VLOP
regulationFull Name: Very Large Online Platform
Definition
A Very Large Online Platform (VLOP) is an online platform or search engine that reaches 45 million or more average monthly active users in the European Union, as designated by the European Commission under the Digital Services Act (DSA, Regulation 2022/2065). The VLOP designation carries significant regulatory obligations under both the DSA (enhanced content moderation, transparency reporting, risk assessments) and the eIDAS 2.0 Regulation (mandatory acceptance of EUDI Wallet credentials). Under eIDAS 2.0, VLOPs are required to integrate EUDI Wallet credential verification into their authentication and identity verification flows, enabling EU citizens to log in, verify their identity, and prove attributes (such as age) using their EUDI Wallet instead of platform-specific accounts. This mandate makes VLOPs the first major category of private-sector relying parties required to accept the EUDI Wallet, ensuring immediate practical utility for the hundreds of millions of EU citizens who use these platforms daily. The VLOP mandate is a strategic regulatory decision that uses the enormous reach of Big Tech platforms to drive EUDI Wallet adoption and establish the wallet as a standard authentication method across the European digital economy.
VLOP Designation and the Digital Services Act
The VLOP concept originates from the Digital Services Act (DSA), adopted in 2022, which created a tiered regulatory framework for online platforms based on their size and societal impact. Platforms crossing the 45 million monthly active user threshold in the EU are designated as VLOPs by the European Commission after a formal assessment process. The threshold of 45 million represents approximately 10% of the EU population, ensuring that only platforms with truly significant reach face the enhanced obligations.
The European Commission's designation process involves platforms self-reporting their user numbers and the Commission verifying these figures. Designations are published in the Official Journal of the EU and take effect immediately. As of 2026, over 20 platforms and search engines have been designated, spanning social media (Meta's Facebook and Instagram, TikTok, X, Snapchat, Pinterest), search (Google Search, Microsoft Bing), e-commerce (Amazon, AliExpress, Zalando), app stores (Google Play, Apple App Store), video (YouTube), travel (Booking.com), maps (Google Maps), and professional networking (LinkedIn). The list evolves as platforms grow or shrink relative to the threshold.
The eIDAS 2.0 Regulation uses this existing VLOP framework rather than creating a new classification system, connecting the digital identity mandate to the DSA's established platform oversight structure. This regulatory cooperation means that VLOPs already subject to enhanced DSA obligations (including dedicated compliance officers, annual risk assessments, and algorithmic transparency) must also invest in EUDI Wallet integration, adding identity verification capabilities to their regulatory compliance requirements.
VLOP Obligations Under eIDAS 2.0
The eIDAS 2.0 Regulation imposes specific obligations on VLOPs regarding EUDI Wallet acceptance. The primary obligation is to enable users to authenticate using their EUDI Wallet as an alternative to platform-specific login mechanisms. This means that a user on Google, Amazon, or Facebook must be able to choose "Login with EUDI Wallet" alongside existing options. The VLOP must implement the OpenID4VP protocol to receive and verify credential presentations from the wallet, validate the credentials against the EU Trusted Lists, and create or link a user account based on the verified attributes.
VLOPs must comply with the data minimization requirements of both eIDAS 2.0 and GDPR when requesting attributes from the wallet. For basic authentication, a VLOP can request a pseudonymous identifier and basic profile information (such as name and email address). For age verification (required by the DSA for certain content), the VLOP can request only an age-over attestation rather than the full date of birth. For identity verification (required for specific platform functions like marketplace selling), the VLOP may request additional attributes but must justify each request against its stated purpose.
The regulation also requires VLOPs to treat EUDI Wallet authentication on equal footing with their existing authentication methods. A VLOP cannot make wallet authentication deliberately more cumbersome than password-based login, hide the wallet option in obscure settings, or reduce platform functionality for users who authenticate via the wallet. This non-discrimination principle ensures that EUDI Wallet users receive the same experience and capabilities as users of traditional authentication methods.
Impact on the EUDI Wallet Ecosystem
The VLOP mandate is arguably the most important driver of EUDI Wallet adoption in the private sector. By requiring the platforms with the largest reach to accept wallet credentials, the regulation ensures that EUDI Wallet holders have immediate, daily use cases for their wallet beyond occasional government service interactions. When a citizen can use their EUDI Wallet to log into Google, verify their age on TikTok, and authenticate on Amazon, the wallet becomes an integral part of their digital life rather than a rarely-used government tool.
The VLOP mandate also creates a demonstration effect that is expected to drive voluntary adoption by smaller platforms and services. When citizens become accustomed to "Login with EUDI Wallet" on major platforms, they will expect similar functionality from smaller services, creating market pressure for widespread adoption beyond the legally mandated entities. This cascading adoption pattern has been observed in other technology mandates, where regulatory requirements on the largest players establish de facto standards that the rest of the market follows.
For VLOPs themselves, the mandate presents both compliance costs and potential benefits. Integration costs include implementing OpenID4VP credential verification, connecting to EU Trusted Lists, adapting account systems to support wallet-based authentication, and training staff on the new system. However, VLOPs also benefit from reduced fraud (wallet-verified identities are more trustworthy than self-asserted email registrations), simplified age verification (replacing unreliable methods like self-declaration or credit card checks), and reduced liability for identity-related issues. Some VLOPs, particularly those already investing in identity verification infrastructure (such as financial services platforms), may view the EUDI Wallet as a cost-saving mechanism that replaces expensive proprietary identity verification systems.