Commentary on the judgment of the General Court of the European Union, 19 November 2025, Case T-367/23, Amazon EU Sàrl v European Commission
The judgment delivered by the General Court of the European Union on 19 November 2025 comes at a singular moment when the law, confronted with the emergence of private powers whose influence over collective life sometimes exceeds that of States themselves, must rethink its fundamental categories. The question raised cannot be reduced to a mere review of the legality of a designation decision adopted by the European Commission. It goes to the capacity of European law to grasp and regulate the new forms of power represented by very large digital platforms, hybrid entities which, while formally governed by private law, de facto perform functions that structure today’s public sphere, comparable to those traditionally performed by public authorities. Regulation 2022/2065 of 19 October 2022, known as the Digital Services Act or DSA, stems from an ambition that goes beyond regulating unfair commercial practices: it seeks to establish a legal order for the digital space capable of preserving, in the face of the unprecedented concentration of economic, informational and symbolic power represented by very large platforms, the conditions for the effective exercise of fundamental freedoms and for the functioning of democratic processes.
Amazon’s challenge reveals the scale of the conceptual upheaval entailed by this new regulatory regime. By contesting its designation as a very large online platform as well as the legality of the provisions of the DSA that define the criteria for such designation and the obligations flowing from it, the applicant was calling into question the very foundations of the regulatory architecture built by the EU legislature. Its argument was structured around a threefold inadequacy: the inadequacy of the quantitative criterion used to identify the platforms to be subject to the enhanced obligations regime, which allegedly ignores the qualitative differences between the various types of services; the inadequacy of the obligations imposed in relation to the risks actually generated by online marketplaces; and, finally, the inadequacy of the regulatory framework as a whole in the light of the proportionality requirements arising from the Charter of Fundamental Rights. This threefold challenge invited the General Court to rule on fundamental questions relating to the theory of fundamental rights, the philosophy of economic regulation and the epistemology of risk in contemporary technological societies.
By rejecting all the pleas raised by the applicant while subjecting the contested provisions to close review of their compatibility with the requirements of the Charter, the General Court achieves a remarkable synthesis between deference and vigilance. On the one hand, it recognises that the EU legislature enjoys a substantial margin of discretion in determining the practical arrangements for pursuing objectives of general interest. On the other hand, it asserts that this margin of discretion is not unlimited and that the court retains the power to strike down provisions that are manifestly inappropriate or disproportionate. This dialectic runs through the entire decision and gives it a theoretical depth that goes beyond the case at hand. The judgment does not merely validate the legal regime governing very large platforms; it outlines a renewed conception of regulation in digital societies, reconciling the imperative of protection against systemic risks with respect for economic freedoms and fundamental rights.
I. Validation of the concept of digital systemic risk
The first question concerned the legality of the criterion laid down in Article 33(1) of the DSA for identifying the platforms subject to the enhanced obligations. The choice of a quantitative threshold (forty-five million average monthly active users in the European Union, or ten per cent of the population) rather than a qualitative case-by-case assessment reflects a logic of objectifying risk that is characteristic of what Michel Foucault called modern “governmentality”, favouring quantification techniques over casuistic approaches. The underlying assumption is that a platform’s capacity to generate systemic risks correlates with its number of users closely enough for that number to serve as a reliable proxy for a direct assessment of dangerousness. That assumption was not self-evident and warranted Amazon’s challenge.
A. The foundations of the systemic risk approach: transposing to the digital sphere a paradigm borrowed from the financial sector
The concept of systemic risk, borrowed from the vocabulary of financial regulation, traditionally refers to the risk that the failure of one financial institution spreads by contagion to the whole system. Transposing it to the digital sphere raises considerable conceptual difficulties. Whereas in the financial sector systemic character stems from the technical and economic interdependence of institutions, nothing of the kind characterises digital platforms which, as Amazon argued, are largely independent of one another and do not form a “system” in the strict sense.
The systemic risk associated with very large platforms is therefore not a risk of contagion within a system of interdependent entities, but a risk to society as a whole, affecting or liable to affect a significant part of the population in the exercise of its fundamental rights or in its participation in democratic processes.
