Marketplace legal requirements in the EU: DSA, DAC7, GDPR

Marketplace legal requirements look frightening because they are usually presented as a heap: DSA, DAC7, GDPR, P2B, Omnibus. Yet a small platform starting out is not subject to everything, and not straight away. This guide from the Marketplace Factory team, which builds complete marketplaces from a single sentence, puts the EU rules in the order they arise: what applies on launch day, what comes back every year, what arrives as you grow. For each one: the text, who it covers, what to do. At the end: what we already handle for you, and short notes for operators in the UK and the US.

What applies from day one

Before opening to the public, check these eight points:

1. A legal notice saying who runs the site.
2. Terms of use describing publishing rules and moderation.
3. A privacy notice and, if you use non-essential cookies, a consent mechanism.
4. A point of contact for users and another for authorities.
5. A way to report illegal content, and a reasoned answer to every removal.
6. Each seller’s status displayed, trader or private individual, and what it means for the buyer.
7. Consumer dispute information, and a consumer mediator where your country requires one.
8. A licensed payment provider if money passes through your site.

The DAC7 report will come the following 31 January. The rest depends on your size.

Your status: host, publisher, marketplace operator

A marketplace wears several hats at once.

• Host of its sellers' listings. Article 6 of the Digital Services Act (DSA) exempts you from liability for content stored at sellers' request if you did not know it was illegal, or if you remove it promptly once you learn of it.
• Publisher of everything you write yourself: pages, copy, curated selections. For that, you answer for the content.
• Online marketplace provider under EU consumer law, with specific information duties.

Mind the trap in Article 6(3) of the DSA: the exemption falls away, under consumer law, if your site leads an average consumer to believe that you are the one selling. Every listing must make clear who the seller is.

The documents to publish

• Legal notice: the e-Commerce Directive (Article 5) requires your name, geographic address, email, trade register number and VAT number, easily and permanently accessible. Each country adds its own details.
• Terms of use: who can publish, what is banned, how you moderate, how to contest a decision. Article 14 of the DSA requires them to describe your moderation rules in “clear, plain, intelligible” language.
• Terms of sale: each seller’s terms towards their customers, and yours if you charge service fees.
• Privacy notice and cookie management: see below.

If your sellers are businesses, the P2B Regulation adds rules for your terms towards them: grounds for suspension, main ranking parameters, and at least fifteen days' notice before any change.

Telling consumers who sells and how offers are ranked

Since the consumer Omnibus Directive (EU) 2019/2161, a new Article 6a of the Consumer Rights Directive requires online marketplaces to tell consumers, before they are bound:

1. the main parameters that determine ranking of offers, in a dedicated, easily reached section;
2. whether the third party is a trader or not, based on that party’s own declaration;
3. if it is not a trader, that EU consumer rights do not apply to the contract;
4. where relevant, how obligations are shared between the seller and the marketplace.

The same directive bans showing search results without clearly disclosing paid placement. A listing paid to appear first must be recognisable as such.

The DSA: what really concerns you

The DSA has applied since 17 February 2024 to every platform serving users in the Union. It stacks duties in layers, and the European Commission’s DSA page sums it up: obligations are proportionate to each service’s role and size. Micro and small enterprises, under the EU SME definition (fewer than 50 staff and no more than €10 million in turnover or balance sheet), are largely exempt.

The exemption ends twelve months after you exceed the thresholds. Above 45 million monthly active users in the Union, a platform can be designated “very large” and takes on extra duties. Fines can reach 6% of annual worldwide turnover (Art. 52).

Two tips, even for a small platform. First, give reasons for every removal: Article 17 asks you to state the decision, the facts, the ground (law or terms) and the means of redress. Second, collect your trader sellers' details anyway, as Article 30 provides (name, address, phone, email, ID, payment account, registration number, self-certification): it is the best defence against fraud, and you will be bound by it as you grow.

DAC7: reporting your sellers' income

The EU’s DAC7 directive requires platform operators to report their sellers' income. It covers four activities: sales of goods, personal services, rental of any mode of transport and rental of immovable property.

• When: “no later than 31 January of the year following” the year in question, to the tax authority of your Member State; a platform based outside the EU registers in one Member State.
• What: each seller’s identity, amounts paid per quarter, number of transactions, fees withheld by the platform, the bank account used and, for property rentals, the property’s address. Each seller receives the same information by the same date.
• Who is excluded: sellers of goods with fewer than 30 sales for no more than €2,000 over the year. That threshold only applies to sales of goods.
• What counts as a platform: software that merely lets users list or advertise, process payments or redirect users, “without any further intervention”, is not a platform in DAC7’s sense.
• Penalties: set nationally. In France, a fine of up to €50,000 according to the tax administration’s guidance (in French).

