ChatGPT, Reddit and Roblox designated as very large online platforms under DSA

The European Commission confirmed on Monday that ChatGPT, Reddit and Roblox have each surpassed 45 million average monthly active users in the European Union, automatically designating them as Very Large Online Platforms (VLOPs) under the Digital Services Act. The decision subjects all three to the regulation's most demanding tier of obligations, including mandatory annual risk assessments, independent audits, transparency reporting and a dedicated compliance function.

The threshold is not new. Since the DSA entered into force in November 2022 and became fully applicable across the bloc in February 2024, any platform reporting 45 million or more average monthly recipients in the EU must notify the Commission and, once designated, comply with the VLOP regime within four months. The Commission publishes and updates the list on its VLOP register, which now includes more than twenty services ranging from Google Search and YouTube to TikTok, X, LinkedIn and Pinterest.

What the designation means in practice

VLOP status brings a specific set of obligations that go well beyond the baseline DSA requirements applying to all intermediary services. The three platforms must now produce annual systemic risk assessments covering the dissemination of illegal content, negative effects on fundamental rights, civic discourse, electoral processes, public health, protection of minors and mental health. They must commission independent external audits at their own expense, publish transparency reports on content moderation and recommender systems, and maintain an internal compliance function independent from commercial operations.

They are also required to provide regulators and vetted researchers with access to data necessary for scrutinising systemic risks, and to implement a crisis response mechanism that the Commission can activate in circumstances such as a pandemic or war. Failure to comply can attract fines of up to 6% of global annual turnover and, in repeated or severe cases, a temporary suspension of the service in the EU via a court order.

ChatGPT becomes the first AI chatbot under the VLOP regime

ChatGPT's inclusion marks the first time a generative AI conversational agent has been captured by the DSA's top tier. OpenAI, the US company behind the service, now faces a dual regulatory framework: the DSA's systemic risk obligations and the AI Act, which entered into force in August 2024 and classifies general-purpose AI models with systemic risk, a category likely to include the models powering ChatGPT, under a separate regime of evaluation, documentation and incident reporting.

The overlap is intentional. The Commission has argued that the DSA addresses the platform layer, how content is distributed, amplified and moderated, while the AI Act targets the model layer, how the underlying system is trained, tested and deployed. For OpenAI, this means maintaining two parallel compliance programmes, each with distinct reporting lines, audit requirements and enforcement authorities. The AI Act designates the European AI Office within the Commission as the central supervisory body for general-purpose models, whereas DSA enforcement for VLOPs is led by the Commission directly, supported by the national Digital Services Coordinators.

Reddit and Roblox join a growing list of user-generated platforms

Reddit and Roblox follow a different trajectory. Both are built on user-generated content, Reddit as a network of community forums, Roblox as a platform where users create and monetise games, and both have argued in the past that their decentralised structure makes top-down moderation harder than on centrally curated feeds. The Commission's designation rejects that distinction for the purposes of systemic risk. With 45 million monthly users each, their scale alone triggers the presumption that their design choices can amplify harm across the single market.

For Reddit, which listed on the New York Stock Exchange in March 2024, the designation arrives as the company is under pressure to demonstrate profitability while expanding its advertising business. The DSA's restrictions on targeted advertising using sensitive data and its ban on dark patterns in consent interfaces will constrain some of the monetisation strategies Reddit has explored. Roblox, whose user base skews heavily towards children and teenagers, faces particular scrutiny on the protection of minors. The Commission has already signalled that age verification, default privacy settings and the design of virtual economies will be priority areas for VLOP audits in 2025 and 2026.

How the Commission decides and what comes after

The 45 million figure is not an estimate. Platforms are legally obliged to publish their average monthly active recipients in the EU at least every six months, calculated according to a methodology set out in a delegated regulation. The Commission uses those self-declared numbers, cross-checked where necessary against third-party data, to adopt a formal designation decision. Once published in the Official Journal, the four-month compliance clock starts. The DSA regulation also allows the Commission to designate a platform below the threshold if it considers the service poses systemic risks, though that power has not yet been used.

The three new VLOPs must now submit their first systemic risk assessments by early 2025, assuming the designation decision was adopted in late August 2024. They will also need to appoint a compliance officer reporting directly to the management board, publish a transparency report covering the second half of 2024, and undergo their first independent audit within twelve months. The Commission has indicated it will prioritise the assessment of recommender systems, content moderation resources for EU languages, and the effectiveness of notice-and-action mechanisms for illegal content.

Enforcement landscape and the TikTok precedent

The Commission's willingness to use its full enforcement toolkit was demonstrated earlier this year when it opened formal proceedings against TikTok over alleged failures to assess the addictive design of its 'Lite' rewards programme and to provide researchers with data access. That investigation, still ongoing, could result in the first VLOP fines under the DSA. The message to ChatGPT, Reddit and Roblox is clear: the Commission expects substantive compliance, not procedural box-ticking.

National Digital Services Coordinators, Ireland's Coimisiún na Meán for most US platforms with EU headquarters in Dublin, but also regulators in other member states, will handle the day-to-day supervision of non-VLOP obligations and support the Commission on VLOP enforcement. The coordination mechanism is still bedding in; the first joint inspection of a VLOP took place only in mid-2024.

What happens next

The immediate test for all three platforms is the submission of their first systemic risk assessments, due four months after the designation decision takes effect. Those documents will be examined by the Commission and, in redacted form, made available to the public. Researchers and civil society groups have already flagged specific concerns: for ChatGPT, the potential for synthetic disinformation at scale and the opacity of model updates; for Reddit, the moderation of extremist communities and the impact of algorithmic amplification on polarisation; for Roblox, the exposure of children to inappropriate content and the economics of its virtual currency. The Commission has set a deadline of February 2025 for the first round of VLOP transparency reports covering the full second half of 2024, which will provide the first comparable dataset across the expanded list.