A VLOP, short for very large online platform, is an online platform that the European Commission has designated under the Digital Services Act because it reaches at least 45 million average monthly active recipients in the European Union, about 10 percent of the EU population. Designation triggers the strictest tier of DSA obligations, centered on identifying and reducing systemic risks that the platform creates for society.
In platform regulation, the VLOP category reflects a simple principle: obligations grow with reach. A small forum and a social network with hundreds of millions of users both host content, but only the latter can shape public debate, elections or public health at a continental scale, so only the latter carries the full set of risk management, audit and transparency duties.
How a platform becomes a VLOP
Every online platform and search engine in the EU must publish its average monthly active recipients at least once every six months. When the figure reaches the 45 million threshold, the Commission designates the service as a VLOP, or as a VLOSE if it is a very large online search engine. The obligations apply four months after notification of the designation.
The counting method matters. Recipients are counted per service, averaged over six months, and include users who were exposed to content even without registering. Providers sometimes contest their figures or their designation in court, but the obligations apply during the dispute unless a court suspends them.
| Element | Rule | Practical effect |
|---|---|---|
| User threshold | 45 million average monthly active recipients in the EU | Adjustable by the Commission if the population changes |
| Reporting cycle | User numbers published every six months | Allows the Commission to detect new candidates |
| Start of obligations | Four months after designation | Time to build compliance processes |
| Supervisor | European Commission for VLOP-specific duties | Direct EU-level enforcement |
| End of designation | Below the threshold for a full year | Commission may terminate the designation |
Obligations specific to very large online platforms
A VLOP must meet all obligations that apply to ordinary platforms, such as notice and action procedures, statements of reasons and cooperation with trusted flaggers. On top of these, Section 5 of Chapter III of the DSA adds a specific layer of duties.
| Obligation | Content | Frequency |
|---|---|---|
| Systemic risk assessment | Analyze risks to rights, civic discourse, elections, public health and minors | At least once a year and before launching critical features |
| Risk mitigation | Adapt design, moderation, algorithms and advertising | Ongoing |
| Independent audit | External audit of compliance with DSA duties | At least once a year |
| Non-profiling recommender option | At least one feed option not based on profiling | Permanent |
| Ad repository | Public searchable archive of advertisements | Kept for one year after the last display |
| Researcher data access | Data for vetted researchers studying systemic risks | On reasoned request |
| Compliance function | Independent internal compliance officers | Permanent |
| Transparency reports | Moderation reports and risk documentation | Every six months |
| Supervisory fee | Annual fee to fund Commission supervision | Capped at 0.05 percent of worldwide net income |
The crisis response mechanism adds a further tool. In a serious threat to public security or public health, the Commission can require VLOPs to assess and address how their services contribute to the crisis, for a limited period.
In practice, the risk assessment is the center of the whole regime. It must consider how recommender systems, content moderation, terms and conditions, advertising systems and data practices influence each risk, and the mitigation measures and audit then follow from it. A weak assessment therefore tends to produce findings across every other obligation.
VLOP compared with related categories
The VLOP label is often confused with the gatekeeper concept of the Digital Markets Act. The two regimes pursue different goals and use different criteria, although some large companies fall under both.
| Category | Legal basis | Main concern | Designation criterion |
|---|---|---|---|
| Online platform | DSA | Illegal content and user rights | Hosts and disseminates user content to the public |
| VLOP | DSA | Systemic societal risks | At least 45 million monthly EU recipients |
| VLOSE | DSA | Systemic risks from search | Search engine with the same threshold |
| DMA gatekeeper | DMA | Fair and contestable digital markets | Turnover, market value and user thresholds per core platform service |
Enforcement and penalties
The Commission supervises VLOPs directly and can request information, conduct inspections and interview staff. When it suspects an infringement, it can open formal proceedings, adopt interim measures and accept binding commitments from the provider.
Fines for breaching the DSA can reach 6 percent of worldwide annual turnover, and periodic penalty payments can reach 5 percent of average daily worldwide turnover for each day of delay. As a last resort, after repeated serious infringements, a temporary restriction of access to the service in the EU can be requested from national courts.
Practical challenges and common misunderstandings
- VLOP status does not depend on company size. It depends only on EU users of a specific service, so one company can operate several VLOPs.
- Systemic risk is broader than illegal content. Risk assessments must also cover lawful but harmful effects, such as on mental health or civic discourse.
- Audits require evidence. Auditors need documented processes, metrics and test results, not policy statements.
- Recommender alternatives must be real. A non-profiling feed must be easy to find and select, not hidden in settings.
- Researcher access raises data protection questions that must be solved through secure access environments.
The short version
A VLOP is an online platform so big that more than one in ten people in the EU use it every month. Because what happens on such a service can affect elections, health or the safety of children across Europe, it must follow extra rules.
It has to study the risks it creates, fix them, let outside auditors check its work and offer a feed that is not based on tracking. The European Commission watches these platforms directly.
Where it makes a difference
A video-sharing service grows quickly and reports 48 million average monthly active recipients in the EU in its six-monthly publication. The Commission designates it as a VLOP, and four months later the new obligations apply.
The provider sets up an independent compliance function and runs its first systemic risk assessment, which identifies risks from autoplay features for minors and from coordinated disinformation during national elections. As mitigation, it disables autoplay by default for teenage accounts, adds a chronological feed that does not use profiling and builds a public ad repository. A year later, the external auditor confirms most measures but notes gaps in the documentation of election risks, and the provider publishes an implementation report describing how it will close them.