Chapter 4|Supervision, Investigation, Enforcement and Monitoring of VLOPs and VLOSEs|📖 15 min read
1. The Commission may, by decision, impose periodic penalty payments not exceeding 5% of the average daily worldwide annual turnover of the provider of the very large online platform or of the very large online search engine concerned in the preceding financial year per day, calculated from the date specified in the decision, to compel the provider of the very large online platform or of the very large online search engine concerned to:
(a) supply correct and complete information requested by a decision pursuant to Article 67 or rectify incorrect, incomplete or misleading information;
(b) submit to an inspection pursuant to Article 69;
(c) comply with a decision ordering interim measures pursuant to Article 70;
(d) comply with a commitment made binding by a decision pursuant to Article 71;
(e) implement measures to ensure compliance with a decision of non-compliance pursuant to Article 73.
2. Where the provider of the very large online platform or of the very large online search engine concerned has satisfied the obligation which the periodic penalty payment was intended to enforce, the Commission may fix the final amount of the periodic penalty payment at a lower figure than that which would arise from the original decision.
3. Article 74(5) and (6) shall apply.
Understanding This Article
Article 76 creates Commission's periodic penalty payment authority enabling daily financial penalties up to 5% average daily worldwide turnover compelling VLOP/VLOSE compliance with enforcement orders. Differs fundamentally from Article 74 retrospective fines punishing past violations - Article 76 prospectively coerces future compliance through escalating economic pressure incentivizing immediate remediation. Mechanism particularly powerful against wealthy platforms for whom one-time Article 74 fines (even at 6% annual turnover) might represent acceptable business cost - daily accumulating penalties create unsustainable financial bleeding forcing compliance.
Coercive vs. Punitive Character: Article 76 serves distinct enforcement function from Article 74. Article 74 fines sanction completed violations - provider violated obligation in past, Commission determines violation occurred, imposes proportionate financial penalty reflecting violation gravity. Payment satisfies penalty regardless of whether provider subsequently achieves compliance - punitive backward-looking remedy. Article 76 penalties compel ongoing/future compliance - provider currently failing to satisfy enforcement obligation (provide information, permit inspection, implement interim measure, honor commitment, execute remediation), Commission imposes daily penalty accruing until obligation satisfied. Penalty stops when compliance achieved - coercive forward-looking remedy. Distinction matters for proportionality assessment: Article 74 must proportionate to violation harm, Article 76 must proportionate to compliance value. Very serious past violation might warrant €2B Article 74 fine but relatively modest ongoing non-compliance (e.g., refusing secondary information request) warrants smaller daily Article 76 penalty. Conversely, minor past violation might warrant modest Article 74 fine but ongoing refusal to implement critical interim measure protecting users from imminent harm warrants substantial Article 76 daily penalty creating urgency.
Five Triggering Scenarios - Paragraph 1: (a) Information compliance (Article 67) - Commission ordered provider supply information via Article 67 decision, provider refused, supplied incomplete information, or provided false/misleading data and refuses to rectify. Periodic penalties compel: complete responses to outstanding requests, corrections of identified inaccuracies, provision of withheld documents or data, compliance with follow-up clarification demands. Starts accruing from Commission-specified deadline for compliance (typically 14-30 days after information rectification demand). (b) Inspection submission (Article 69) - Commission ordered Article 69 inspection, provider refuses access to premises, denies document access, restricts inspector movement, withholds computer systems access, refuses to provide explanations or demonstrations. Periodic penalties compel immediate inspection facilitation. Typically begins accruing upon scheduled inspection date when provider obstructs - creates immediate consequence for obstruction. (c) Interim measure implementation (Article 70) - Commission ordered provisional remedies preventing imminent serious harm, provider failed to implement within specified deadline or implemented inadequately. Periodic penalties compel full faithful implementation. Given interim measures' urgency (addressing ongoing serious harm), Commission typically sets short grace periods (7-14 days) before daily penalties begin and higher daily rates (2-4% given harm severity). (d) Commitment adherence (Article 71) - Provider offered commitments Commission accepted as binding, provider subsequently breached commitments through incomplete implementation, evasive compliance, or outright violations. Periodic penalties compel genuine good faith implementation. Breach particularly serious given provider voluntarily proposed commitments then failed to honor - suggests bad faith warranting aggressive enforcement. (e) Remediation execution (Article 73) - Article 73 non-compliance decision ordered remediation within reasonable period, provider missed deadline or implemented measures inadequately not achieving compliance. Periodic penalties compel full implementation of Article 73-ordered measures. Often combined with Article 75 enhanced supervision where Commission rejected provider's action plan or found implementation insufficient - penalties drive iteration until satisfactory compliance.
