Brussels has put the finishing touches on a sweeping update to the Digital Markets Act (DMA), a move that will force Big Tech to overhaul how they operate across the bloc. The new rules, unveiled today, close loopholes that let companies like Google and Meta sidestep requirements by basing key services outside the EU.

The update targets “digital gatekeepers” that dominate cross-border markets. Under the revised DMA, a firm will be designated if it holds a market capitalisation above €75 billion or operates a core platform service in at least three member states. This broadens the net considerably.

Commissioner Margrethe Vestager, the EU’s digital chief, did not mince words. “For too long, these companies have used complex corporate structures to avoid accountability. That ends now,” she said in a press conference. The update empowers national regulators to conduct joint investigations across borders, a first in EU digital law.

One key change: mandatory data-sharing for advertising platforms. Advertisers will get access to anonymised performance metrics, irrespective of where the platform’s data is stored. This is a direct hit at Google’s advertising empire.

But the real sting lies in the enforcement mechanisms. Fines for non-compliance can reach 20% of global annual turnover, up from 10% in the original DMA. For repeat offenders, the EU can force structural separation, meaning divestiture of services.

Critics worry this will stifle innovation. “Europe is building a fortress at the cost of its digital future,” said a spokesperson for the Computer and Communications Industry Association. The American Chamber of Commerce warned of retaliatory trade measures.

Yet consumer groups are cheering. “This finally puts citizens ahead of corporate profits,” said Ursula Pachl of BEUC, the European Consumer Organisation. The update also bans “pay or consent” models, where users must pay to avoid tracking. This could reshape how news sites and apps monetise content.

The timing is delicate. The UK, post-Brexit, has introduced its own Digital Markets Unit but has not matched the EU’s aggressiveness. Brussels hopes to set a global standard, akin to GDPR.

I spoke to a former senior Google executive who asked to remain anonymous. “The update is a regulatory ambush. It will force us to rethink our entire European strategy,” he said. “But we adapt. We always do.”

Smaller tech firms see an opportunity. Jonas Lemberg, CEO of the German social platform Mastodon, told me: “We’ve been calling for this. The gatekeepers have had it too easy. Now the playing field is levelled.”

Implementation begins in 90 days. Companies have six months to comply with data-sharing rules. The European Commission has already launched a public consultation on code of conduct for very large platforms.

Enforcement will be shared between the European Commission and national authorities like Germany’s Bundeskartellamt and France’s Autorité de la concurrence. This creates a patchwork of oversight, but officials say they are coordinated.

Legal challenges are expected. Brussels has budgeted for years of litigation. But the political will is strong. EU lawmakers from across the spectrum backed the update overwhelmingly.

The message from Brussels is clear: the era of digital laissez-faire is over. For the world’s biggest tech companies, the cost of doing business in Europe just went up.