
How a company becomes a DMA gatekeeper
Designation follows three qualitative criteria (significant impact, important gateway, entrenched position), each with a quantitative presumption. A company that meets the thresholds must notify the Commission within two months, and the Commission then decides on designation within 45 working days.
| Criterion | Presumption threshold | What it captures |
|---|---|---|
| Economic weight in the union | Annual union turnover from 7.5 billion euros, or a market value from 75 billion euros, plus presence in three or more member states | Scale of the undertaking |
| Gateway for business users | Over 45 million end users each month and over 10,000 business users each year, counted within the EU | Control over access to customers |
| Lasting market position | User thresholds reached in three consecutive financial years | Stability of the position |
The presumption is rebuttable, but only with substantiated arguments showing that, exceptionally, the service is not an important gateway despite the numbers. The Commission can also designate a company that misses the thresholds through a market investigation based on qualitative factors.
Core platform services covered by the DMA
Designation is service-specific: a gatekeeper is bound only for the core platform services listed in its designation decision. The DMA defines ten categories.
| Category | Typical example | Typical concern |
|---|---|---|
| Online intermediation services | App stores, marketplaces | Fees, anti-steering, ranking |
| Online search engines | General web search | Self-preferencing, data access |
| Online social networking services | Social media platforms | Data combination, lock-in |
| Video-sharing platform services | Video hosting platforms | Data use, advertising |
| Number-independent messaging | Messaging apps | Lack of interoperability |
| Operating systems | Mobile and desktop systems | Default settings, sideloading |
| Web browsers | Browser engines and apps | Defaults and engine restrictions |
| Virtual assistants, cloud and online advertising | Voice assistants, cloud platforms, ad networks | Bundling, opaque pricing |
The first designations in September 2023 covered six companies and more than twenty services, and later decisions added further companies and services. Some services were found not to be gateways after rebuttal or market investigation, which shows that size alone does not settle designation.
Obligations that apply to gatekeepers
Gatekeepers must comply with their obligations within six months of designation. The rules target practices that lock in users, exclude rivals or exploit business users.
| Obligation | Practice addressed | Expected effect |
|---|---|---|
| Ban on self-preferencing | Ranking own products above rivals | Fair visibility for competitors |
| Consent for data combination | Merging personal data across services | User control over profiling |
| Freedom to steer | Blocking offers outside the platform | Lower prices, direct customer relations |
| Alternative app distribution | Single official app store only | Competing stores and sideloading |
| Messaging interoperability | Closed messaging ecosystems | Cross-service messages |
| Choice screens and uninstallation | Locked defaults | Easier switching |
| Data portability and access | Data kept from users and business users | Easier switching and analytics |
Some obligations are self-executing, while others can be specified by the Commission in a dedicated procedure. Gatekeepers may not circumvent obligations through design, contract terms or dark patterns, and they must inform the Commission of every intended acquisition in the digital sector.
Compliance reporting and enforcement
Each gatekeeper must publish an annual compliance report, submit an independently audited description of its consumer profiling techniques, and maintain a compliance function independent of operational management.
Penalties are severe. Fines may reach 10 percent of global annual turnover, or up to 20 percent for repeated infringements, plus periodic penalty payments. In cases of systematic non-compliance, the Commission may order behavioral remedies or, as a last resort, structural remedies such as divestiture. The first non-compliance decisions with fines were adopted in 2025.
Enforcement is centralized in the European Commission, with national competition authorities able to support investigations. Private parties can also bring claims in national courts based on breaches of the DMA.
In practice, most disputes concern how a gatekeeper implements an obligation, not whether the obligation exists. New fee structures, warning screens, eligibility conditions for alternative stores and consent designs are all examined for whether they make the right effective in practice. Business users therefore document concrete obstacles, because evidence of real-world friction carries more weight than abstract objections.
How the gatekeeper regime differs from neighboring rules
The gatekeeper status is easily confused with designations under the Digital Services Act (DSA), where very large online platforms (VLOPs) are defined by user numbers alone. The two regimes address different problems: the DMA targets market contestability and fairness, while the DSA targets content moderation and systemic societal risks.
- DMA gatekeeper: conduct rules for economic power over core platform services.
- DSA VLOP: risk management duties for platforms with at least 45 million EU users.
- Competition law: case-by-case enforcement after proving dominance and abuse.
- National rules: some states add their own regimes for platforms of paramount significance.
A company can be a gatekeeper and operate VLOPs at the same time, and it must then satisfy both regulations in parallel, coordinated by different teams within the Commission.
The simple explanation
Some tech companies are so large that many businesses can only reach customers through them, for example through an app store or a search engine. The European Union calls these companies gatekeepers, because they control the gate between sellers and buyers.
Once a company is named a gatekeeper, it must follow a fixed set of fairness rules. It may not favor its own products, must let users choose other apps and services, and must ask before combining personal data. Breaking the rules can cost a share of worldwide revenue.
How it is used in practice
A music streaming service distributes its subscription app through a mobile app store operated by a designated gatekeeper. Before the DMA applied, the store’s terms prevented the service from telling users inside the app that subscriptions were cheaper on its own website.
After the gatekeeper’s compliance deadline, the streaming service updates its app to inform users about its web offer and to link to it, relying on the freedom-to-steer obligation. It also tests distribution through an alternative app store in the EU and asks the gatekeeper for access to data generated by its users, as the DMA allows.
When the service believes that new fees and warning screens undermine these rights, it files a complaint with the Commission. The regulator can examine whether the gatekeeper’s implementation complies, a route that would previously have required years of competition proceedings.