This broad conception, which the General Court endorsed, reflects a fundamental awareness of the role played by very large platforms in structuring today’s public sphere. As recital 75 of the DSA notes, these platforms play “an important role […] in facilitating public debate, economic transactions and the dissemination to the public of information, opinions and ideas”. This recognition presupposes accepting that very large platforms are not mere neutral providers of technical services, but actors which, through their design choices, recommender algorithms and moderation policies, actively shape the conditions of access to information and the terms of participation in public debate. It also presupposes accepting that these private actors should be subject to obligations more akin to those traditionally imposed on public authorities.
Article 34(1) of the DSA lists four broad categories of systemic risk. The first concerns the dissemination of illegal content, a notion broadly defined as “any information that […] is not in compliance with Union law or the law of any Member State”, covering a wide spectrum ranging from counterfeiting to incitement to hatred. The second category covers “any actual or foreseeable negative effects for the exercise of fundamental rights”, listing in particular human dignity, respect for private life, data protection, freedom of expression, non-discrimination, the rights of the child and consumer protection. This non-exhaustive list reflects a broad approach that is not confined to cases of formal illegality but encompasses any substantial infringement of fundamental values. The third and fourth categories concern negative effects on civic discourse, electoral processes and public security, as well as gender-based violence, the protection of public health and minors, and consequences for physical and mental well-being. This extension beyond the realm of illegality stricto sensu reflects a particularly ambitious conception of the regulator’s task, which is no longer limited to penalising unlawful conduct but seeks to prevent the emergence of potentially pathological social or psychological dynamics.
The General Court upheld the choice of a purely quantitative criterion, holding that the legislature had not made a manifest error of assessment in considering that marketplaces reaching forty-five million users were liable to generate various systemic risks. This endorsement rests on a twofold empirical finding. First, marketplaces can indeed facilitate the sale of dangerous or counterfeit products and serve as vehicles for the dissemination of illegal content through advertisements or reviews. Amazon itself acknowledged that it had had to introduce preventive rules in its general terms and conditions, confirming a contrario the existence of a real risk. Second, the fact that a platform has a large number of users increases the number of people liable to be exposed to problematic content, amplifying potentially harmful effects. The forty-five million threshold is therefore a reasonable indicator of the capacity to generate systemic risks, even though it cannot capture all the qualitative nuances between the various types of services.
B. Proportionality review as a means of reconciling the imperative of regulation with respect for economic freedoms
Recognising the legitimacy of the general interest objective did not relieve the General Court of the need to review closely the proportionality of the interferences with fundamental rights. This review is particularly important in a field where the legislature’s choices rest on complex, forward-looking assessments of how technologies and uses will evolve. The exercise undertaken by the General Court illustrates both the methodological sophistication of proportionality review and the difficulties inherent in such review in the face of empirical uncertainty and technical complexity.
Amazon relied first on an infringement of the freedom to conduct a business, enshrined in Article 16 of the Charter, arguing that the obligations imposed by Articles 34 to 43 of the DSA impose a significant burden and require complex and costly changes to IT systems. The General Court accepted that these obligations did indeed constitute an interference with the freedom to conduct a business, thereby acknowledging that it does not underestimate the extent of the constraints imposed. However, the freedom to conduct a business is not an absolute prerogative and may be subject to a broad range of interventions by public authorities in the general interest. This statement reflects a European conception of economic freedoms as participatory freedoms whose exercise necessarily takes place within a normative framework defined by the legislature, a conception that differs from the American constitutional tradition, in which freedom of contract and private property enjoy particularly strong protection.
The General Court held that the freedom to conduct a business had to be reconciled with Article 38 of the Charter, which seeks to ensure a high level of consumer protection. In accordance with settled case law, the importance of that objective may justify negative economic consequences, even substantial ones, for certain operators. This approach reflects an implicit hierarchy that attaches particularly great weight to consumer protection and to the prevention of systemic risks.
As regards proportionality review stricto sensu, the General Court carried out a structured three-stage analysis. First, it examined whether the obligations were appropriate for achieving the objective of preventing systemic risks, holding that the various obligations laid down in Articles 34 to 43 do indeed contribute to identifying, assessing and mitigating those risks. Second, it examined whether the obligations went beyond what was strictly necessary. Amazon suggested less restrictive alternative measures: excluding marketplaces, adopting qualitative criteria, limiting access to advertising repositories to researchers and authorities only. The General Court rejected these arguments, noting that these alternatives would not achieve the same level of protection. Excluding marketplaces was not justified, since they are liable to generate numerous systemic risks. Using qualitative criteria would have the drawback of lengthening and complicating the designation process while introducing damaging legal uncertainty. Limiting access to the repositories would deprive the media and consumer associations of the ability to scrutinise the advertisements displayed. Third, the General Court assessed whether the interference was disproportionate, emphasising that the obligations remain targeted, structured and surrounded by procedural safeguards.
