Global menu

Our global pages


New Requirements for Online Platforms operating in the EU

  • Ireland
  • Privacy, data protection and cybersecurity


As of 12 July 2020, online platforms and search engines operating within the EU must comply with Regulation (EU) 2019/1150 (the “P2BR”). Similar to the GDPR, the P2BR has extra-territoriality effect. It apples to online platforms and search engines where they offer services to EU established/resident business users and corporate website users that offer goods or services to consumers located in the EU through online platforms or search engines.

P2BR’s primary purpose is to regulate how operators of online platforms engage with businesses that use those platforms to reach consumers. It aims at creating a fair, transparent, and more predictable environment for businesses and traders when using online intermediation services and online search engines such as online marketplaces, app stores and social media platforms. Certain services, like online advertising and online payment services, are excluded from its scope as are business to consumer relationships.

What are the new requirements?

The P2BR has several key requirements including:

1. Drafting of terms and conditions: These must be drafted in plain and intelligible language. If an online platform wishes to amend its terms and conditions, business users must be given at least 15 days’ notice of any changes - unless the business user has agreed to shorten this notice period.

2. Ranking of goods/services on an online platform: Online platforms are required to explain in their terms and conditions the parameters used to rank products/services on their platform. This includes a requirement to describe any preferential treatment given to the platform’s own products/services. 

3. Termination/suspension of business user’s account: An online platform will need to give at least 30 days’ notice and provide a statement of reasons for the termination/suspension of any business user’s account. In addition, platforms must provide details on how to appeal any decision to terminate or suspend a business user’s account.

4. Access to Data: Online platforms must include in their terms and conditions a description of what data they collect, how this data is used and the conditions under which a business user can access this data.

5. Restricting businesses’ selling goods/services through other means: Where an online platform restricts the ability of business users to offer the same goods and services to consumers under different terms and conditions through other means, they must include the grounds for the restrictions in their terms and conditions and make these publicly available.

6. Complaint handling and dispute resolution: Online platforms are now required to establish an internal complaint handling system to enable business users to lodge complaints directly with the platform. This includes technical platform issues and P2BR non-compliance. Platforms will also be required to publish information on this system annually and identify mediators to whom a complainant can seek redress. 

Note that this requirement does not apply to small enterprises with less than 50 staff members and generating <€10m turnover will be exempt.

What are the consequences of non-compliance?

  • Terms and Conditions might be null and void: P2BR non-compliance will render certain provisions within the platform’s terms and conditions null and void meaning they may be unenforceable against a business user. 
  • Complaints: The online platform's internal complaints process should allow business users to raise complaints. If a complaint about non-compliance cannot be resolved, business users should be able to refer the complaint to mediation. 
  • Legal proceedings: Businesses are still able to commence litigation and therefore platforms should not rule out the possibility of a potential damages claim arising from breaches of the P2BR.
  • Specific sanctions: The P2BR does not stipulate any specific sanctions as it will be left to the Member States’ discretion.

What steps do affected businesses need to take?

Affected businesses should seek to:

  • review and amend their terms and conditions to ensure P2BR compliance;
  • Notify business users of any changes to the terms and conditions;
  • identify what type of data is collected and create a data policy;
  • establish a clear process for suspending and terminating a business user’s account;
  • establish an internal complaints-handling system; and
  • identify and select several mediators.

If you have any questions in relation to the above, please feel free to contact a member of the Eversheds Sutherland team:

Marie McGinley, Partner and Head of IP, Technology & DP -

Neasa Ní Ghráda, Senior Associate in IP, Technology & DP -

Kirsty Farrell, Solicitor in Corporate and Commercial -