EU DSA Second-Wave VLOP Designations April 2026 — 12+ New Platforms Under Article 33, Cross-Product User Counts & 2027 Audit Timeline
The European Commission's second-wave DSA designations effective April 2026 add 12+ platforms to the Very Large Online Platform list under tighter user-count methodology. The January 2027 compliance review will be the first formal audit of the second-wave cohort with fines up to 6% of global revenue.
Inside This Compliance Report
April 2026 Designation Wave
The European Commission's second-wave DSA platform designations effective April 2026 expand the Very Large Online Platform cohort and tighten the methodology used to determine which platforms meet designation thresholds. The first-wave designations in 2023 covered 19 platforms; the second wave adds more than a dozen mid-tier networks newly above the 45 million monthly active recipient threshold under the refined methodology.
The European Board for Digital Services convened its 18th meeting on April 15, 2026 in Brussels reaffirming enforcement priorities including supervision of newly designated platforms, protection of minors, and Member State coordination. The Board also submitted views on Commission preliminary findings affecting TikTok and four pornographic platforms, signaling continued enforcement progression where platform conduct warrants formal action.
Newly designated platforms have a six-month adaptation period to bring DSA compliance to first-wave standard. The January 2027 compliance review will be the first formal audit of the second-wave cohort, with non-compliance triggering fines up to 6 percent of global annual revenue. Use the Policy Change Tracker to monitor designation updates and the EU DSA Compliance guide for framework details.
"The Commission's threshold of 45 million average monthly active recipients in the EU has been applied more literally in the second wave, with methodological refinements that count unique users across product lines rather than allowing platforms to segment users between micro-products."
— Atlas Institute analysis of DSA second-wave designations, April 2026
Cross-Product User Count Methodology
The April 2026 methodological refinement closes a gap that previously allowed multi-product platforms to keep individual products below threshold while aggregate users across products materially exceeded the threshold.
What Changed in Counting
| Pre-2026 Approach | Refined Methodology |
|---|---|
| Per-product user count with platform-defined product boundaries | Unique users across product lines under common ownership and integrated infrastructure |
| Multi-product platforms could segment users between products | Integrated platforms evaluated as single entity for designation |
| Affiliated companies could argue independent product status | Corporate structure substance over form determines integration |
| Products with shared identity infrastructure counted separately | Shared identity, content, recommendation, or ad infrastructure treated as integrated |
Platform Patterns Most Affected
- Marketplace + social + content: Each component below threshold individually but aggregate exceeds
- Creator economy products: Creator-facing tools and consumer-facing surfaces integrated
- Consumer + developer: Developer ecosystems sharing identity with consumer products
- B2B + B2C: Business and consumer surfaces operationally connected
- Affiliated entity structures: Apparently independent products sharing infrastructure with parent or affiliates
For platform self-evaluation see Policy Change Tracker and Legal Compliance Scan.
Newly Designated Platform Categories
The April 2026 cohort spans several platform categories with specific designations announced through formal Commission decisions.
Cohort Categories
- Mid-tier social networks: Regional concentration in EU markets; niche networks with strong demographic engagement; creator-focused platforms
- Specialized commerce / marketplace: EU-concentrated marketplaces; classifieds and listing platforms; B2B marketplaces with consumer surfaces
- Content and creator platforms: Mid-tier video and streaming; audio/podcast platforms; creator monetization platforms
- Integrated platforms (refined methodology): Aggregate users across product lines exceed threshold
- Search and discovery (mid-tier): EU-market platforms with substantial query volume
Adjacent Categories Under Watch
- First-wave VLOPs: User count methodology re-evaluated under refined approach
- Approaching threshold: Platforms approaching but not yet exceeding may face designation in subsequent waves
- VLOSEs: Very Large Online Search Engines under separate but related provisions
DSA Obligations and Adaptation Period
Newly designated VLOPs face the full set of DSA obligations applied to first-wave VLOPs but with adaptation period reflecting recent designation.
Core VLOP Obligations
| Obligation | Article | Adaptation Priority |
|---|---|---|
| Systemic risk assessment | 34 | Critical — methodology and documentation foundation |
| Risk mitigation measures | 35 | Critical — measures aligned with identified risks |
| Independent audit | 37 | Critical — audit-ready by January 2027 |
| Transparency reporting | 42 | High — periodic reports public and accessible |
| Researcher data access | 40 | High — GDPR-compatible procedures |
| Advertising repository | 39 | High — affects advertiser-facing operations |
| Recommender transparency | 38 | Medium — opt-out from profile-based recommendations |
| Content moderation appeals | 20 | Medium — timely review and outcome reporting |
| Crisis response | 48 | Medium — Commission engagement procedures |
First-Wave vs. Second-Wave Differences
- Adaptation timeline: Second-wave platforms have six-month adaptation; first-wave platforms operate established compliance infrastructure
- Initial gaps tolerated: Provisional approaches mature through adaptation period
- Peer learning: Second-wave benefits from first-wave audit experience and Commission interpretive guidance
- Supervisory engagement: Capability building emphasis during adaptation alongside enforcement focus
For first-wave compliance context see our EU DSA Compliance Guide.