The General Court briefly rejected the plea alleging infringement of the right to property guaranteed by Article 17 of the Charter, noting that Amazon put forward no substantive argument and that the obligations, although they impose administrative burdens, do not deprive providers of ownership of their platforms. This analysis is consistent with case law according to which regulating the use of property does not in itself constitute an interference with the right to property, Article 17 expressly providing that “the use of property may be regulated by law in so far as is necessary for the general interest”.
The plea alleging infringement of the principle of equal treatment called for a more substantial analysis. Amazon argued that Article 33 treats the different types of platforms in the same way even though they allegedly generate different risks. The General Court held that, given the purpose of the DSA, which is to prevent systemic risks to society as a whole, the different types of platforms reaching the forty-five million user threshold are in a comparable situation, since they are all liable to expose a significant part of the population to potentially problematic content. Amazon also challenged the difference in treatment between platforms above the threshold and those below it. The General Court recalled that the legislature had considered that a platform generates systemic risks at Union level when it reaches ten per cent of the population, favouring a clearly supranational approach.
II. Validation of the obligations imposed on very large platforms
Beyond the validation of the designation criterion, the judgment is of major interest for its analysis of several specific obligations. Amazon challenged the obligation to offer a recommendation option not based on profiling (Article 38), the obligation to maintain a public advertising repository (Article 39), and the obligation to provide vetted researchers with access to certain data (Article 40). Examining these obligations makes it possible to grasp the general philosophy of the framework, which rests on a threefold requirement of transparency, accountability and democratic oversight. This philosophy reflects what might be described, borrowing Foucault’s terminology, as “algorithmic governmentality”, a mode of government that seeks not so much to prohibit as to make visible the mechanisms by which platforms operate and to create the conditions for informed public debate.
A. The obligation to offer recommendation options not based on profiling
Article 38 of the DSA is one of its most remarkable innovations, aimed at enabling users to choose the information to which they are exposed by giving them the option of being recommended only products whose selection has not been influenced by profiling. The issue goes beyond the protection of personal data and touches on the more fundamental question of the extent to which individuals should retain some degree of control over the mechanisms that determine the information to which they are exposed, or whether it should be accepted that this determination may be entirely delegated to opaque algorithms driven by the aim of maximising engagement.
Amazon challenged this obligation by alleging an infringement of its freedom of commercial expression, arguing that it limited its ability to present the most relevant products to consumers. This argument rests on the assumption that recommender systems based on profiling are the most effective way of matching supply to consumer preferences. However, an extensive body of social science literature has shown that individual preferences are largely endogenous to the systems that solicit them and that recommender systems do not reveal pre-existing preferences but actively help to shape them. From this perspective, Article 38 can be understood as a mechanism designed to preserve a degree of pluralism in the ways information is presented and to prevent users from being trapped in filter bubbles.
The General Court accepted that Article 38 constitutes an interference with the freedom of expression and information of marketplaces. However, it considered that interference to be justified and proportionate. As regards justification, it noted that Article 38 strengthens consumers’ rights by giving them the opportunity to express a choice, thereby contributing to a high level of consumer protection. The provision is capable of preventing a systemic risk within the meaning of Article 34(1)(b). As regards proportionality, the General Court highlighted several points. First, Article 38 does not restrict providers’ freedom to present products within a system not based on profiling, leaving them wide latitude. Second, the provision does not prohibit offering systems based on profiling; it merely requires an alternative option to be offered as well. Users retain the option of choosing profiling and may return to it if they wish. Third, the obligation does not harm consumers but strengthens their rights by offering them a choice. The General Court also dismissed the argument that Article 38 would favour large companies to the detriment of SMEs, noting that Amazon did not explain why large companies would not develop niche products or why marketplaces would not allow searches by criteria.
B. Advertising transparency and data access obligations: building an infrastructure for democratic oversight
The obligation to maintain a public advertising repository (Article 39) is a major innovation whose scope goes beyond consumer protection and extends to establishing democratic oversight of ad targeting mechanisms. The provision requires the publication of a repository containing, in particular, the content of the advertisements, the identity of the advertiser, the period during which they were displayed, the targeting parameters and the number of recipients reached. The obligation is intended to enable three levels of oversight: individual, by each user, who can understand why they are being shown a particular advertisement; collective, by the media and consumer associations, which can identify problematic practices; and institutional, by regulators and researchers, who can analyse overall trends.
