The European Commission proposed the Digital Services Act (DSA) and Digital Markets Act (DMA) as a new rulebook for major online intermediaries. Together, the proposals aimed to increase platform accountability for online harms and create fairer competition when a few large platforms act as key “gatekeepers.”
EU privacy regulators, working through the European Data Protection Board (EDPB), adopted guidance on “dark patterns” (interface designs that steer people into choices they did not intend). This mattered for virtual-platform governance because design choices in social and immersive apps can shape how users share data and give consent.
The DMA was published in the EU’s Official Journal, marking the final text as EU law. This set up the EU’s “ex ante” (rules-first) approach to large platform power, including app stores and social platforms that can also host or connect virtual-world services.
The DMA entered into force, starting the countdown to when its obligations would apply. It created a framework for designating “gatekeepers” and then requiring them to follow specific do’s and don’ts, such as limits on self-preferencing and restrictions on combining user data without consent.
The DSA entered into force, and some provisions started applying immediately (including parts related to designations and oversight). The DSA’s risk-based structure is important for virtual platforms because it ties responsibilities to platform role and scale, especially where algorithms and immersive content can amplify harms.
The European Commission issued its first designation decisions under the DSA, naming the initial set of Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs). These services had to meet extra duties—like stronger risk assessments and independent audits—within four months of notification.
The DMA became applicable, meaning its operational timelines for notifications, designations, and compliance began running. This was a key step toward directly affecting platform features that can influence virtual-world access, distribution, identity, and payments (for example through app-store rules).
The Commission designated six companies as gatekeepers under the DMA. Designation triggered a fixed compliance deadline, pushing large ecosystem operators (including app stores and social networks) to change rules and technical choices that can determine how users access digital goods and services, including virtual experiences.
The Commission used its DSA powers to require Meta to provide information about how it was addressing risks, including issues tied to illegal content and election integrity. This showed how DSA oversight could shift from general duties on paper to targeted supervision of platform risk controls and design choices.
The Commission opened formal proceedings to investigate whether X may have breached the DSA in areas including risk management, content moderation, dark patterns, ad transparency, and researcher data access. The case signaled that DSA enforcement could reach core platform mechanics—recommendation systems, interface design, and transparency tools.
The DSA began applying generally across the EU (with earlier compliance already required for designated VLOPs and VLOSEs). This broadened the law’s practical impact beyond the largest services, shaping baseline expectations for content governance, user reporting, and transparency across many kinds of online and virtual platforms.
The Commission opened formal proceedings to assess whether TikTok may have breached the DSA, including protections for minors, advertising transparency, and risks linked to addictive design. This action was relevant to virtual-platform governance because it connected platform design patterns and recommender systems to legal duties around harm prevention.
The Commission opened DMA investigations into Alphabet, Apple, and Meta over concerns that their changes did not meet DMA requirements. The issues included app-store steering rules, search self-preferencing, browser choice design, and Meta’s “pay or consent” approach—areas that can affect distribution, discovery, and monetization in virtual ecosystems.
The Commission opened formal proceedings to assess whether Facebook and Instagram may have breached the DSA, including around deceptive ads and political content, and concerns about the loss of the CrowdTangle monitoring tool without an adequate replacement. This highlighted how DSA enforcement can focus on transparency and independent scrutiny during high-risk periods like elections.
The EU AI Act entered into force, creating a risk-based framework for AI systems used in the EU, including rules that phase in over time. For virtual platforms, this matters because AI increasingly shapes avatars, content creation, moderation, and recommender systems, and the Act adds new compliance expectations depending on how AI is used.
EU regulatory actions affecting virtual platforms (2020–2024)