Daily Accumulation Mechanics: Penalties calculated as percentage of average daily turnover multiplied by days of non-compliance. Average daily turnover = provider's total worldwide annual turnover in preceding financial year ÷ 365 days. Turnover encompasses all revenue from all products/services globally regardless of relationship to DSA violation - parallel to Article 74. Example: Platform with €73B annual turnover has average daily turnover of €200M. Commission imposes 2% daily periodic penalty for failure to implement Article 70 interim measure = €4M per day. Penalties accrue from Commission-specified start date: Day 1: €4M, Day 7: €28M, Day 30: €120M, Day 90: €360M. Escalating trajectory creates powerful incentive for rapid compliance - even brief continued non-compliance generates hundreds of millions in liability for major platforms. Commission specifies start date in periodic penalty decision typically providing short grace period (7-30 days depending on urgency) for provider to achieve compliance voluntarily before daily accrual begins. Grace period rationale: demonstrates Commission reasonableness, gives provider opportunity to comply without penalty, prevents claims Commission imposed penalties for violations provider couldn't remedy immediately due to technical/logistical constraints. However, for urgent matters (interim measures addressing serious ongoing harm, critical inspection obstruction) Commission may specify immediate accrual without grace period.
Rate Determination and Proportionality: Maximum 5% daily average daily turnover represents ceiling not standard rate. Commission exercises discretion setting specific percentage considering: (1) Violation urgency - interim measures addressing serious imminent harm warrant higher rates than secondary information requests. (2) Provider cooperation - partial compliance attempts merit lower rates than complete obstruction. (3) Compliance difficulty - technically complex remediation may warrant lower rates giving provider time to implement, simple operational fixes warrant higher rates as easily achievable. (4) Prior non-compliance - repeated obstruction warrants escalating rates, first-time resistance merits moderate initial rates. (5) Proportionality to value - penalties must proportionate to importance of achieving compliance not merely revenue-maximizing. Typical Commission practice: start at 0.5-2% daily for initial non-compliance, escalate to 3-4% if persistent obstruction, reserve 5% maximum for egregious willful sustained refusal. Paragraph 3 incorporation of Article 74(5) requires penalties be 'effective, proportionate and dissuasive' - prevents Commission from imposing nominal rates ineffective at compelling wealthy platform compliance or excessive rates disproportionate to compliance value. Provider may challenge periodic penalty rate as disproportionate through judicial review - Courts apply intensive proportionality scrutiny independent of Commission's assessment.
Compliance Determination and Accrual Cessation: Periodic penalties stop accruing when provider 'satisfied obligation which periodic penalty was intended to enforce.' Burden on provider to demonstrate compliance to Commission through: documentation evidencing full implementation, objective verification (Article 37 audits, third-party testing, Commission Article 72 monitoring), good faith engagement with Commission seeking confirmation compliance achieved. Compliance assessment may require Commission discretion - for complex remediation measures, provider's self-assessment that 'compliance achieved' may not align with Commission's view. Example: Platform claims implemented interim measure requiring algorithmic adjustment reducing harmful content exposure; Commission testing shows adjustment inadequate failing to achieve protection level interim measure intended. Dispute whether compliance achieved - Commission may continue accruing penalties until satisfied with effectiveness. Provider can seek judicial review if believes Commission unreasonably refusing to recognize compliance, but litigation proceeds while penalties accumulate unless Court grants suspension. Paragraph 2 reduction authority addresses scenario where provider achieves compliance after some penalty accrual: Commission 'may fix final amount at lower figure than original decision' - enables Commission to reward eventual compliance through penalty mitigation even though some daily accrual technically owed. Reduction discretion balances: acknowledging provider ultimately cooperated meriting leniency, versus deterring strategic delay where provider calculates compliance cheaper after initial penalty period than immediate compliance. Commission typically exercises reduction for: good faith compliance efforts encountering genuine obstacles eventually overcome, partial compliance showing provider tried but initially fell short, providers demonstrating financial hardship where full accumulated penalty creates viability concerns.