Amazon challenged this obligation by alleging an infringement of its right to respect for private life, arguing that disclosing information about advertisements could cause commercial harm by revealing elements of its business strategy to competitors. The General Court acknowledged that Article 39 constitutes an interference with the right to respect for private life, confirming that the protection afforded by Article 7 of the Charter extends to the professional and commercial activities of legal persons. However, it considered that interference to be justified and proportionate. As regards justification, the General Court recalled that the limitations are intended to reduce systemic risks in order to contribute to a high level of consumer protection. The repository serves to inform consumers but also to enable the media and associations to scrutinise the advertisements displayed, in particular to prevent the promotion of illegal or inappropriate products to vulnerable audiences such as minors.
As regards proportionality, the General Court highlighted several points.
First, the information concerns only a limited part of the economic activity (Amazon acknowledged that its advertising revenue accounts for only seven per cent of its total revenue).
Second, some of the information, such as that relating to the content of the advertisements and the products concerned, is not confidential, since it is by nature publicly accessible.
Third, the most commercially sensitive information, in particular that relating to an advertisement’s success as measured by its conversion rate, is not among the information to be disclosed. Fourth, Article 39 expressly excludes the disclosure of any personal data of the recipients. Taken together, these factors lead to the conclusion that the legislature struck a reasonable balance between the imperative of transparency and the protection of legitimate business interests.
The obligation to provide vetted researchers with access to certain data (Article 40) is one of the most ambitious provisions of the text. The obligation has two limbs. First, Article 40(4) provides that, upon a reasoned request from the Digital Services Coordinator, providers must give vetted researchers access to data for the sole purpose of conducting research that contributes to the detection and understanding of systemic risks. This first limb reflects a logic of expertise mobilised in the service of public regulation. Second, Article 40(12) requires access to publicly accessible data to be given to researchers who meet certain conditions, reflecting a broader logic of opening up data to the scientific community.
Amazon challenged these obligations by alleging an infringement of its right to respect for private life, arguing that they could lead to the disclosure of an “unlimited” quantity of confidential data without sufficient safeguards to preserve its confidentiality. The General Court rejected this argument on the basis of two sets of considerations. First, it recalled that marketplaces reaching the forty-five million user threshold are indeed liable to generate various systemic risks, so that the objective pursued by Article 40 is entirely legitimate. Second, it held that Article 40 provides sufficient safeguards. Article 40(5) allows the provider to request that the access request be amended in order to protect confidential data. Article 40(8) requires researchers to demonstrate that they are able to preserve the confidentiality of the data and to describe the appropriate technical and organisational measures. The General Court rejected the argument that the legislature should have set out in the Regulation the specific measures that researchers were required to adopt, holding that it could confine itself to imposing an obligation to demonstrate the ability to preserve confidentiality. This approach favours making actors accountable rather than detailed prescription, reflecting a logic of outcome-based regulation that has the advantage of flexibility.
Ultimately, the judgment of 19 November 2025 is a major contribution to the development of a European law on the regulation of digital platforms. By validating the architecture of the framework established by the DSA while subjecting it to close review of its compatibility with the Charter, the General Court achieves a remarkable synthesis between recognition of the legislature’s margin of discretion, affirmation of the court’s role as guardian of fundamental rights, regulatory pragmatism in the face of empirical uncertainty, and methodological rigour in proportionality review. The decision endorses a functional approach to the concept of systemic risk that seeks to capture the reality of the influence exerted by very large platforms on contemporary society. It affirms that consumer protection, the prevention of infringements of fundamental rights and the safeguarding of the integrity of democratic processes are objectives of general interest of particular importance, capable of justifying substantial interferences with operators’ economic rights. Although Amazon has announced its intention to appeal, it already appears that the Court of Justice will find it difficult to overturn a decision so solidly reasoned and so aware of the theoretical and practical issues raised by the regulation of very large digital platforms.
The General Court’s validation of the DSA regulatory framework is therefore very probably a decisive step in the affirmation of a European model for regulating digital platforms, a model that seeks to preserve a delicate balance between economic innovation, consumer protection, the safeguarding of fundamental values and the preservation of the conditions for the effective exercise of freedoms in the digital public sphere.
