The Digital Markets Act (DMA) is an EU regulation that sets rules for a small group of very large platforms, the "gatekeepers", including a ban on combining users' personal data across services or using it for advertising without GDPR-standard consent. It does not apply to your website directly. It matters to you because gatekeepers such as Google and Meta now insist on valid consent signals from the sites that use their advertising and analytics tools.
What the Digital Markets Act is
The Digital Markets Act, Regulation (EU) 2022/1925, is designed to keep digital markets open where a few platforms act as gatekeepers. It entered into force on 1 November 2022 and became applicable on 2 May 2023. Unlike the GDPR, which applies broadly to any organisation processing personal data, the DMA targets a specific class of companies the European Commission calls gatekeepers - large platforms that serve as critical intermediaries between businesses and consumers.
As of October 2026, the Commission's list of gatekeepers names seven companies: Alphabet (Google), Amazon, Apple, ByteDance (TikTok), Meta, Microsoft, and Booking.com (added in May 2024). Between them, they run 23 designated core platform services spanning search engines, operating systems, app stores, messaging apps, social networks, browsers, and online advertising.
The regulation does not replace the GDPR or the ePrivacy Directive. It sits alongside them, adding a competition-focused layer that restricts how gatekeepers collect, combine, and use user data.
How gatekeepers are designated
A company qualifies as a gatekeeper if it meets three cumulative criteria: it has a significant impact on the EU internal market, it operates a core platform service that acts as an important gateway for business users to reach consumers, and it holds an entrenched, durable market position. The European Commission uses quantitative thresholds to presume these criteria are met.
| Threshold | Requirement |
|---|---|
| Annual EU turnover | EUR 7.5 billion or EUR 75 billion global market capitalisation |
| Monthly active end users in the EU | At least 45 million |
| Yearly active business users in the EU | At least 10,000 |
| Duration | Thresholds met in each of the last three financial years |
Companies can try to rebut the presumption with evidence. ByteDance challenged its designation, and on 17 July 2024 the EU General Court dismissed its action in Bytedance v Commission (T-1077/23).
The first six gatekeepers were announced on 6 September 2023 and had until 6 March 2024 to comply. Booking.com was designated in May 2024, with a compliance deadline of November 2024.
DMA obligations: what gatekeepers must and must not do
Articles 5, 6, and 7 of the DMA contain the core obligations. Several directly affect data collection and consent.
Data combination and cross-use (Article 5(2))
Gatekeepers cannot combine personal data from a core platform service with data from their other services - or from third parties - unless the user gives GDPR-standard consent. This means Google cannot merge your Chrome browsing data with your YouTube watch history or Google Ads profile without asking first and receiving a clear yes.
The consent must be freely given, specific, informed, and unambiguous. If a user refuses or withdraws consent, the gatekeeper cannot ask again for the same purpose more than once within a year, and users who decline must still get a less personalised but equivalent alternative.
No advertising use of third-party data without consent
Under Article 5(2)(a), gatekeepers cannot process personal data of end users who use third-party services that rely on the gatekeeper's core platform services, for the purpose of online advertising, without consent. If you run a website that feeds visitor data to Google or Meta through their advertising pixels or analytics tags, the gatekeeper needs to know that the visitor consented.
Other key obligations
Gatekeepers must allow app developers to steer users to offers outside their platforms, must not self-preference their own products in search results, must allow users to uninstall pre-installed apps, and must provide business users with access to their performance data.
How the DMA changes cookie consent for your website
The DMA does not directly regulate your website. You are not a gatekeeper. But the regulation's ripple effects reach every site that relies on gatekeeper services - and that includes almost everyone running analytics or marketing cookies.
Google tightened its EU User Consent Policy around the DMA deadline. Since 16 January 2024, publishers that show Google ads through AdSense, Ad Manager or AdMob in the EEA and the UK must use a Google-certified consent management platform (Switzerland followed on 31 July 2024). Since March 2024, advertisers and Google Analytics users need Google Consent Mode v2 signals for ad personalisation and measurement of EEA users. Without valid consent signals, Google restricts conversion tracking, remarketing audiences and personalisation features in GA4 and Google Ads.
Meta faced the DMA directly. On 23 April 2025, the Commission fined Meta EUR 200 million over its "pay or consent" model, which asked EU users either to agree to personalised advertising or to pay for an ad-free subscription.
What this means in practice
If your website uses Google Analytics, Google Ads, Meta Pixel, or any advertising service from a designated gatekeeper, your consent banner needs to do three things. First, it must present accept and reject options with equal prominence - no oversized green "Accept All" button next to a tiny grey "Manage Preferences" link. Second, it must pass the visitor's choice to the gatekeeper through the mechanism that gatekeeper reads, such as Google Consent Mode for Google's tags or the IAB Transparency and Consent Framework (TCF) where a publisher's ad stack requires it. Third, it must keep a record of each choice, because you may need to show what a visitor agreed to.
A consent management platform handles these tasks for the signals it supports: it detects which cookies and trackers are present, categorises them, presents the choice and passes it on to the services that read it.