Key Points
Coercive not punitive - periodic penalties compel future compliance rather than punish past violations like Article 74 fines
Maximum 5% average daily worldwide turnover per day - for major platforms can exceed €100 million daily creating powerful compliance incentive
Five triggering scenarios: (a) information refusal/false data, (b) inspection obstruction, (c) interim measure non-compliance, (d) commitment breaches, (e) remediation failures
Penalties accrue daily from Commission-specified date until provider achieves compliance - unlimited duration creates escalating pressure
Average daily turnover calculation: annual turnover ÷ 365 days, based on preceding financial year
Commission discretion to reduce final amount (paragraph 2) if provider subsequently complies - rewards correction even if delayed
Article 74(5) and (6) incorporation: penalties must be effective/proportionate/dissuasive, provider entitled to right to be heard
Unlike Article 74 fines (single payment for past violation), Article 76 creates ongoing financial bleeding until compliance
Particularly effective against wealthy platforms where one-time Article 74 fines potentially absorbed as business cost
Penalties run concurrently with Article 73 remediation deadlines - provider faces daily accumulating liability if misses deadline
Commission may impose periodic penalties simultaneously with or subsequent to Article 74 fines - complementary not mutually exclusive
5% daily rate ceiling rarely imposed - Commission typically starts at lower percentage (0.5-2% daily) with escalation if non-compliance persists
Calculation date critical - Commission specifies when daily accrual begins, typically after reasonable grace period from order
Providers must prove compliance to halt accrual - burden shifts from Commission enforcement to provider demonstration
Judicial review available but typically doesn't suspend accrual unless Courts grant interim relief - penalties accumulate pending litigation
Payment owed even if provider later successfully annuls underlying order - separate challenge required to periodic penalty decision itself
Practical Application
X (Twitter) Information Request Non-Compliance: Commission conducting Article 66 investigation issues Article 67 information request demanding: complete database of content moderation decisions for 6-month period (all content flagged, removal decisions, appeals, outcomes), algorithm documentation explaining how recommendation system determines content visibility, internal communications regarding changes to verification badge policies. X provides response claiming: content moderation database contains 'millions of records too voluminous to produce efficiently,' algorithm details 'proprietary trade secrets preventing disclosure,' communications regarding verification 'protected by attorney-client privilege.' Commission finds response inadequate - conducts Article 69 inspection revealing: actual database readily exportable in structured format contradicting volume objection, algorithm documentation exists in accessible form with no genuine trade secret barrier to sharing high-level methodology, communications primarily between executives and product teams not attorneys mooting privilege claim. Commission issues Article 67 follow-up decision requiring corrected complete response within 21 days. X fails to comply by deadline providing only partial additional information. Commission adopts Article 76 periodic penalty decision: €100M daily (0.5% of €20M average daily turnover) beginning Day 22 after information request deadline, continuing until X provides complete accurate responses. Day 25: X CEO posts on platform that Commission demands 'violate our legal rights' and company 'will not comply with overreach,' confirms X will absorb penalties rather than submit. Penalties accumulate: Week 1: €700M, Week 2: €1.4B total, Week 4: €2.8B. X shareholders pressure executives as massive daily bleeding threatens quarterly earnings. Day 32: X pivots, provides complete database access, algorithm documentation, communications. Commission reviews compliance over 3 days, confirms information complete and accurate Day 35. Penalties accrued: €1.4B (35-21=14 days × €100M). Commission exercises paragraph 2 reduction authority: notes X ultimately complied avoiding need for indefinite accrual, but delay caused significant investigation obstruction requiring €1B penalty acknowledging cooperation. Reduction balances deterring future obstruction against rewarding eventual compliance. X challenge before EU Courts: argues penalties disproportionate to information request nature, Commission could have obtained data through Article 69 inspection rendering information request moot. Court rejects: X's initial refusal necessitated extensive Commission time/resources, penalties served critical function compelling compliance that voluntary cooperation should have provided, proportionality satisfied given X's financial capacity and deterrence needs.
