Digital Platforms: DSA, DMA and E-Commerce

Digital platforms in Germany in brief

Digital platforms operating in Germany are subject to a layered regulatory framework. The EU Digital Services Act (DSA, Regulation (EU) 2022/2065) sets due-diligence obligations for intermediary services, hosting services, online platforms and marketplaces, with the most extensive duties reserved for very large online platforms and search engines.

The Digital Markets Act (DMA, Regulation (EU) 2022/1925) regulates gatekeepers designated by the European Commission. In Germany, § 19a of the Act against Restraints of Competition (Gesetz gegen Wettbewerbsbeschränkungen, GWB) gives the Federal Cartel Office (Bundeskartellamt) additional powers over undertakings of paramount significance for competition across markets. On top of this sit German consumer and e-commerce law, data protection rules and the contract law that governs IT services, cloud and outsourcing.

For most businesses the relevant questions are practical: which DSA category does our service fall into, what must our terms, notice-and-action systems and interfaces look like, which German authority supervises us, and how do we structure our IT and cloud contracts. This page answers those questions and links to more detailed insights. For the broader framework, see our data and digital law overview.

The Digital Services Act

The DSA has applied to all providers of intermediary services since 17 February 2024. It follows a pyramid structure: basic obligations for all intermediaries, additional duties for hosting services, further duties for online platforms, special rules for platforms allowing consumers to conclude distance contracts with traders (online marketplaces) and the heaviest obligations for very large online platforms and very large online search engines, those with more than 45 million average monthly active recipients in the EU.

The online platform obligations in Section 3 do not apply to micro and small enterprises, except for certain transparency reporting duties (Article 19 DSA). Online platforms may not design their interfaces in a way that deceives or manipulates users or materially impairs their ability to make free and informed decisions (Article 25 DSA). Marketplaces must collect and verify information on traders before allowing them to offer products, and design their interface so that traders can provide required product information.

DSA enforcement in Germany under the DDG

Germany adopted the Digital Services Act (Digitale-Dienste-Gesetz, DDG) to implement the DSA's enforcement provisions and to replace the former Telemedia Act. The Federal Network Agency is the competent authority and Digital Services Coordinator under Article 49 DSA, subject to special competences of the Federal Agency for the Protection of Children and Young Persons in the Media for certain child-protection measures and of the state media authorities (§ 12 DDG). Under the DSA, Member States must ensure that fines for breaches can reach 6% of the provider's annual worldwide turnover (Article 52(3) DSA). Very large platforms and search engines are supervised primarily by the European Commission.

The DDG also continues long-standing German rules for online services. Providers of business digital services must keep an easily recognisable and directly accessible imprint (Impressum) with their name, address, legal form, representatives, register details and contact information (§ 5 DDG). Missing or incorrect imprint information is a frequent subject of warning letters from competitors. Our insight on DSA enforcement under the DDG covers the authority structure in detail.

Operating digital platforms in practice: moderation, complaints and advertising

Complying with the DSA is largely a matter of process design. Digital platforms need workflows that can handle large volumes of notices consistently, document decisions and give users a fair hearing. The core building blocks are the following.

Notice and action

Hosting services must provide an easily accessible electronic mechanism for anyone to notify allegedly illegal content. A sufficiently precise and substantiated notice can give the provider actual knowledge of the content, which matters for its liability exemption. Decisions on notices must be taken in a timely, diligent, non-arbitrary and objective manner, and the notifier must be informed. Rightholders and brand owners use these mechanisms intensively, so platforms should have trained staff and escalation rules for IP, defamation and consumer protection notices.

Statements of reasons and complaints

Where a hosting service removes or restricts content, suspends an account or limits monetisation, it must give the affected user a clear and specific statement of reasons. Online platforms must also offer an internal complaint-handling system, free of charge and electronic, for at least six months after the decision (Article 20 DSA), and users may turn to certified out-of-court dispute settlement bodies. Notices from trusted flaggers designated by the Digital Services Coordinator must be processed with priority. In Germany, users and businesses also bring civil actions against platforms over account suspensions and content decisions, which makes careful documentation of each decision important.

Advertising, recommender systems and minors

Online platforms must label advertisements and show on whose behalf an advertisement is presented and the main parameters used to target it. They may not present advertisements based on profiling using special categories of personal data, such as health or religion, and may not show profiling-based advertising to users they know with reasonable certainty to be minors (Articles 26(3) and 28(2) DSA). Platforms using recommender systems must explain the main parameters in their terms and, where several options exist, let users choose (Article 27 DSA). Platforms accessible to minors must take appropriate and proportionate measures to ensure a high level of privacy, safety and security.

Terms and conditions

All intermediary services must set out in their terms any restrictions they impose on the use of their service, including content moderation policies, algorithmic decision-making and human review, in clear and unambiguous language. German courts additionally review platform terms under the standard-terms rules of the Civil Code, so restrictions must be transparent and balanced to be enforceable against users.

Gatekeepers: the DMA and § 19a GWB

The Digital Markets Act applies to gatekeepers designated by the European Commission for core platform services such as app stores, search engines, social networks, operating systems, browsers and online intermediation services. Gatekeepers must, for example, allow business users to offer their products on other channels, refrain from self-preferencing in ranking, enable interoperability and data portability, and obtain consent before combining personal data across services. The Commission can impose fines of up to 10% of total worldwide turnover, and up to 20% for repeated infringements (Article 30 DMA). Business users in Germany can rely on the DMA in private enforcement before German courts. See our insight on DMA obligations.

