The Digital Markets Act (DMA) came into full force in March 2024 and changed the rules of the game for the biggest tech platforms in Europe. If your website relies on Google Analytics, Meta Pixel, or other tools from designated gatekeepers, DMA is directly relevant to you: and to the way these platforms handle cookie consent.

What is the Digital Markets Act?

The Digital Markets Act is an EU regulation (Regulation (EU) 2022/1925) designed to ensure fair and contestable digital markets. Unlike GDPR, which applies to all organisations that process personal data, DMA targets only the very largest digital platforms: the so-called gatekeepers.

Gatekeepers are companies that provide core platform services (search engines, social networks, operating systems, app stores, messaging, browsers, virtual assistants, advertising services) and meet specific thresholds for market impact. The European Commission designated six gatekeepers in September 2023:

  • Alphabet (Google Search, Google Maps, Google Play, Chrome, YouTube, Google advertising)
  • Amazon (Amazon Marketplace, Amazon Ads)
  • Apple (iOS, App Store, Safari)
  • ByteDance (TikTok)
  • Meta (Facebook, Instagram, WhatsApp, Facebook Marketplace, Meta advertising)
  • Microsoft (Windows, LinkedIn, Bing, Edge)

These companies had until 7 March 2024 to comply with their DMA obligations: and non-compliance can result in fines of up to 10% of global annual turnover, or 20% for repeat infringements.

How DMA differs from GDPR

GDPR is a horizontal regulation: it applies to any organisation that processes personal data of EU residents, regardless of size. DMA is a vertical, asymmetric regulation that places extra obligations only on the biggest gatekeepers. Think of GDPR as the floor everyone must meet, and DMA as an additional storey that only the largest players are required to build.

The practical differences for cookie consent:

  • GDPR requires any website to obtain freely given, informed, specific consent before setting non-essential cookies.
  • DMA additionally prohibits gatekeepers from requiring users to consent to data combination across their core platform services as a condition of access to those services. It also requires gatekeepers to offer equivalent alternatives where consent is not given.

For most small and medium businesses, GDPR remains the primary compliance framework. DMA matters to you mainly because it shapes how the gatekeeper tools you rely on: Google Ads, Meta Pixel, and others: handle consent data.

Key DMA obligations affecting cookie consent

Article 5(2) of the DMA is the most relevant provision for cookie consent. It prohibits gatekeepers from:

  • Processing personal data for online advertising purposes without valid consent (DMA explicitly references GDPR standards here)
  • Combining personal data from core platform services with data from other services: including third-party websites: without separate, explicit consent
  • Cross-using personal data for online targeting without consent that users can revoke as easily as it was given

Crucially, DMA requires that consent must be genuinely free. Gatekeepers cannot make access to their core services conditional on users accepting data combination: this is what made Meta's original "pay or consent" model legally contested.

The "pay or consent" controversy

In November 2023, Meta introduced a subscription model across the EU: users could either pay a monthly fee (€9.99/month on web) to use Facebook and Instagram without being tracked for advertising, or use the services for free in exchange for consenting to personal data processing for ads.

This model: known as "pay or consent": was immediately controversial. The European Data Protection Board (EDPB) issued an opinion in April 2024 concluding that large platforms cannot, as a rule, offer a binary choice between paying for privacy and consenting to data processing for advertising. The consent obtained through such models is not "freely given" because there is no genuine free alternative for users who cannot afford or choose not to pay.

The European Commission also opened a DMA investigation into Meta's model, which resulted in Meta announcing changes to its approach in late 2024: including a less targeted ads option that does not require users to pay or consent to extensive data processing.

The lesson for businesses: even if you are not a gatekeeper yourself, the tools you embed from gatekeepers (pixels, SDKs, advertising tags) must receive valid GDPR consent before they process user data. DMA enforcement is tightening the standards for what counts as "valid."

