A VLOP is a Very Large Online Platform: a service the European Commission has designated because it reaches at least 45 million average monthly active recipients in the European Union. Designation is not a finding of wrongdoing. It is a size test, and passing it moves a service from the general rules of the Digital Services Act into a second tier covering systemic risk assessment, independent audits, recommender system choice, advertisement repositories and researcher data access. The regulation is Regulation (EU) 2022/2065. The threshold of 45 million represents roughly 10 percent of the Union's population. The drafters used population share rather than revenue because the harms the law targets scale with reach.

How a service becomes designated

The process starts with self-reporting. Article 24(2) requires every online platform and search engine offering services in the Union to publish, at least once every six months, the average monthly active recipients it reaches there. The first round fell due on 17 February 2023. The Commission reads those disclosures and adopts a designation decision under Article 33.

The unit being counted is defined in Article 3(p). An active recipient is someone who has engaged with the service either by asking it to host information or by being exposed to information the service hosts and disseminates through its interface. The figure is averaged over six months, which stabilises it against seasonal spikes.

The Zalando case shows how contested the arithmetic can be. The Berlin retailer argued that only about 30 million users engaged with the third-party seller listings in its Partner Programme, since only those listings constitute hosted content, while the Commission counted 83 million across the whole site. On 3 September 2025 the General Court dismissed Zalando's challenge to its designation, holding that identical product pages made the direct and third-party exposure impossible to separate. Similar ambiguity persists elsewhere: LinkedIn reports 45.2 million logged-in users alongside 132.5 million logged-out site visits.

Once notified, a provider has four months to comply. The mechanism runs the other way as well: where a service falls below the threshold, the Commission can terminate designation, and the extra duties lapse four months later. Stripchat was de-designated on 27 May 2025.

What attaches on designation

Articles 34 through 43 form the second tier. Article 34 requires an annual assessment of systemic risks in four categories: dissemination of illegal content, effects on fundamental rights, effects on civic discourse, electoral processes and public security, and effects on gender-based violence, the protection of minors and users' physical and mental well-being. Advertising systems are named explicitly among the factors to be assessed, and the mitigation duty in Article 35 can extend to adapting the advertising system itself. Article 37 mandates an annual independent audit, Article 38 at least one recommender option not based on profiling, Article 41 an independent compliance function, and Article 42 transparency reporting every six months.

Article 39 is the provision that reshapes advertising work. Designated services must maintain a public repository of every advertisement presented on their interfaces, accessible through a searchable multi-criteria tool and through an application programming interface, retained for one year after the last presentation. Each entry must carry the creative, the advertiser, the payer where different, the period of display, whether the advertisement was targeted at a specific group, the main parameters used, and reach broken down by member state.

Two adjacent duties are often bundled with VLOP status but bind every online platform. Article 26 requires per-advertisement disclosure of who paid and which parameters determined delivery. Article 28(2) prohibits advertising based on profiling where the platform knows with reasonable certainty that the recipient is a minor. The European Data Protection Board set out where those provisions collide with data protection law in Guidelines 3/2025 on 11 September 2025, noting that Article 26 information reaches a person after processing may already have happened.

Designation also carries a bill. Article 43 requires an annual supervisory fee, calculated under Commission Delegated Regulation (EU) 2023/1127 of 2 March 2023, proportionate to recipients in the Union and capped at 0.05 percent of the provider's worldwide annual net income. Non-compliance exposes a designated service to fines of up to 6 percent of worldwide annual turnover.

Origin and evolution

The Commission proposed the Digital Services Act on 15 December 2020, the same day as the Digital Markets Act. The text was signed on 19 October 2022, published in the Official Journal on 27 October 2022, and entered into force on 16 November 2022. General application followed on 17 February 2024, but designated services were bound earlier by design.

The first designation decisions came on 25 April 2023: 17 Very Large Online Platforms and two Very Large Online Search Engines, with compliance due by 25 August 2023. Adult platforms Pornhub, Stripchat and XVideos followed on 20 December 2023, Shein on 26 April 2024, Temu on 31 May 2024 and XNXX on 10 July 2024. WhatsApp was designated on 26 January 2026 on the basis of 51.7 million monthly users for its Channels feature, with the private messaging service expressly excluded from the definition of an online platform.

Why the label matters commercially

For buyers and sellers, designation converts assertions into inspectable artefacts. Repositories expose campaign-level creative, targeting parameters and member-state reach on services where nothing comparable existed. Apple's filing of 13 August 2026, produced on the Commission's harmonised template, disclosed that advertisements removed from the App Store after publication had already served 12,318,874 impressions in the first half of the year, alongside 687 moderation staff and 153 million average monthly recipients.

Enforcement has attached numbers to the tier. The Commission fined X 120 million euros on 5 December 2025 in the first non-compliance decision, citing an inadequate advertisement repository under Article 39 and blocked researcher access under Article 40(12). X terminated the Commission's own advertising account two days later. TikTok closed a parallel repository case through binding commitments the same day. Larger penalties followed on product safety grounds: 200 million euros against Temu on 28 May 2026 and 550 million euros against AliExpress on 20 July 2026, both under Articles 34 and 35.

IAB Europe's DSA Taskforce, launched in July 2022, published a common data format for transparency disclosures, reaching version 1.2 on 4 December 2025 with disclosure text in 24 languages.

Limitations and disputes

The numbers that trigger designation are supplied by the companies themselves. The Commission publishes them with an explicit caveat that they come from provider transparency reports or websites, without prejudice to any assessment of the methodology.

Article 39 has been litigated hardest. Amazon sought annulment of its designation and interim relief, arguing that publishing the repository would expose confidential commercial information. On 27 September 2023 the President of the General Court suspended the publication obligation while leaving the duty to compile intact. The Court of Justice set that suspension aside on 27 March 2024 in C-639/23 P(R), and the General Court dismissed the main action in T-367/23 on 19 November 2025.