In Germany, § 19a GWB allows the Bundeskartellamt to declare that an undertaking active to a significant extent on multi-sided markets and networks has paramount significance for competition across markets, taking into account its dominance, financial strength, vertical integration, access to data and its influence on third parties' access to markets (§ 19a(1) GWB). The designation applies for five years. The Bundeskartellamt can then prohibit specific practices, such as self-preferencing or making the use of services conditional on data processing. Several large digital groups have been designated, and the Bundeskartellamt has used the provision alongside the DMA. See our insight on digital gatekeepers under § 19a GWB.

For companies that depend on large digital platforms as business users, for example app developers, online retailers and advertisers, these rules create new rights and negotiation leverage. Complaints to the Commission or the Bundeskartellamt and private actions before German courts are realistic options where a gatekeeper does not comply.

Platform-to-business rules

Online intermediation services and search engines that serve business users in the EU are also subject to the Platform-to-Business Regulation (Regulation (EU) 2019/1150). It requires clear terms for business users, notice of at least 15 days for changes to those terms, a statement of reasons for restricting or suspending a business user, transparency about ranking parameters and an internal complaint-handling system. The Commission's November 2025 Digital Omnibus proposal would repeal this Regulation and integrate parts of it elsewhere, but as long as it remains in force, operators of digital platforms with business users must comply, and business users can rely on it in disputes.

E-commerce and consumer law for digital platforms

Digital platforms and online shops selling to consumers in Germany must comply with extensive information and design duties in the Civil Code (BGB). Before the consumer places an order, the trader must clearly and prominently present key information such as the main characteristics of the goods, the total price and contract duration (§ 312j(2) BGB), and the order button must be labelled unambiguously, for example "order with obligation to pay". Consumers have a 14-day right of withdrawal for most distance contracts, and subscription contracts concluded online must offer a termination button. EU law is adding a withdrawal function for online contracts; see our insight on the withdrawal button.

Consumer law in Germany is enforced mainly by competitors, consumer associations and qualified business associations through warning letters and injunctions, and increasingly through collective actions. Platforms should therefore treat consumer law compliance as a litigation risk, not only a regulatory one.

Marketplaces should also consider how far they may be treated as the seller or as jointly responsible where the presentation of offers leads consumers to believe that the platform itself is the contracting party, a point the DSA addresses in its consumer protection rules for marketplaces. Clear identification of the trader on each offer page is the simplest safeguard. Ranking transparency and consumer reviews are among the areas now regulated expressly in the Act against Unfair Competition (UWG), following the EU's consumer law modernisation, and personalised pricing triggers specific information duties. Our insight on consumer law for e-commerce gives an overview.

On 11 November 2026, the European Commission adopted its proposal for a Digital Fairness Act (COM(2026) 1100), which addresses practices such as dark patterns, addictive design and personalised offers; it is at the start of the legislative process. See our insight on the Digital Fairness Act.

IT contracts, outsourcing and cloud

Behind every digital platform are contracts for software development, licensing, hosting, cloud services and IT operations.

German contract law has particular features that international providers and customers often underestimate. Standard terms are reviewed under §§ 305 to 310 BGB even between businesses, and German courts frequently invalidate liability caps and exclusions that would be enforceable elsewhere.

Software development projects are often classified as contracts for work (Werkvertrag), with acceptance and warranty rules that differ from service contracts, which matters especially for agile projects where the result is not fully defined at the outset. Software-as-a-service is usually characterised, at least in its core, as a rental-type contract, which affects warranty and liability. Data processing agreements under Article 28 GDPR are mandatory where providers process personal data.

Exit management deserves particular attention: termination assistance, data return in usable formats and continuity of service during migration are often poorly drafted and become critical when a provider relationship ends. Regulated sectors face additional requirements. Financial entities must comply with DORA's contractual requirements for ICT services and with outsourcing rules under German supervisory law, and NIS2 entities must address supply chain security in their contracts. Cloud contracts must also reflect the Data Act's switching rules, which abolish switching charges from 12 January 2027. See our insights on SaaS and cloud contracts, IT contracts and agile projects and IT outsourcing in regulated sectors.

Illustration: a hypothetical US software company launches a B2B marketplace for industrial spare parts in Germany, where small workshops can also buy as consumers. The company checks whether it is an online platform under the DSA, appoints a legal representative in the EU, sets up notice-and-action and trader verification, adds a German imprint, reviews its terms against German standard-terms law and the consumer rules for its smaller customers, and updates its cloud hosting agreement to reflect Data Act switching rights for its own enterprise customers.

How TRW & Co helps

We advise operators of digital platforms, marketplaces and online services on the DSA, the DDG, consumer and e-commerce law, and on their position under the DMA and § 19a GWB, whether as regulated companies or as business users. We draft and review terms and conditions, notice-and-action processes and interface designs, respond to warning letters and represent clients before the Federal Network Agency and the courts.

On the contract side, we draft and negotiate software, SaaS, cloud, outsourcing and IT project agreements for providers and customers, including DORA and NIS2 requirements. To discuss your platform or IT project, please contact us. This page is general information and not legal advice.