Additionally, companies doing business in the European Union and\/or European Economic Area, and that use the gatekeepers\u2019 services will also likely need to achieve and maintain compliance to prevent business disruptions.<\/p>\n\n\n\n
Penalties for Digital Markets Act (DMA)<\/a> violations are significant, and can be up to 10% of global annual turnover for gatekeepers, or up to 20% for repeated violations, among other penalties. Third parties using gatekeepers\u2019 platforms and services could lose access to them, along with their data and user bases. This would cut off advertising, analytics, and other necessary functions, damaging business operations with losses of audience access, revenue, and brand reputation.<\/p>\n\n\n\n Obligations imposed by the Digital Markets Act are fairly similar to some of those required by the General Data Protection Regulation (GDPR)<\/a>, but they cover more territory. For example, the Digital Markets Act includes additional access to consumers\u2019 personal data and uses of it. The Act also aims to bolster the competition landscape and increase fairness among digital companies and benefit smaller organizations in the market.<\/p>\n\n\n\n The European Commission has so far designated seven \u201cgatekeeper\u201d companies under the Digital Markets Act based on the size and influence of their platforms and audiences, and their power in the digital market. The list may grow or change in the future.<\/p>\n\n\n\n The gatekeeper designation means that these platforms and the services they offer have to ensure they\u2019re in compliance with the DMA by March 6, 2024. Otherwise, they risk substantial penalties.<\/p>\n\n\n Wondering about the DMA definition<\/a> of gatekeeper and other terms? Learn more with our comprehensive glossary.<\/p>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/div>\n\n\n\n Companies that use the gatekeepers\u2019 core platform services in Europe will also need to demonstrate their compliance (e.g. collecting and signaling valid user consent) or risk losing access to those platforms and the associated data, user base and revenue.<\/p>\n\n\n\n Companies operating in the European Union and\/or European Economic Area may also need to comply with additional data privacy regulations, like the GDPR. Fortunately, many of the laws\u2019 requirements are in alignment already.<\/p>\n\n\n\n These requirements make implementation of a consent management solution<\/a> important to help ensure that you are obtaining valid consent from users on these platforms before collecting and\/or processing their personal data, and that you can signal it to gatekeepers.<\/p>\n\n\n\n To date, the European Commission has identified 23 core platform services (CPS) among those that the gatekeepers own and operate. This list may grow or change over time. These are the services most under compliance scrutiny under the DMA due to their vast audiences, amount of data generated and processed, and consumer and market influence:<\/p>\n\n\n\n Third-party entities that make use of the CPS will be required by the gatekeepers to comply with the Digital Markets Act if they want to maintain access to these services, e.g. for advertising. Otherwise they risk significant revenue loss if their access to the platforms is removed.<\/p>\n\n\n\n The Digital Markets Act uses the same principles for user privacy and consent as the EU\u2019s GDPR and ePrivacy Directive (ePD)<\/a>. This means that they use an opt-in model, and personal data cannot be collected or processed before valid consent is obtained. Third parties will also have to be able to signal this consent to gatekeepers like Google.<\/p>\n\n\n\n As per the GDPR, consent must be freely given, specific, informed, unambiguous, and obtained in advance of data collection<\/strong>.<\/p>\n\n\n\n Consent is also not a \u201csingle use\u201d action. Consumers must be able to change or withdraw their consent at any time, and it must be as easy to do so as it was to provide consent. If a company is audited by data protection authorities, they must be able to provide a record of user consent choices.<\/p>\n\n\n\n A consent management platform (CMP) enables companies to do several things that facilitate valid consent and regulatory compliance with privacy laws. A CMP enables companies to:<\/p>\n\n\n\n Companies using Google services must also support the most up to date version of Google Consent Mode, as this is used to enable consent signaling to Google when their services are in use.<\/p>\n\n\n\n Prior or opt-in consent is required by the DMA from customers, visitors or site\/app users of gatekeepers\u2019 and third parties\u2019 services, if these companies:<\/p>\n\n\n\n Read the EC\u2019s published list of specific \u201cdo\u2019s and don\u2019ts\u201d for gatekeepers<\/a><\/p>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/div>\n\n\n\n Explicit<\/strong>: Active acceptance required, e.g. ticking a box or clicking a link. Informed<\/strong>: Who wants to collect what data, why, for how long, and who will it be shared with, etc.?<\/p>\n\n\n\n Documented<\/strong>: You have the burden of proof of consent in the case of an audit.<\/p>\n\n\n\n In advance<\/strong>: No data can be collected before consent is obtained, e.g. cookies cannot be set on your website before the user has consented to them.<\/p>\n\n\n\n Granular<\/strong>: Individual consent for individual purpose, i.e. consent cannot be bundled with other purposes or activities. The second layer of a CMP can display all cookies\/tracking technologies in use and their purposes to enable highly granular consent choices.