Meta Interim Measure Non-Implementation: Commission investigation reveals Meta's Instagram algorithm amplifying eating disorder content to teenage girls showing vulnerability signals (prior engagement with diet content, body image posts, appearance-focused accounts). Commission issues Article 70 interim measure ordering Meta within 14 days: deploy algorithmic modifications downranking eating disorder content for users under 18, implement warning screens on remaining eating disorder content, disable recommendations of eating disorder accounts to minors. Article 70 justified by urgent need preventing serious harm (documented teen hospitalizations linked to Instagram eating disorder content). Day 14: Meta submits compliance report claiming implemented measures. Commission Article 72 monitoring and independent testing reveals: algorithmic adjustment deployed but minimal effect (5% reduction in eating disorder exposure), warning screens implemented only in English excluding non-English content, recommendation disabling incomplete missing majority of identified eating disorder accounts. Commission determines Meta implemented superficial cosmetic changes satisfying literal language but not substantive protection interim measure intended - evasive compliance constitutes non-implementation. Commission adopts Article 76 periodic penalty decision: €300M daily (2% of €450M average daily turnover) beginning Day 21 (7-day grace period for Meta to cure deficiencies), continuing until effective implementation verified. High 2% rate justified by: teen mental health urgency given ongoing documented harms, Meta's financial capacity (extremely profitable), need for strong deterrence given evasive compliance indicating bad faith. Day 21-28: Meta insists already compliant, argues Commission imposing 'moving goalposts.' Penalties accumulate €2.1B (7 days). Day 29: Investor pressure and media coverage of accumulating penalties forces executive attention. Meta deploys enhanced algorithmic changes, multi-language warning screens, comprehensive recommendation blocking. Day 32-35: Commission conducts intensive testing with ECAT algorithmic auditors and third-party researchers. Testing shows: 67% reduction in eating disorder content exposure (adequate effectiveness), warnings displayed across all EU languages with appropriate cultural adaptation, recommendation blocking comprehensive covering 94% of identified accounts. Commission determines compliance achieved Day 35. Total penalties: €4.2B (14 days × €300M). Meta requests paragraph 2 reduction arguing: initial implementation represented good faith effort, technical complexity of effective algorithmic adjustment required iteration, company ultimately achieved substantial harm reduction exceeding minimum interim measure requirements. Commission denies reduction: Meta's initial evasive compliance demonstrated bad faith not good faith effort, technical complexity excuse undermined by Meta's massive AI/engineering resources enabling faster implementation if prioritized, 14-day delay continued exposing vulnerable teens to serious psychological harms warranting full penalty. Decision sends signal to all VLOPs that interim measures require immediate effective compliance not superficial gestures.
TikTok Article 71 Commitment Breach: TikTok accepted Article 71 binding commitments addressing Article 40 researcher access failures: streamline application processing to 30-day maximum, provide granular content-level data, expand API rate limits, eliminate non-disclosure requirements for research findings, approve minimum 75% of eligible applications. Six months later, Commission Article 72 monitoring reveals: average application processing 127 days (far exceeding 30-day commitment), data still limited to aggregated statistics not content-level, API rate limits unchanged from pre-commitment levels, new terms of service impose 'confidentiality regarding TikTok proprietary systems' functionally recreating non-disclosure, approval rate 34% (below 75% commitment). TikTok breached commitments systematically implementing form over substance. Commission issues Article 76 periodic penalty decision: €50M daily (2% of €63M average daily turnover) beginning immediately (no grace period given TikTok already had 6 months to implement and chose evasion), continuing until genuine compliance verified. Immediate accrual justified by: commitment breach particularly serious given TikTok voluntarily proposed measures, bad faith evident from systematic evasion across all commitment dimensions, Article 40 researcher access critical for accountability. Day 1-15: TikTok argues interpretation differences, claims implementing 'spirit if not letter,' requests Commission consultation to clarify expectations. Penalties accumulate: €750M. Commission responds commitment language unambiguous ('30-day maximum' not '127-day average'), evasion evident not honest misunderstanding, consultation should have occurred during implementation not after breach detected. Day 