Very Large Online Platform

Very Large Online Platform is a legal term of the European Union. Translated, it means “sehr große Online-Plattform”. It refers to internet services where users themselves publish content or offer goods, such as social networks, video portals, or marketplaces. A service is considered “very large” if it is used on average by more than 45 million people per month in the EU. That corresponds to roughly ten percent of all EU residents. Anyone who exceeds this threshold is officially placed on a list by the EU Commission and gains additional obligations.

Why 45 million users is a threshold

Behind the rule lies a simple idea: whoever reaches many people can also cause a lot of damage. A small forum with a thousand members does not change an election. A network with hundreds of millions of users can spread misinformation across an entire continent within hours. The EU therefore treats such services similarly to other infrastructure that affects many people.

At the same time, small providers should not be crushed. The obligations for very large platforms are expensive: they require lawyers, audit reports, and dedicated departments for risk issues. A start-up could not afford this and would disappear from the market. The figure of 45 million is thus a compromise between protection and competition.

For the companies themselves, the status is financially noticeable. Violations can be punished with fines of up to six percent of global annual revenue. For a corporation like Meta or Google, that amounts to billions. That’s why VLOPs regularly appear in business news whenever the EU Commission opens proceedings.

Which obligations the status triggers

The basis is an EU law called the Digital Services Act, or DSA for short. It has applied in all member states since 2023. Platforms report their user numbers, and the EU Commission then decides on the classification. Once a service has been designated, it has four months to implement the additional obligations.

The most important of these obligations is the risk assessment. The platform must examine once a year what harm its service can cause. This includes the spread of illegal content, effects on elections, and consequences for the mental health of young people. It must then take measures against these risks. External auditors review the result, similar to how accountants review a balance sheet.

Further rules come on top of this. Users must be told why a particular post is being shown to them. There must be a version of the recommendation system that does not rely on personal data. Advertising may no longer be targeted based on characteristics such as religion or political opinion. And researchers can demand access to the platform’s data in order to study its effects.

Who is on the list

In 2023, the EU Commission designated the first group, including Facebook, Instagram, TikTok, YouTube, X, LinkedIn, Amazon, and Zalando. Others were added later, such as porn sites and the shopping app Temu. Very large search engines also fall under similar rules; they are then called VLOSEs. The list is public and is continuously updated.

For AI-related topics, the status is becoming increasingly relevant. If a platform integrates a chatbot or an image generator, this counts among the features whose risks it must examine. The EU Commission has already sent requests for information regarding AI-generated content and its labeling. The DSA and the EU’s separate AI Act interlock here.

A common misconception is confusing the DSA with the General Data Protection Regulation. The GDPR regulates what may be done with personal data. The DSA, on the other hand, regulates how platforms handle content and risks. Both laws apply in parallel but pursue different goals.