Enforcement so far: fines and investigations
The European Commission is the sole enforcer of the DMA. In March 2024, weeks after the compliance deadline, it opened non-compliance investigations into Apple, Google, and Meta. The first fines arrived on 23 April 2025, and Google followed in July 2026.
| Gatekeeper | Violation | Fine |
|---|---|---|
| Apple (April 2025) | Preventing app developers from steering users to offers outside the App Store (Article 5(4)) | EUR 500 million |
| Meta (April 2025) | "Pay or consent" advertising model that did not offer genuine user choice (Article 5(2)) | EUR 200 million |
| Google (July 2026) | Self-preferencing in Google Search | EUR 460 million |
| Google (July 2026) | Anti-steering on Google Play | EUR 430 million |
On 23 July 2026, the Commission fined Google EUR 890 million under the DMA and ordered it to end the non-compliance. Google's EUR 2.95 billion fine of September 2025 over advertising technology is a separate antitrust case under EU competition law, not a DMA decision.
These amounts sit well below the DMA's maximum penalty of 10% of worldwide annual turnover (rising to 20% for repeat infringements), and periodic penalties of up to 5% of average daily worldwide turnover are available for ongoing non-compliance. The Commission is also looking at cloud computing and held a stakeholder roundtable on cloud services under the DMA on 1 July 2026.
DMA vs GDPR: how they work together
The DMA and GDPR are both EU regulations with equal legal standing. They overlap on consent and personal data, but serve different purposes. The GDPR protects individual privacy rights. The DMA protects market competition.
Where the two intersect is consent. Article 5(2) of the DMA requires consent within the meaning of the GDPR (Articles 4(11) and 7) when gatekeepers want to combine user data. The Commission and the EDPB published draft joint guidelines on the interplay between the two laws for consultation on 9 October 2025. As of October 2026, the final version is expected in the last quarter of 2026, covering among other things what counts as a genuine, freely given choice.
For website owners, the practical takeaway is that GDPR consent requirements have not changed, but the DMA makes it far more likely that your advertising and analytics partners will enforce them through their own tools.
What the DMA means for smaller businesses
The DMA's direct obligations fall only on designated gatekeepers. A small e-commerce shop or a medium-sized SaaS company will never be designated. But the indirect effects on publishers and advertisers are real.
Google's EU User Consent Policy means that any website running analytics or advertising through Google's ecosystem needs proper consent flows. Without them, data degrades: less conversion tracking, smaller remarketing lists, fewer audience insights. For businesses that rely on paid advertising, this is a measurable loss in campaign performance.
On the positive side, data portability requirements mean users can move their data between services more readily, and the prohibition on self-preferencing may level the playing field in search results and app store rankings.
DMA review and what comes next
Article 53 of the DMA required the Commission to evaluate the regulation by 3 May 2026 and every three years after that. Enforcement continues regardless: as of October 2026, the Commission has fined Apple, Meta and Google, and issued further guidance to Google in July 2026 on AI interoperability on Android and sharing search data.
For website owners, the direction of travel is clear. Advertising platforms demand verifiable consent signals, and non-essential cookies need proper consent whatever happens to the DMA.
Short answers on the DMA
Does the DMA apply to my website directly?
No. The DMA applies only to designated gatekeepers - currently Alphabet, Amazon, Apple, ByteDance, Meta, Microsoft, and Booking.com. Your website is affected indirectly because these gatekeepers now require you to pass valid consent signals when using their advertising and analytics services.
Do I need to change my cookie banner because of the DMA?
Possibly, if your banner does not already meet GDPR standards and pass the consent signals your tools read, such as Google Consent Mode v2. Google and Meta restrict features for websites that cannot pass valid user consent.
What happens if I ignore the DMA's indirect requirements?
You will not be fined under the DMA itself, but Google may limit conversion tracking, remarketing, and audience building in your Google Ads and GA4 accounts. Meta may similarly restrict ad targeting capabilities for your campaigns.
Is the DMA the same as the GDPR?
No. The GDPR protects individual data privacy rights and applies to all organisations processing personal data. The DMA regulates competition in digital markets and applies only to designated gatekeepers. They overlap on consent requirements but serve different purposes.
How much can gatekeepers be fined under the DMA?
Up to 10% of worldwide annual turnover for a first infringement, rising to 20% for repeat infringements. Periodic penalties of up to 5% of average daily worldwide turnover can be imposed for ongoing non-compliance. Structural remedies are available as a last resort.
Which gatekeeper services are covered by the DMA?
As of October 2026, 23 core platform services are designated, including Google Search, YouTube, Android, Chrome, Google Maps, Google Play, Google Shopping, Google Ads, Facebook, Instagram, WhatsApp, Messenger, the App Store, iOS, Safari, iPadOS, Amazon Marketplace, Windows, LinkedIn, TikTok, and Booking.com's travel intermediation service.
Will the DMA affect websites outside the EU?
If your website targets EU users and uses gatekeeper services like Google Analytics or Meta Pixel, you are indirectly affected. The gatekeepers' consent requirements apply based on the location of the end user, not the location of the website owner.
Pass the right consent signals to Google
If your website relies on Google or other gatekeeper services, start by knowing what it sets. A free cookie scan lists your cookies by category. Kukie.io then blocks non-essential cookies until visitors choose and sends their choice to Google Consent Mode v2, so Google's tags receive the consent state your visitors set.