16: TikTok announces 'comprehensive researcher access reform' deploying: automated application processing achieving 28-day average, API providing content-level data with appropriate privacy protections, 10x API rate limit increase, revised ToS eliminating confidentiality beyond legitimate trade secret protection. Processing reforms effective immediately; API/ToS changes implemented Day 23. Commission monitoring Days 24-30 verifies: application processing meets commitment (testing 50 applications averaging 27 days), API functionality adequate for research needs, rate limits sufficient for comprehensive studies, ToS changes enable finding disclosure. However, approval rate monitoring requires longer period (3 months minimum for statistical significance given application volume). Commission continues penalties through Month 4 until approval rate data demonstrates sustained 75%+ rate. Month 4: approval rate reaches 78%. Total penalties: €6B (120 days × €50M). TikTok requests reduction arguing: reforms exceeded minimum requirements deploying superior researcher access infrastructure, approval rate achieved and sustained, extended monitoring period penalized uncertainty not non-compliance. Commission grants partial reduction to €4.5B (25% mitigation) acknowledging: TikTok's ultimate implementation exceeded commitments creating model researcher access, approval rate uncertainty legitimate given statistical requirements, but systematic initial breach warranted substantial penalty deterring commitment evasion strategies. Case establishes Article 71 commitment breaches trigger aggressive Article 76 enforcement - platforms cannot propose commitments then evade through superficial compliance.
For platforms facing potential periodic penalty payments, understanding the calculation methodology is essential for risk assessment. The maximum daily penalty is 5% of average daily worldwide turnover, calculated by dividing the preceding financial year's total worldwide annual turnover by 365 days. For a platform with $10 billion annual revenue, 5% of average daily turnover equals approximately $1.37 million per day. For larger platforms like Meta (over $100 billion annual revenue) or Google, daily penalties could exceed $13 million. These calculations demonstrate the severe financial pressure periodic penalties create to compel rapid compliance.
The penalties accrue daily from the date appointed by the Commission's decision until compliance is achieved. If a platform takes 30 days to comply with an information request after a periodic penalty decision, and the daily penalty is set at $1 million, the total penalty would reach $30 million. This compounding effect creates powerful incentives for immediate action. Platforms must have crisis response procedures enabling rapid mobilization of resources to achieve compliance when periodic penalties are imposed or threatened.
Importantly, Article 76(2) provides that where the platform satisfies the obligation the periodic penalty was intended to enforce, the Commission may fix the definitive amount at a figure lower than that under the original decision. This provision offers platforms an incentive to achieve compliance quickly even after penalties begin accruing. Platforms should immediately notify the Commission upon achieving compliance, provide comprehensive evidence of compliance, and request reduction of the definitive penalty amount based on prompt remediation. The Commission has discretion to reduce penalties for platforms that demonstrate good faith efforts to comply promptly.
Preventive compliance strategies can avoid periodic penalties entirely. Platforms should: (1) Respond fully and promptly to all Commission information requests under Article 67; (2) Cooperate completely with inspections under Article 69; (3) implement interim measures under Article 70 immediately upon order; (4) comply with binding commitments under Article 71 as an absolute priority; (5) Implement Article 73 non-compliance decision remedies within mandated timeframes; (6) Maintain emergency response procedures for urgent Commission orders; (7) Allocate sufficient resources to ensure compliance capacity. Effective preventive compliance is far less costly than paying periodic penalties while scrambling to achieve compliance under extreme financial pressure.
Legal counsel should advise clients that periodic penalty payments are procedural enforcement tools, not substantive fines. They can be imposed separately from or in addition to substantive fines under Article 74. A platform might face: (1) Periodic penalties under Article 76 for refusing an inspection; (2) Followed by substantive fines under Article 74 (up to 6% of global turnover) for the underlying DSA violation revealed by the inspection; (3) Plus potential additional periodic penalties for failing to implement remedies ordered in the Article 73 non-compliance decision. This layering of penalties can create enormous financial exposure, making comprehensive compliance essential.