<\/p>\n\n\n\n Freely given<\/strong>: Equally accessible and easy to use \u201cAccept\u201d and \u201cDeny\u201d options, e.g. buttons all on the first layer of the CMP. Do not manipulate users\u2019 choices via design.<\/p>\n\n\n\n Easy to withdraw<\/strong>: Changing consent or opting out is as easy to do as opting in, e.g. available on the same layer of the CMP.<\/p>\n\n\n\n The GDPR and DMA require consent for the use of cookies and trackers on websites. This makes a consent management platform (CMP) a necessary tool in many cases, but a lot of companies doing business in the EU do not have a CMP installed, or it\u2019s installed incorrectly, preventing regulatory compliance.<\/p>\n\n\n\n These companies risk noncompliance with the Digital Markets Act, which also risks their business continuation via access to the gatekeepers\u2019 platforms and services, including advertising with Google.<\/p>\n\n\n\n A consent management platform can be implemented on websites, apps, and other platforms in minutes. A CMP like Cookiebot CMP can be customized to match corporate branding, and deep scans your website to ensure detection and control of all of the cookies and other tracking technologies you use.<\/p>\n\n\n\n Cookiebot CMP is a European leader in helping companies obtain consent and achieve data privacy compliance, and enables this right out of the box. Cookiebot CMP relies on state of the art technology that detects more cookies and trackers. It automates detection, categorization and blocking of them over time to help you maintain compliance without dedicating a lot of technical or legal resources. Protect your operations from DMA violations and ensure you can keep using gatekeepers\u2019 services.<\/p>\n\n\n\n Data protection authorities in Europe have demonstrated that they will pursue compliance with data privacy laws, and enforcement continues to expand. The DMA will build on that commitment.<\/p>\n\n\n\n The European Commission can impose fines for DMA violations on gatekeepers of up to 10% of the company\u2019s annual global turnover, 20% in cases of repeated violations. Additionally, the EC can require gatekeepers in the EU to sell parts or all of a business, or institute bans on acquisitions if they would involve lines of business in which the entity had been found to be in violation.<\/p>\n\n\n\n As for third-party organizations relying on gatekeepers\u2019 services, if they fail to comply, they can lose platform access, which would also involve loss of data, audience\/customers, and be a hit to revenue. As noted, the DMA bears similarities with other laws, so a DMA violation may also mean a violation of the GDPR or other privacy laws, which have their own potential penalties. This would be publicity no company wants, and would likely damage brand reputation and consumer trust, which would be a further hit to revenues and growth potential.<\/p>\n\n\n\n The specifics of CMP implementation do depend on what platforms you\u2019re using, like your CMS, as well as other tools, including Google Tag Manager and other services. Cookiebot CMP is flexible and can be installed with just a few lines of JavaScript. There\u2019s also a cookies WordPress plugin<\/a>.<\/p>\n\n\n\n1. Which companies has the European Commission designated as gatekeepers?<\/h2>\n\n\n\n
\n
Requirements for Digital Markets Act compliance for third-party companies<\/h3>\n\n\n\n![\"Illustration](\"https:\/\/www.cookiebot.com\/en\/wp-content\/uploads\/sites\/7\/2023\/10\/Requirements_for_Digital_Markets_Act_compliance_for_third-party_companies.svg\")
<\/figure>\n\n\n\n2. What is a core platform service under the Digital Markets Act?<\/h2>\n\n\n\n
\n
Does the Digital Markets Act provide more protection for user privacy?<\/h2>\n\n\n\n
\n
\n
and\/or<\/li>\n\n\n\n4. What rights do third-party companies have under the Digital Markets Act?<\/h2>\n\n\n\n
One of the big goals of the Digital Markets Act is a fairer digital marketplace and improved competition. To this end, the law has a number of requirements that gatekeepers must meet, and which benefit third parties using the CPS. These benefits include:<\/p>\n\n\n\n\n
5. How can companies obtain and store valid consent under the Digital Markets Act?<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.cookiebot.com\/en\/wp-content\/uploads\/sites\/7\/2023\/10\/5_How_can_companies_obtain_and_store_valid_consent_under_the_Digital_Markets_Act_.svg\")
<\/figure>\n\n\n\n
Conditions for valid consent under the Digital Markets Act are the same as under the GDPR:<\/p>\n\n\n\n
<\/p>\n\n\n\n6. How can a CMP get you ready for the Digital Markets Act and why do you need one?<\/h2>\n\n\n\n
7. How do you implement a CMP to be ready for the Digital Markets Act?<\/h2>\n\n\n\n
\n
![\"Pepco\"](\"https:\/\/www.cookiebot.com\/en\/wp-content\/uploads\/sites\/7\/2023\/11\/pepco_group_logo_340px_01-1.svg?v=1548f22bcec1f087\"\n){kind=logo}
\n <\/div>\n ![\"rural-king\"](\"https:\/\/www.cookiebot.com\/en\/wp-content\/uploads\/sites\/7\/2023\/11\/rural-king.svg?v=c61b94b055f7f6f1\"\n)
\n <\/div>\n ![\"orbico\"](\"https:\/\/www.cookiebot.com\/en\/wp-content\/uploads\/sites\/7\/2023\/11\/orbico.svg?v=0c403b5e138f2d8e\"\n)
\n <\/div>\n ![\"credit-exchange\"](\"https:\/\/www.cookiebot.com\/en\/wp-content\/uploads\/sites\/7\/2023\/11\/credit-exchange.svg?v=6bb93c10d76574f5\"\n)
\n <\/div>\n ![\"canon\"](\"https:\/\/www.cookiebot.com\/en\/wp-content\/uploads\/sites\/7\/2023\/11\/canon.svg?v=d58e7999bf5b46cc\"\n)
\n <\/div>\n ![\"bauhaus\"](\"https:\/\/www.cookiebot.com\/en\/wp-content\/uploads\/sites\/7\/2023\/11\/bauhaus.svg?v=695ed7c488c3a310\"\n)
\n <\/div>\n <\/div>\n <\/div>\n","protected":false},"excerpt":{"rendered":"