In this post, we look at what constitutes a very large online platform (VLOP) or very large online search engine (VLOSE), who has been designated as a VLOP or VLOSE, and significantly, what obligations attach to services designated as a VLOP or a VLOSE under the Digital Services Act (DSA).  This is relevant as earlier this week, Zalando, an online retailer, appealed its designation as a VLOP by the European Commission (Commission) to the Court of Justice of the European Union (CJEU) – the first VLOP to do so.

What is a VLOP or a VLOSE?

In theory, VLOPs and VLOSE are the largest and most influential online businesses in the EU.  To qualify as a VLOP or a VLOSE, an online business must first meet the definition of an “online platform”.  Broadly, this is defined as a hosting service that at the request of a user “stores and disseminates information to the public”.  For many firms, characterisation as an online platform may be obvious – but given the breadth of the online ecosystem, it is apparent that the term ‘online platform’ may well be contested.  In any event, where an online platform has an ‘average monthly active recipient’ (or “user”) in the EU equal to or higher than 45 million users, it will be designated by the Commission as a VLOP or VLOSE.  Recently, the Commission published guidance to assist companies to calculate their users.

Who is a VLOP or VLOSE?

In April 2023, the Commission designated 17 VLOPs and 2 VLOSEs.  A list of the designated VLOPs and VLOSEs can be found here and includes four shopping platforms, two app stores, six social media providers, and two content sharing sites. 

What rules must a VLOP or VLOSE comply with?

VLOPs and VLOSEs are subject to stringent obligations under the DSA by virtue of their scale and size and the potential influence and impact these services have on users and society as a whole.  We highlight five compliance obligations below:

• Online advertising transparency 

VLOPs and VLOSEs carrying advertisements on their online interfaces must now publish certain information.  This includes the name of the product, service or brand and the subject matter of the advertisement, the person on whom the advertisement is being presented, the period during which the advertisement was presented and whether the advertisement was intended to be presented specifically to one or more particular groups of recipients of the service.

• Independent audit

VLOPs and VLOSEs must commission an independent audit to verify their compliance with their obligations under the DSA at least once per year and at their expense. The audit report must be transmitted to the Digital Services Coordinator (the Media Commission in Ireland) and the Commission and made public, subject to certain caveats.

• Compliance function

VLOPs and VLOSEs must establish an independent compliance role to monitor adherence to the DSA, and such compliance officer must be able to report directly to the management body. The compliance officer must cooperate with the Digital Services Coordinator and the Commission – and is expected to play an important role in advising the VLOP, and monitoring its obligations under the DSA.

• Risk assessment and mitigation

VLOPs and VLOSEs must consider systemic risks such as the dissemination of illegal content and any actual or foreseeable negative effects for the exercise of fundamental rights and freedoms (e.g. protection of personal data, consumer protection, etc.); civic discourse, electoral processes, public security and issues such as gender-based violence and the protection of public health.  Where risks are identified, VLOPs and VLOSEs must impose mitigation measures which may include adapting the design, features or functioning of the service, adapting algorithmic and other processes, putting in place controls such as age verification and parental control or taking awareness-raising measures.

• Crisis response mechanisms

VLOPs and VLOSEs may be required to instigate crisis response mechanisms where there is a serious threat to public security or public health in the EU.  VLOPs or VLOSE must assess whether and to what extent the functioning and use of their services significantly contributes to the threat, identify and adopt measures to prevent, eliminate or limit such contribution to the threat, and to provide associated reports to the Commission.

What is Zalando challenging in the DSA?

Since adopted in October 2022, many online platforms are struggling with various aspects of the internal policy and processes needed to implement the far-reaching obligations contained in the DSA.  One common difficulty experienced by online platforms is the need to identify whether or not the online platform exceeds the 45 million user threshold (and, thus, VLOP status) given the variety of different business models, outsourced partnerships and fluctuation in user traffic.

On 27 June 2023, Zalando initiated the first legal challenge in respect of VLOP status under the DSA before the CJEU.  Zalando claims the Commission ‘misinterpreted’ its user numbers because it operates a hybrid business model: namely, it operates (i) a retail business where items are sold by Zalando (approx. 64% of its volume), and (ii) a partner model where products are sold by third party brands directly to customers (approx. 36% of its volume).  Zalando calculates its active users per month at 31 million such that it falls short of the DSA’s threshold of 45 million users.  Zalando argues that there is an absence of a “clear and consistent methodology to assess if a specific company is a VLOP” which leads to unequal treatment. 

Interestingly, while Zalando supports the objectives of the DSA, it argues that VLOP designation has the potential to hinder fair competition and innovation in the EU.  As described above, very strict compliance obligations apply to VLOPs and VLOSEs, and incorrect designation has the potential to significantly restrict or impact the operation of such online platforms.  Expect to see further challenges to the operation of the DSA in future.