For two decades, the rules of the digital economy were written in Silicon Valley boardrooms, not in European parliaments. A handful of platforms decided which apps you could install, which payment system you had to use, whose content was seen, and what happened to your data. Europe largely watched from the sidelines — writing the checks and absorbing the dependencies.
That era is ending. With the Digital Markets Act (DMA) and the Digital Services Act (DSA), the EU has moved from reacting to individual abuses to setting the ground rules in advance. Together with the GDPR and the new Data Act, these regulations form the backbone of a European strategy that treats digital infrastructure as a matter of sovereignty, not just consumer protection. For businesses and public bodies, they are not abstract Brussels paperwork — they are levers you can actually use.
Two laws, one goal
The DMA and DSA entered into force together in late 2022 and reached full effect in 2024. They tackle two different problems with the same underlying ambition: an open, contestable, accountable digital market that answers to European rules.
The DMA is competition law reimagined. Instead of chasing abuses through years of litigation after the damage is done, it sets clear obligations in advance for the largest players — the so-called gatekeepers. The DSA is about responsibility: it forces platforms to be transparent about how they moderate content, rank information, and target advertising, and it gives users and regulators real insight into systems that were previously black boxes.
Crucially, both laws apply regardless of where a company is headquartered. A platform serving European users must follow European rules. That principle — the rulebook follows the user, not the corporate address — is the quiet heart of digital sovereignty.
Who counts as a gatekeeper
The DMA does not regulate the whole market. It targets firms that control critical bottlenecks between businesses and their customers. In September 2023 the Commission designated six gatekeepers — Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft — covering core platform services like app stores, search, browsers, operating systems, social networks and online advertising. Booking.com was added in 2024.
Being designated triggers a list of hard obligations. Gatekeepers may no longer rank their own products above rivals (self-preferencing). They must let business users access the data they generate. They must allow alternative app stores and sideloading on mobile devices. They must offer messaging interoperability. And they cannot combine your personal data across services without genuine consent.
The point is structural. These duties attack exactly the mechanisms that lock customers in — the closed app store, the pre-installed default, the data moat — and that made European alternatives so hard to reach in the first place.
Enforcement with real teeth
Regulations only matter if they are enforced, and here the DMA has already shown its bite. In April 2025 the Commission issued its first non-compliance decisions: Apple was fined 500 million euros for restricting developers from steering users toward cheaper offers outside the App Store, and Meta was fined 200 million euros for its "consent or pay" model, which forced users to either accept data combination or pay a fee.
The DSA has followed suit. In late 2025 the Commission fined X (formerly Twitter) 120 million euros over its misleading blue-check verification, obstacles to researcher data access, and an incomplete advertising repository. In 2026 e-commerce platform Temu faced a 200 million euro fine for failing to manage the risk of illegal products.
The numbers are meaningful because the ceilings are high: DMA fines can reach 10 percent of global annual turnover, rising to 20 percent for repeat offenders, while DSA fines can reach 6 percent. For the first time, non-compliance carries a price large enough to change corporate behaviour rather than be filed under the cost of doing business.
The DSA: accountability by design
Where the DMA reshapes markets, the DSA reshapes the information environment. Very Large Online Platforms and search engines — those with more than 45 million EU users — face the strictest duties: annual assessments of systemic risks such as disinformation and threats to minors, independent audits, and transparency about their recommender algorithms.
For everyday users and businesses this translates into concrete rights: clear reasons when content is removed, mechanisms to challenge those decisions, a ban on advertising that targets children or uses sensitive data, and prohibitions on manipulative "dark patterns" in interface design.
For European organisations, the DSA also lowers a reputational and legal risk. Platforms that were once opaque about how they handle illegal content or political advertising now operate under enforceable standards, giving you firmer ground when you assess where to advertise, publish or build.
Why this advances sovereignty
Digital sovereignty is not autarky. It does not mean cutting Europe off from global technology. It means Europe setting the terms on which that technology operates — and retaining the freedom to choose otherwise. The DMA and DSA deliver exactly this: they do not ban American platforms, they make them contestable and accountable.
This connects directly to the wider regulatory stack. The Data Act, applicable since September 2025, forces cloud providers to enable switching and phase out egress fees, so that moving your data and workloads between providers becomes a right rather than a negotiation. The GDPR, reinforced after the Schrems II ruling and now paired with the 2023 EU-US Data Privacy Framework, keeps European data under European legal protection.
Read together, these laws systematically dismantle lock-in. And lock-in is the single biggest reason European alternatives struggled to compete: not inferior products, but switching costs deliberately engineered to be prohibitive.
Interoperability opens the door to alternatives
The most far-reaching consequence of this legislation is practical. When app stores must open, when messaging must interoperate, when default settings must be genuinely user-chosen, and when data must be portable, the cost of leaving a dominant provider collapses.
That is where European alternatives come in. A browser that no longer has to use Apple's engine, an email and office suite you can adopt without ripping out your infrastructure, a messenger that can reach your contacts without forcing everyone onto the same app, a cloud you can migrate to without punitive fees — these were often technically viable already. What was missing was a legal environment that made switching realistic. Now it exists.
Public bodies are proving the point. Germany's Schleswig-Holstein has moved roughly 30,000 workstations from Microsoft Office to LibreOffice and from Exchange to open-source mail and collaboration tools, and the federal openDesk workspace shows a sovereign digital office is a working reality, not a slogan. What a state administration can do, most organisations can do too.
What decision-makers should do now
First, treat these regulations as an opportunity, not a compliance chore. The obligations imposed on gatekeepers are rights granted to you — to your data, to fair terms, to switch. Audit where you are locked in and quantify what leaving would cost now that egress fees and switching barriers are being dismantled.
Second, revisit choices you assumed were permanent. Default browsers, app distribution, cloud contracts and office software are all more contestable than they were two years ago. When a contract renews, treat European alternatives as serious candidates, not fringe options — the interoperability and portability rights now make them credible.
Third, watch enforcement, because it defines the real perimeter of your rights. Each Commission decision clarifies what gatekeepers can and cannot do, and each opens practical room to manoeuvre. Europe has finally given itself the tools to shape its own digital market. Using them is now a business decision, and increasingly a straightforward one.
