Who Qualifies as a VLOP Under the DSA? - Key Group

If you run an online platform and your user numbers are looking healthy—say, tens of millions of active monthly users in the EU—you might want to pause your victory dance. Under the European Union’s Digital Services Act (DSA), those impressive numbers may come with a shiny new label: Very Large Online Platform, or VLOP. And with that label comes a new set of regulatory obligations that are as serious as they are sweeping.

In this article, we’ll unpack what it really means to be a VLOP, how the EU calculates those numbers, and why it’s a legal designation that could redefine your operational priorities. Whether you’re a seasoned compliance officer or a startup founder waking up to a growth milestone, this is what you need to know before the regulators knock.

What Is a VLOP?

Under Article 33 of the DSA, a Very Large Online Platform is an online platform that reaches more than 45 million average monthly active recipients of the service in the EU. This threshold represents 10% of the total EU population.

Once you cross that line, the European Commission designates your platform as a VLOP, and a cascade of obligations follows.

What Counts as an “Online Platform”?

An online platform, as defined by the DSA, is a type of hosting service that stores and disseminates information to the public on behalf of users. This includes:

Social media platforms
Online marketplaces
App stores
Review sites
Video-sharing services

However, it excludes some services like:

Private messaging services
Cloud storage used for personal use
Online communication where content isn’t made publicly accessible

So, TikTok? Platform. Etsy? Platform. Dropbox private folder? Not a platform.

How Are Users Counted?

The DSA uses average monthly active recipients in the EU as the primary metric. This means:

Unique users who actually engage with the platform
Within the European Union only
Averaged over a six-month period

Importantly, this is not just about registered accounts. It includes logged-in users, guest users, and app users, as long as they interact with the service.

And no, platforms can’t play games with this number. You must calculate it transparently and submit it annually to the European Commission.

If you suspect you might cross the 45 million mark, your legal and compliance teams should start preparing before the official designation lands.

What Happens When You’re Designated a VLOP?

Once the Commission formally designates you as a VLOP, you must:

1. Conduct Systemic Risk Assessments

Annually assess risks your platform poses to:

Democratic discourse
Public health and safety
Fundamental rights

2. Mitigate Those Risks

Implement measures like:

Adjusting recommender systems
Moderating content more effectively
Limiting virality for harmful material

3. Audit Yourself

Submit to independent audits of your risk assessments and mitigation efforts.

4. Data Access for Researchers

Qualified researchers can request access to certain datasets for public interest research. Transparency, meet science.

5. Algorithmic Transparency

Platforms must explain how recommender systems work and give users meaningful control over them. “Because the algorithm says so” is no longer a valid excuse.

6. Crisis Response Mechanism

In times of crisis (e.g., war, public health emergency), the Commission can require you to take specific measures to mitigate risks.

7. Internal Compliance Officer

Appoint a DSA compliance officer and implement internal processes to ensure governance across departments.

Fines and Enforcement

The DSA has teeth. VLOPs that fail to comply can face penalties of up to 6% of global annual turnover. Daily non-compliance fines and public naming-and-shaming are also on the table.

In addition to monetary risk, the reputational damage of being labeled non-compliant in a public registry maintained by the EU is not great PR.

Can a Platform Lose VLOP Status?

Yes, but it’s not easy. The platform must fall below the 45 million user threshold oraz show that this trend is consistent and not temporary. You also have to notify the Commission if your user numbers fall significantly.

But beware: regulators may still impose certain obligations based on systemic impact, even if you technically fall under the threshold.

What’s the Difference Between a VLOP and a VLOSE?

Glad you asked.

VLOP: Very Large Online Platforma (e.g., Facebook, YouTube, TikTok)
VLOSE: Very Large Online Search Engine (e.g., Google Search, Bing)

While the obligations are similar, VLOSEs focus more on indexing and ranking obligations rather than content hosting and moderation.

How to Prepare for VLOP Status

If you’re on the cusp of VLOP territory:

Monitor your user metrics: Regularly track and document EU user activity.
Start internal audits early: Don’t wait for designation to build risk frameworks.
Invest in legal and policy teams: You’ll need internal governance muscles.
Train staff: Ensure cross-departmental understanding of DSA obligations.
Document everything: Transparency is a survival skill now.

Final Thoughts

Becoming a Very Large Online Platform may sound like a compliment, and in some ways, it is. But under the DSA, it’s also a signal that your platform has outgrown the freedoms of digital adolescence. Now, you’re a civic actor with real-world consequences.

The EU isn’t just regulating tech for the sake of it. It’s recognizing that platforms of this scale affect elections, shape discourse, influence purchasing decisions, and moderate global attention spans.

So if your platform is inching toward VLOP status, it’s time to start acting like one—before the Commission officially tells you to. Because in the DSA era, big reach comes with big responsibility.

Who Qualifies as a “Very Large Online Platform” (VLOP) Under the DSA?