The EU's DSA second wave is here — these are the platforms caught in it

When the European Union first designated 19 Very Large Online Platforms (VLOPs) under the Digital Services Act in 2023, the list read like a who's-who of the big tech social-media economy: Meta's platforms, TikTok, YouTube, X, Pinterest, LinkedIn, and Snapchat all made it. Obligations for that tier of company were steep but manageable — the platforms had teams large enough to absorb them.

The second wave, effective April 2026, is different. The Commission has quietly expanded the designation criteria and added more than a dozen platforms to the VLOP list, including several mid-tier networks that now must meet the same transparency, risk-assessment, and researcher-access obligations as Meta. For these newly designated platforms, the compliance lift is meaningful — and public reporting suggests some are underprepared.

The designation math matters. The Commission's threshold — 45 million average monthly active recipients in the EU — has been applied more literally in the second wave, and with methodological refinements that count unique users across product lines rather than letting platforms segment users between micro-products. Several platforms that had avoided designation by arguing their European user base was split across multiple national or feature-specific product offerings found those arguments less persuasive the second time around.

The bigger story, though, is the expansion of the Digital Markets Act alongside the DSA. Several platforms that avoided DSA VLOP designation in 2023 by staying just under the monthly active user threshold have found themselves reclassified under newly revised methodology for counting "active recipients of the service." The math is not in their favor.

For creators, the practical consequence of the second wave is subtler than the first. VLOP-designated platforms must provide researchers with more granular data access, must run formal risk assessments on algorithmic recommendations, and must offer non-profile-based feed alternatives. That last requirement — a non-personalized feed option — is the one most likely to reshape creator economics, because it introduces a discovery surface that isn't optimized for engagement metrics at all.

The research-access requirement deserves separate attention. Under Article 40 of the DSA, vetted researchers can request structured data from designated platforms on content moderation, algorithmic recommendation, and user interaction patterns. Platforms have 30 days to respond to a vetted request and cannot deny it without specific technical or legal justification. Over the past six months, the first wave of granted research access has produced meaningfully rigorous analysis of platform-specific growth mechanics — work that is already being used as an input by creator-development firms to inform client strategy.

The newly designated platforms — HowSociable's analysis suggests these include at least two US-headquartered mid-tier networks and several European-specific services — have had approximately six months to prepare since designation was announced. By all public indications, some have used that time well and some have not. The January 2027 DSA compliance review, which will be the first formal audit of the second-wave cohort, will be the moment to watch for enforcement actions. Non-compliance can trigger fines of up to 6 percent of global annual revenue — numbers that for most of the affected platforms are large enough to materially affect financials.

For US-based creators, the DSA second wave is primarily interesting for what it foreshadows. California's 2024 AADC-successor law already copies several DSA provisions. Federal DSA-adjacent legislation has been in draft form for two years and is widely expected to land in the next 24 months. The platforms that have built DSA-compliant infrastructure will have a meaningfully easier path through US regulation than those that haven't.