Don’t disrupt your digital marketing

The Digital Markets Act (DMA) is a regulatory framework introduced by the European Commission to regulate digital markets and address challenges to data privacy and the dominance of online tech giants. The law aims to ensure fair competition, enhance consumer protection, and promote innovation in the digital ecosystem. The DMA will have a significant impact on how large online platforms and the smaller third parties that use their services handle user consent and data.

The European Commission introduced the DMA in response to growing concerns about the power of dominant large tech enterprises that have digital platforms with enormous global reach. These companies have a significant and growing impact on competition, innovation, and consumer welfare. The law reflects the EU’s commitment to addressing the challenges posed by the digital economy in the 21st century.

The DMA’s role is to regulate the digital market, help ensure competition, and protect privacy, ensuring that the ecosystem operates in a way that is fair and beneficial to both businesses and consumers in the European Union.

The DMA has three main objectives:

• fostering competition in digital markets
• addressing unfair practices by the tech giants that control large online platforms
• safeguarding the interests of smaller businesses and consumers

By imposing specific obligations on tech enterprises that currently dominate the market—designated as gatekeepers by the DMA—the law seeks to create a more transparent, competitive, and user-centric digital commercial environment.

The DMA introduces several key provisions for gatekeepers, including:

• obligations for their platforms to refrain from unfair or anti-competitive practices
• provide access to data collected on or generated by their platforms
• ensure interoperability
• avoid preferential treatment of their own or specific partners’ functionality or services

The DMA applies to companies that operate large online platforms meeting specific criteria, such as having a significant impact on digital markets, acting as intermediaries between businesses and users, and enjoying a durable position of market power with significant influence over innovation. These platforms will be subject to enhanced regulatory obligations and scrutiny under the DMA. The DMA’s requirements protect online users in the European Union, European Economic Area, and the UK. The DMA does not apply outside of these areas, even though the currently designated gatekeeper companies are headquartered in the USA and China.

The six gatekeepers designated by the European Commission are:

• Meta (owner of Facebook, Instagram, WhatsApp, and others)
• Alphabet (owner of Google and Android)
• ByteDance (owner of TikTok)
• Apple
• Amazon
• Microsoft

Although the DMA applies to these gatekeepers, smaller businesses should also be aware of and understand the law, as it’ll directly impact how they use the large online platforms and services owned by gatekeepers. Business owners will be responsible for following the compliance rules imposed by digital services such as those from Google and Amazon.

Yes. The DMA establishes a single set of rules that apply uniformly to gatekeepers and the digital platforms operating in the EU. This consistency is intended to replace the current patchwork of national regulations with a common regulatory framework. However, certain aspects of implementation may still be subject to national customization.

The coordination of the DMA with other regulatory frameworks will be crucial to ensure consistency and avoid conflicts. The DMA is designed to complement existing regulations, such as GDPR, rather than replace them. The European Commission, responsible for enforcing the DMA, will work closely with other regulatory bodies, including national competition and data protection authorities, to ensure harmonization and coordination. Regular consultations and cooperation mechanisms will be established to exchange information, align enforcement actions, and address any overlaps or inconsistencies between the DMA and other regulatory frameworks.

While the primary focus of the DMA regulation is tech giants, small and medium sized enterprises (SMEs) that use their platforms for sales and marketing will also feel its effects. It’s highly likely that smaller companies will soon be required to follow new privacy rules that gatekeepers will establish to comply with the DMA. The law’s data privacy requirements, for example, apply to all personal data collected on these platforms, whether directly by gatekeepers or by the third parties using them.

Compliance with these new laws won’t have a one-size-fits-all solution. However, businesses should begin exploring platforms that replace outdated intrusive methods with transparent tools for obtaining user consent, tracking without cookies, reliance on first-party databases, and context-based advertising.

One of the DMA’s major requirements is obtaining consent in advance of collecting and processing user data. The designated gatekeeper companies as well as third parties using their platforms and services must be able to prove consent was obtained. Third parties need to be able to transmit this consent signal to gatekeeper companies like Google as well to maintain access to their platforms. A consent management solution enables companies to compliantly and securely obtain, store, and signal user consent to comply with regulations like the DMA.

According to the GDPR, consent must be:

• Explicit: Active acceptance, e.g. ticking a box or clicking a link.
• Informed: Who, what, why, for how long?
• Documented: The website operator has the burden of proof in the case of an audit. Ensure consents are securely documented and stored.
• In advance: No data is collected before the user has consented, i.e. cookies cannot be set on the website before the user consent or if they decline.
• Granular: Separate consent for each individual purpose, i.e. consent cannot be bundled with other purposes or activities.
• Freely given: Provide “Accept” and “Deny” options, e.g. buttons, that are equally displayed and accessible.
• Easy to decline or withdraw: Opting out must be as easy to do as opting in.

Cookiebot CMP is designed to be easy to use for the average user and not require a lot of technical expertise. It can be implemented on your website in 3 steps after you’ve created an account.

1. Add your website to the Cookiebot CMP Admin
2. Customize your cookie banner settings or select from our predefined options
3. Add the cookie banner script into your website’s code by following the easy instructions on the “Your scripts” tab

To help, we’ve prepared this Getting Started guide with detailed explanations of the setup.

When a website visitor (user) submits a consent from your website(s), the following data is automatically logged at Cookiebot CMP:

• user’s IP number in anonymized form (by removing the last 16 bit of IPv4 addresses and by removing the last 96 bit of IPv6 addresses)
• date and time of the consent
• user agent of the user’s browser
• URL from which the consent was submitted
• an anonymous, random and encrypted key value
• user’s consent state, serving as proof of consent

The key is used for proof of consent and is an option to verify the consent state stored in the user’s browser.

The GDPR requires that all consents must be retained for a period of 5 years, serving as essential documentation to substantiate consent if required. In addition, retaining historical consents is crucial in the event of an audit of your website by data protection authorities.

Using a cookie consent solution like Cookiebot CMP, end users can change or withdraw consent at any time, as easily as they gave it, which is a core cookie consent requirement in the EU.