Practical impact for websites using Google and Meta tools

If your website uses Google Analytics 4, Google Ads conversion tracking, or Meta Pixel, DMA enforcement directly affects you: not because you are a gatekeeper, but because the gatekeepers themselves are changing how their tools work in response to DMA pressure.

Google Consent Mode v2

Google responded to increasing regulatory pressure (both GDPR and DMA) by making Google Consent Mode v2 mandatory for all websites using Google's advertising and measurement products from March 2024. Consent Mode allows Google's tags to operate in a limited mode when consent is not given, modelling conversion data rather than tracking individual users. Websites without Consent Mode v2 risk loss of remarketing audiences and conversion modelling in Google Ads.

Meta Pixel and the Conversions API

Meta has similarly updated its guidance, recommending use of the Conversions API (CAPI) for server-side event sharing alongside: or instead of: the browser-based Pixel. However, server-side tracking does not exempt you from consent requirements: personal data sent via CAPI still requires the same valid consent as the browser Pixel.

Consent must come first

Under both GDPR and DMA-shaped platform requirements, the sequence is non-negotiable: no tracking before consent. This means:

  1. Your cookie banner must block all non-essential tracking tags until the user actively accepts them.
  2. You must respect refusals: if a user declines, analytics and advertising tags must not fire.
  3. You must provide an easy mechanism for users to withdraw or change their consent at any time.

Timeline and enforcement

Key dates in the DMA timeline:

  • November 2022: DMA entered into force
  • May 2023: DMA became applicable
  • September 2023: Six gatekeepers officially designated by the European Commission
  • 7 March 2024: Gatekeeper compliance deadline; DMA obligations took full effect
  • March 2024 onwards: European Commission began formal investigations into potential DMA non-compliance (Apple's browser engine rules, Meta's advertising model, interoperability obligations)
  • 2025–2026: First enforcement decisions and potential fines expected; additional platforms may be designated as gatekeepers

The DMA is enforced exclusively by the European Commission: unlike GDPR, where each EU member state has its own supervisory authority. This centralised enforcement model means decisions will be relatively uniform across the EU, but may also materialise more slowly than national GDPR enforcement actions.

What your business should do

Even if DMA does not apply to you directly, here is what you should do to stay aligned with the direction of EU digital regulation:

  1. Audit your third-party tools. Make a complete list of all tracking, analytics, and advertising tags on your website. For each one, confirm whether the vendor requires consent and whether you are correctly blocking it before consent is given.
  2. Implement Consent Mode v2. If you use any Google advertising or measurement products, implement Google Consent Mode v2 immediately if you have not already done so. This is now a Google requirement, not just a regulatory one.
  3. Review your cookie banner. Ensure it blocks all non-essential cookies before consent, presents choices clearly without dark patterns, and provides an equally easy way to refuse or withdraw consent.
  4. Keep consent records. GDPR requires you to document that consent was obtained. Ensure your Consent Management Platform records consent events with timestamps, the version of the policy consented to, and the user's choices.
  5. Follow regulatory developments. DMA enforcement is still in its early stages. Watch for European Commission decisions on gatekeeper compliance: these will affect the tools and SDKs you embed on your website.

The bigger picture: consent is the foundation

DMA is, at its core, about power asymmetries in digital markets. But its practical effect: in combination with GDPR and the coming ePrivacy Regulation: is to raise the bar for what counts as meaningful consent across the entire web. The era of "accept all" buttons being clicked without thought is ending. Regulators, platforms, and increasingly users expect consent to be genuine, granular, and revocable.

For businesses, this means that a solid, compliant cookie consent setup is not just a legal checkbox: it is infrastructure. The quality of your analytics data, the effectiveness of your ad targeting, and your standing with platforms like Google and Meta all depend on getting consent right.

Consentio helps you build a cookie consent setup that works: for GDPR, for Consent Mode v2, and for the evolving DMA landscape. Our visual banner editor lets you build a compliant banner without writing a line of code, while consent analytics show you exactly how visitors are responding. Start for free and have your site compliant in minutes.