January 2027 Audit Timeline
The January 2027 compliance audit marks the first formal Article 37 evaluation of the second-wave cohort and creates significant operational pressure to mature compliance during adaptation.
Audit Scope
- Risk assessment quality: Methodology, scope, and documentation of systemic risk identification and analysis
- Risk mitigation adequacy: Measure proportionality and implementation
- Transparency reporting: Accuracy and completeness of periodic reports
- Article 39 ad repository: Compliance with mandatory disclosure fields
- Researcher access: Procedures and data quality
- Recommender transparency: User opt-out and explanations
- Content moderation appeals: Procedures and outcomes
- Crisis response: Capability and Commission engagement
Audit Outcome Range
| Outcome | Implication |
|---|---|
| Positive opinion | Compliance confirmed; standard supervisory cycle continues |
| Qualified opinion | Limited compliance issues; remediation plan required |
| Negative opinion | Material non-compliance; enforcement progression including fines and supervised remediation |
Reports Become Public
- Audit reports published — platform practices exposed to advocacy, journalism, and competitor analysis
- Cross-platform learning informs Commission enforcement priorities for subsequent cycles
- Periodic penalty payments may apply for ongoing non-compliance during remediation
Advertiser and Brand Impact
Second-wave designation affects advertisers across operational, transparency, and risk dimensions with implications varying by scale, content category, and EU focus.
Operational Implications
- Repository participation: Ad content, targeting, advertiser identity, audience reach data publicly disclosed
- Targeting changes: Profile-based targeting of minors and sensitive category restrictions
- Disclosure obligations: AI content, advertiser identity verification, political content frameworks
- Timing changes: Approval timelines and content review aligned with DSA
Transparency and Risk
- Public scrutiny: Research, journalism, civil society analysis at scale
- Competitive monitoring: Peers can observe each other's campaigns within disclosure timeframes
- Cross-jurisdiction consistency: Inconsistent practices across jurisdictions create challenge surface
- Cumulative across platforms: Materially expanded transparency environment vs. single-platform impact
Brand Preparation
- Audit current campaigns on newly designated platforms for elevated-scrutiny practices
- Document business rationale and lawful basis for targeting and content choices
- Rationalize cross-platform operations with consistent compliance standards
- Diversification: Reduce concentration on single-platform DSA maturity
Compliance Checklist
- [ ] Identify which of your platform partners are in the second-wave designation cohort
- [ ] Audit advertising operations on newly designated platforms for repository disclosure scope
- [ ] Document business rationale and GDPR lawful basis for targeting and content choices
- [ ] Align cross-platform compliance standards across first-wave and second-wave platforms
- [ ] Track January 2027 audit timeline and platform adaptation progress for partners
- [ ] Build incident response procedures for platform compliance changes affecting campaigns
- [ ] Engage platform partner managers where eligible for input on DSA implementation
- [ ] Diversify platform mix to reduce concentration on single-platform DSA maturity
- [ ] Map cross-jurisdiction consistency for brands operating in EU and other markets
- [ ] Use EU DSA Compliance guide for framework detail and Policy Change Tracker for ongoing updates
Don't miss the next policy change.
Subscribe to the Policy Change Tracker — get weekly digests or instant Pro alerts across all 8 platforms. Or try our free Keyword Risk Checker first.
Report Keywords — Run AI Compliance Audit
Related Posts
EU DSA Second Wave Enforcement April 2026 — New VLOP Designations, Expanded Advertising Transparency Obligations & 6 Percent Turnover Fines
The EU activated its DSA second enforcement wave in April 2026, designating additional platforms as VLOPs and extending advertising transparency obligations. The €120M X fine set the penalty ceiling at 6 percent of global turnover — advertisers on newly designated platforms face new creative, targeting, and reporting constraints.
Cross-Border Influencer Marketing Compliance 2026 — US, EU, UK & Global Disclosure Laws
Influencer marketing doesn't stop at borders — but advertising laws do. From FTC endorsement rules in the US to the EU's Digital Services Act, UK ASA guidelines, and emerging frameworks in Brazil and Australia, creators and brands face a patchwork of disclosure obligations. This guide maps every major regulation, compares penalties, and provides a practical compliance checklist for cross-border campaigns in 2026.
Cannabis & CBD Social Media Ad Compliance Guide 2026 — Platform-by-Platform Rules, State Laws & Safe Advertising Strategies
A comprehensive 2026 compliance guide to cannabis, CBD, and hemp advertising on every major social media platform. Covers what's allowed, what's banned, topical vs ingestible rules, US state-by-state legal impact, and actionable strategies to run compliant campaigns without getting flagged.