Designated in January 2026 on the strength of its public-facing broadcast surfaces, not private messaging.
- Tier
- VLOP — very large online platform
- Provider
- WhatsApp Ireland Ltd.
- Sector
- Messaging
- Designated
- 26 January 2026
- Obligations from
- 26 May 2026
- EU users at designation
- 51.7 million
- Formal proceedings
- None to date
- Court challenges
- None
Designated 26 January 2026 on 51.7 million average monthly active recipients in the Union.
The designation turns on the distinction the DSA draws between interpersonal communication and public dissemination. Private and group messaging is not an online platform; the public-facing Channels and broadcast surfaces disseminate content to the public at large, and it is those that carry the service over the threshold.
Where WhatsApp sits in the tier
That margin is thin. A service this close to the threshold is one reporting period away from the question Article 33(5) exists to answer — designation is withdrawn where user numbers fall durably below 45 million, as they did for Stripchat in May 2025.
Where interpersonal communication ends and dissemination begins
The DSA draws a hard line between interpersonal communication services and online platforms. Private and group messaging is not an online platform: the content is not disseminated to the public. Broadcast surfaces — channels, public updates, one-to-many distribution — are, and it is those that carry a messaging service over the designation threshold.
The consequence is that designation reaches only part of the product. The asymmetric obligations attach to the public-facing surface, and the Article 34 assessment concerns dissemination there rather than the encrypted conversation underneath it.
- Out of scope
- Private and group messaging, as interpersonal communication rather than public dissemination.
WhatsApp timeline
- 26 January 2026 Designated a VLOP by Commission decision.
- 26 May 2026 Articles 33 to 43 begin to apply, four months after notification.
What WhatsApp has to do
Designation applies the asymmetric obligations in Articles 33 to 43. They are the same for every designated service, read against a platform surface. Terms used on this page are collected in the glossary.
- Article 34 Systemic risk assessment
- Article 35 Mitigation of risks
- Article 37 Independent audit
- Article 38 Recommender systems without profiling
- Article 39 Advertising repository
- Article 40 Data access for the Commission and vetted researchers
- Article 41 Internal compliance function
- Article 42 Transparency reporting
- Article 43 Supervisory fee