The supervisory fee has fared worse. On 10 September 2025 the General Court annulled the Commission's implementing decisions setting the 2023 fees for Facebook, Instagram and TikTok in cases T-55/24 and T-58/24, while provisionally maintaining their effects.

Enforcement capacity is uneven. Germany's Digital Services Coordinator converted 26 of 2,033 complaints into proceedings and issued no fines during 2025, and six of the eight Article 40 researcher access applications it received were withdrawn. Political criticism has been sustained: a United States House Judiciary Committee report of July 2025 argued the regime pressures American platforms into censorship, a characterisation the Commission has rejected.

Disambiguation

A VLOSE, or Very Large Online Search Engine, sits in the same tier under the same threshold but covers search rather than hosting. Only three services carry it: Google Search, Bing and, since today, ChatGPT.

A gatekeeper is a Digital Markets Act designation. It rests on turnover and market capitalisation, targets competitive conduct, and reaches a different list of firms. The Digital Markets Act and the Digital Services Act were proposed the same day and are routinely conflated.

An online platform is the general category. Articles 26 and 28 bind all of them regardless of size, so a small marketplace carries advertising transparency duties without anything in Articles 34 to 43.

The EEA is not the perimeter. The regulation binds the 27 member states, and incorporation into the EEA agreement remains pending.

Recent developments

The Commission today designated ChatGPT as a Very Large Online Search Engine and Reddit and Roblox as Very Large Online Platforms, on declared figures of 159.1 million, 57.2 million and 46.6 million average monthly users. All three must comply by the end of December 2026, bringing the total to 28 designated services. Roblox sits 1.6 million above the threshold, the narrowest margin apart from XNXX at exactly 45 million.

Each brings live advertising exposure. Reddit reported 762 million dollars in second-quarter 2026 advertising revenue and had already restricted personalisation for EU accounts aged 13 to 15 from 24 June 2026. Roblox appointed SuperAwesome as its sole under-13 advertising partner in June 2026. ChatGPT began serving advertising in Europeweeks before designation.

The enforcement frontier has shifted from transparency toward design. The Commission issued preliminary findings against TikTok on 6 February 2026 and against Instagram and Facebook on 10 July 2026, naming infinite scroll, autoplay, push notifications and recommender systems. An investigation opened on 26 January 2026 into Grok and X's recommender systems tests whether an AI functionality deployed inside a designated service falls within the same perimeter.

Timeline

  • 15 December 2020: European Commission proposes the Digital Services Act
  • 19 October 2022: Regulation (EU) 2022/2065 signed
  • 27 October 2022: Published in the Official Journal
  • 16 November 2022: Entry into force
  • 17 February 2023: First Article 24(2) user-number publication deadline
  • 2 March 2023: Delegated Regulation (EU) 2023/1127 sets supervisory fee methodology
  • 25 April 2023: First designations, 17 VLOPs and 2 VLOSEs
  • 25 August 2023: Additional obligations become applicable to the first cohort
  • 27 September 2023: General Court suspends Amazon's Article 39 publication duty
  • 20 December 2023: Pornhub, Stripchat and XVideos designated
  • 17 February 2024: Digital Services Act becomes generally applicable
  • 27 March 2024: Court of Justice sets aside the Amazon suspension in C-639/23 P(R)
  • 26 April 2024: Shein designated
  • 31 May 2024: Temu designated
  • 10 July 2024: XNXX designated
  • 27 May 2025: Stripchat designation terminated
  • 3 September 2025: General Court dismisses Zalando's challenge
  • 10 September 2025: General Court annuls 2023 supervisory fee decisions for Facebook, Instagram and TikTok
  • 29 October 2025: Delegated act on researcher data access enters into force
  • 19 November 2025: General Court dismisses Amazon in T-367/23
  • 5 December 2025: X fined 120 million euros in the first non-compliance decision
  • 26 January 2026: WhatsApp designated on 51.7 million Channels users
  • 28 May 2026: Temu fined 200 million euros
  • 20 July 2026: AliExpress fined 550 million euros
  • 31 August 2026: ChatGPT designated as a VLOSE, Reddit and Roblox as VLOPs
  • End of December 2026: Compliance deadline for the three newest designations

Summary

Who: The European Commission designates and supervises, working with national Digital Services Coordinators such as Coimisiun na Mean in Ireland, the Authority for Consumers and Markets in the Netherlands and the Bundesnetzagentur in Germany. Twenty-eight services carry designation as of today, operated by Alphabet, Amazon, Apple, Meta, Microsoft, ByteDance, OpenAI, Reddit, Roblox, Snap, Pinterest, Zalando, Booking, Wikimedia, X and several marketplaces and adult platforms.

What: A designation under Article 33 of Regulation (EU) 2022/2065 for online platforms reaching at least 45 million average monthly active recipients in the Union. It triggers Articles 34 to 43: systemic risk assessment, mitigation, crisis response, annual independent audit, a non-profiling recommender option, a public advertisement repository, researcher data access, a compliance function, six-monthly transparency reporting and an annual supervisory fee. Fines reach 6 percent of worldwide turnover.

When: The regulation entered into force on 16 November 2022. The first 19 services were designated on 25 April 2023 and bound from 25 August 2023. General application followed on 17 February 2024. Designations have continued through August 2026.

Where: The 27 European Union member states. Incorporation into the European Economic Area agreement remains pending, so obligations do not automatically extend to Iceland, Liechtenstein and Norway.

Why: The drafters concluded that services reaching a tenth of the Union's population create risks that general platform rules cannot address, and that supervision of those risks required a central regulator with investigative powers rather than 27 national ones acting alone.