EU Digital Services Act

What it requires

The Digital Services Act applies to online intermediaries and platforms serving users in the EU, and imposes additional risk-assessment, mitigation and audit duties on services the Commission designates as very large online platforms or very large online search engines. Designated services are supervised by the Commission itself. In July 2025 the Commission published guidelines under Article 28 on the protection of minors, which set out private-by-default accounts for minors, autoplay and streak mechanics switched off by default, and safeguards against loot boxes and virtual currencies. The Commission's supervision register listed 26 designated services in its July 2026 updates — 24 platforms and two search engines — across 21 provider entities, with no new designation since WhatsApp on 26 January 2026.

Why it bears on this field

No microdrama or vertical-drama app is designated, and none appears in the Commission's enforcement record, so the exposure is indirect. What connects the instrument to the format is the theory the Commission is running against designated platforms: its preliminary findings against Instagram and Facebook of 10 July 2026 cite infinite scroll, autoplay, push notifications and highly personalised recommender systems, which is the retention stack a vertical-drama app monetises. The Article 28 guidelines name loot boxes and virtual currencies among the risks to minors, and coin-based in-app purchase is the standard monetisation of the format. Two separate proceedings against TikTok are open: addictive design, at preliminary findings since 6 February 2026, and minors' account protection, at preliminary findings since 24 July 2026.

Open questions

• Does the addictive-design theory have any reach beyond designated very large online platforms?
• Will virtual-currency and loot-box mechanics in undesignated apps become an enforcement priority under the minors guidelines?
• When do the two TikTok proceedings move beyond preliminary findings? The addictive-design case has stood at that stage since February 2026.

Timeline

• 2025-07-14The Commission publishes guidelines on the protection of minors under Article 28. Source (opens in a new tab)
• 2026-02-06The Commission preliminarily finds TikTok's addictive design in breach of the Digital Services Act (IP/26/312). Source (opens in a new tab)
• 2026-07-10The Commission preliminarily finds the addictive design of Instagram and Facebook in breach of the Digital Services Act (IP/26/1579), citing infinite scroll, autoplay, push notifications and highly personalised recommender systems, and an inadequate assessment of risks to minors and vulnerable users. Source (opens in a new tab)
• 2026-07-15The Commission accepts X's action plan. It was published as a Digibyte on 15 July and as a formal press release on 16 July; neither states the date of the decision itself. Source (opens in a new tab)
• 2026-07-20The Commission fines AliExpress €550m, recorded on the supervision register (ip_26_1654). Source (opens in a new tab)
• 2026-07-24The Commission preliminarily finds TikTok in breach for failing to ensure safe accounts for minors (IP/26/1679). This is a separate proceeding from the addictive-design case of 6 February 2026. Source (opens in a new tab)
• 2026-08-31The Commission designates ChatGPT, Reddit and Roblox as very large online platforms or search engines. Designation brings systemic-risk obligations including duties on the physical and mental well-being of minors, with a compliance deadline of January 2027. No vertical-drama or microdrama service is designated. Source (opens in a new tab)