There is no size exemption: small platforms report too. So collect what you need at sign-up: name, date of birth, address, tax number, bank account.

GDPR and cookies

You are the controller of your users' data under the GDPR. The essentials:

• keep a record of processing activities (Article 30): accounts, listings, messages, payments;
• tell users clearly what you do, in a privacy notice;
• collect only what you need, and delete it when planned;
• sign data processing agreements with your processors: hosting, software, email, payments;
• answer access, rectification and erasure requests.

For cookies, the ePrivacy rules as amended by Directive 2009/136/EC allow storing or reading information on a user’s device only with their consent, after clear information, except what is strictly necessary for the service they asked for. The fewer consent-based trackers you use, the simpler your banner.

Consumer disputes

One change to note: the EU Online Dispute Resolution platform no longer exists. Regulation (EU) 2024/3228 stopped new complaints on 20 March 2025 and repealed the ODR Regulation with effect from 20 July 2025: remove the old ODR link from your terms. National mediation rules remain. In France, for instance, Article L. 612-1 of the Consumer Code gives every consumer the right to a free consumer mediator: if consumers pay you service fees or buy on your platform, appoint one and name it in your terms. Check your own country’s rules.

New in 2026: the withdrawal button

Since 19 June 2026, a consumer who concludes a distance contract through an online interface must be able to withdraw online, through a dedicated function. The rule comes from the new Article 11a inserted by Directive (EU) 2023/2673, transposed by each Member State (France did so by an ordinance and a decree of 5 January 2026):

• a function labelled “withdraw from contract here” or an unambiguous equivalent, prominently displayed and available throughout the withdrawal period;
• a short statement, submitted through a confirmation function labelled “confirm withdrawal” or an unambiguous equivalent;
• an acknowledgement of receipt on a durable medium, with its content and the date and time.

The duty falls on the trader who sells, but you control the interface: in practice it falls to the operator to build the mechanism for its sellers. Between private individuals, the right of withdrawal does not apply, but buyers must be told. And Article 16 of the Consumer Rights Directive 2011/83/EU excludes some contracts, including car rental and leisure activities booked for a specific date.

Other people’s money

If buyers' money passes through your site before reaching your sellers, you enter the field of payment services, reserved for licensed institutions. The usual answer is a licensed provider that collects and pays out for you. Everything is explained in our guide to marketplace payments with Stripe Connect.

The summary table

What Marketplace Factory handles, and what stays with you

Our terms of sale set out the split: you are the publisher and operator of your marketplace, responsible for its content, its terms, the DSA, DAC7 and your users' data; we provide the software and act as processor for that data. Here is what every marketplace created with Marketplace Factory includes today (as of 29 September 2026):

• a “Report” button on listings and profiles, sending the report to your team;
• in the back office, listing review before publication, with a written reason for every requested change, refusal or removal;
• in the seller space, a declaration of private or trader status, with company name, registration number, address, email, phone and self-certification for traders;
• legal notice and privacy pages, to complete with your details;
• data hosted in the European Union.

Coming soon: ready-to-review terms of use and a “How listings are ranked” page on every marketplace.

What stays with you: your terms, a mediator where required, the DAC7 report and your record of processing. Our own terms of use also list banned goods and services.

If you operate from the UK

The UK left the EU framework, so the DSA and the withdrawal button do not apply as such. Instead: platforms report sellers' income to HMRC by 31 January, with the same goods exclusion of fewer than 30 sales and €2,000, about £1,700 (HMRC). If users post content that other users see, check whether you run a “user-to-user service” under the Online Safety Act: illegal-content duties have been enforced since 17 March 2025, with fines up to £18 million or 10% of worldwide revenue. Cookies fall under PECR and UK GDPR (ICO). And the CMA’s fake reviews guidance expects businesses that publish reviews to have policies, risk assessments and procedures to remove fake ones.

If you operate in the US

Section 230 says no provider of an interactive computer service shall be treated as the publisher of information provided by another. Marketplaces selling new or unused consumer products must collect, verify and recertify the details of high-volume sellers (200 or more sales and $5,000 or more in twelve months) under the INFORM Consumers Act. Payment platforms file Form 1099-K when a seller exceeds $20,000 in more than 200 transactions (IRS). And sales tax may be yours to collect: in Texas, for example, a marketplace provider that processes sales or payments for third-party sellers must collect and remit sales tax on those sales. Check each state where you have buyers.

To place these duties in the whole project, read how to build a marketplace, step by step; for a concrete case, see how to start a handmade marketplace, where the trader-or-private question comes up with every sale.

With Marketplace Factory, reporting, written reasons, seller status and legal pages are in place from day one: what remains is your own texts and filings, not a technical project.