TL;DR
The Digital Markets Act (DMA) is a European regulation that took effect in March 2024 and imposes specific consent and tracking obligations on large digital platforms (gatekeepers). For website publishers, the DMA strengthens the requirement for explicit consent before any data is shared with gatekeeper services (Google, Meta, Amazon, Apple, etc.). In practice, it affects how you configure your cookies, your CMP and your advertising integrations.
What is the Digital Markets Act?
The Digital Markets Act (DMA) is a European Union regulation that aims to regulate the practices of large digital platforms designated as "gatekeepers". Adopted in 2022 and applicable since March 2024, it complements the GDPR by adding specific obligations on consent, data combination and advertising transparency.
Unlike the GDPR, which applies to every data controller, the DMA specifically targets dominant platforms: Google (Search, Ads, Maps, Android, Chrome), Meta (Facebook, Instagram, WhatsApp, Messenger), Amazon, Apple, Microsoft, ByteDance (TikTok) and a few others. But its effects ripple through to every website that uses these gatekeepers' services.
How does the DMA affect cookie management on your website?
The DMA affects your website as soon as you use services provided by a gatekeeper: Google Analytics, Google Ads, Meta Pixel, Amazon Ads or any other tool from these platforms. The regulation prohibits gatekeepers from combining data across their different services without the user's explicit consent.
For Meta's tag specifically, our guide to Meta Pixel cookies and GDPR compliance explains how to block it until the visitor consents.
Stronger consent for gatekeeper services
Article 5(2) of the DMA prohibits gatekeepers from combining personal data collected through their platform service with data from other services, unless explicit consent is given. In practice, Google can no longer merge your Google Analytics data with Google Ads or YouTube data unless the user has given specific consent.
For website publishers, this means your consent banner must let users accept or refuse data sharing with each gatekeeper separately. A simple "Accept all cookies" button is not enough if users do not understand that their data will be combined across several Google services.
The impact on Google Consent Mode and advertising signals
Google has adapted Consent Mode v2 to comply with the DMA. The two new parameters (ad_user_data and ad_personalization) directly address the DMA requirements: they let the publisher signal whether the user has consented to their data being shared with Google for personalised advertising and to the use of their first-party data.
To see what these signals change for advertisers, read our analysis of Consent Mode v2 and its impact on Google Ads campaigns.
DMA vs GDPR: what are the differences for cookies?
The DMA and the GDPR are complementary, not competing. The GDPR governs the processing of personal data by any organisation. The DMA adds an extra layer of obligations specific to gatekeepers and, by extension, to the publishers who use their services.
What concrete steps should you take for your website?
Even though the DMA targets gatekeepers, website publishers need to adapt their setup to stay compliant. Here are the steps to take.
Update your CMP to send the right signals
Your CMP must send the ad_user_data and ad_personalization parameters in addition to ad_storage and analytics_storage. Without these signals, Google assumes the user has not consented to their data being shared, which disables advanced advertising features.
The FlowConsent Consent Mode v2 documentation shows that all four v2 signals, including ad_user_data and ad_personalization, start as denied before any tag loads.
Check the granularity of your consent banner
The DMA requires specific consent for data combination. Your banner must let users understand which gatekeeper services are used and accept or refuse this sharing. Cookie categories (analytics, advertising, functional) remain relevant, but transparency about who receives the data becomes even more important.
Document data flows to gatekeepers
Add to your cookie policy the list of gatekeeper services used on your website, the data sent and the purposes. The DMA strengthens transparency: users must be able to clearly identify which gatekeepers receive their data.
With FlowConsent, the cookie declaration is generated from the active services, which makes this list easier to keep up to date.
Common mistakes about the DMA and cookies
Thinking the DMA only concerns Big Tech. The DMA directly concerns gatekeepers, but it affects every website that uses their services. If you use Google Analytics, Google Ads or Meta Pixel, the DMA obligations concern you indirectly.
The same applies to TikTok, owned by the gatekeeper ByteDance: see our guide to the TikTok Pixel and GDPR.
Confusing GDPR compliance with DMA compliance. Being GDPR-compliant is not enough. The DMA adds specific requirements on combining data across services. A GDPR-compliant cookie banner may not be compliant under the DMA if the ad_user_data and ad_personalization signals are not sent.
Ignoring your CMP updates. CMPs regularly update their integrations to support new DMA requirements. Failing to update your CMP can lead to a loss of advertising features without you realising it.
Not adapting your cookie policy. The DMA requires greater transparency about who receives the data. If your cookie policy does not explicitly mention gatekeepers and data combination, it is incomplete.
DMA and cookies checklist
- Identify all gatekeeper services used on your website (Google, Meta, Amazon, Apple, etc.)
- Check that your CMP sends the ad_user_data and ad_personalization parameters
- Make sure your consent banner offers sufficient granularity for gatekeeper services
- Update your cookie policy to list the gatekeepers and the data shared
- Test how your tags behave when the user refuses data sharing
- Document your setup in your record of processing activities
- Follow European Commission decisions on designated gatekeepers
- Update your CMP regularly to incorporate new requirements
Conclusion
The DMA does not replace the GDPR; it complements it. For website publishers, the main impact concerns CMP configuration and transparency towards users about data sharing with gatekeepers. Websites that use Google, Meta or Amazon services must adapt their setup to send the right consent signals.
The starting point: check that your CMP is up to date and that all four Consent Mode v2 parameters are correctly configured. Run a free scan of your website with FlowConsent to identify the gatekeeper trackers present on your pages.