Elena Voss45 million is the line—but only for a service the EU can first classify as an online platform. Under the Digital Services Act, that many average monthly active EU recipients crosses the audience threshold for designation as a very large online platform. The number alone cannot put a chatbot in the category.
Key takeaways
- The DSA’s 45 million average monthly EU-recipient threshold applies only after a service qualifies as an online platform; audience size alone cannot make ChatGPT a VLOP.
- WhatsApp Channels shows that the Commission can regulate a qualifying feature rather than an entire product, but that precedent does not resolve whether private chatbot responses amount to public dissemination.
- Roblox fits the conventional platform model because users publish games and communicate, while its safety obligations increasingly operate through age checks, account types, parental controls, publishing gates, and experience reviews.
- ChatGPT tests an interface-neutral approach to platform law: regulators may examine systemic influence across personalized interactions even without a public feed, but the legal classification and relevant EU audience remain unresolved.
- VLOP compliance depends on operational evidence. OpenAI would need records around response risks and human escalation, while Roblox would need evidence covering age signals, publishing decisions, reviews, and recommendations.
A report of planned August designations would place OpenAI’s ChatGPT beside Roblox. ChatGPT usually responds to one user at a time. Roblox lets creators publish games and communicate with other users. The report provides no relevant EU-recipient count for either product, and the Commission has not announced the designations.
The DSA defines an online platform around storing and disseminating information to the public at a user’s request. Roblox follows that familiar pattern; a private ChatGPT response raises a harder classification question. The report does not provide the Commission’s reasoning. If the Commission proceeds, Roblox will show how platform rules reach product architecture, while ChatGPT will test where platform law meets conversational software.
WhatsApp Channels shows a feature can qualify
The Commission’s early VLOP designations covered social feeds, search engines, and marketplaces. The EU General Court later upheld Amazon Store’s designation, confirming that a marketplace can enter the regime without resembling a social network.
Meta then reported that WhatsApp Channels crossed the threshold in the second half of 2024. The Commission placed WhatsApp Channels under VLOP rules after the feature reached 46.8 million average monthly EU recipients.
The Commission designated Channels rather than all of WhatsApp, drawing the regulated boundary around the broadcast feature. Meta must therefore apply the relevant duties to the distribution surface that met the statutory conditions.
The Commission would still have to classify ChatGPT as an online platform, establish its recipient count, and designate it before VLOP systemic-risk duties could apply. The WhatsApp decision establishes feature-level scope; it does not settle ChatGPT’s classification.
Roblox turns safety rules into routing logic
An April 2026 Nevada settlement requires Roblox to pay $12.5 million and implement age verification for all users. Ofcom also said Roblox agreed to stronger anti-grooming measures, including an option for parents to switch off chat for users under 16.
Roblox introduced Kids accounts for users ages 5 through 8 and Select accounts for ages 9 through 15. Games offered to those groups must pass a three-step review. Roblox now uses age, account type, review status, and parental settings to decide who can speak, publish, and enter an experience.
Those controls can fail. After Roblox expanded its Persona-powered age-check system globally in January, Wired reported that it classified some children as adults and some adults as children. The publication also found age-verified accounts offered for sale online. A wrong estimate can route a user into the wrong chat and content permissions, although the reports do not establish how often such errors occurred.
Roblox creators encounter the rules as publishing gates, while parents encounter them as chat and access settings. The company must maintain both sets of controls before content reaches a moderation queue.
Roblox must govern the prompt-to-game path
Roblox’s Build feature lets users create basic games through text prompts in the mobile app, using Roblox and open-source models. Roblox Assistant can plan, build, and test games through agentic tools.
A Roblox user can now move from an idea to an executable game without mastering conventional development software. Roblox must decide who may publish the result, what automated production can generate, how the game is tested, and which age groups may receive it.
Roblox has said developers will need Roblox Plus to publish games for Kids and Select accounts. That requirement places an eligibility check between generation and distribution, while the three-step review tests the resulting experience before younger users can enter it.
The DSA separately requires designated VLOPs to offer a recommender option that does not rely on profiling. If Roblox is designated, its compliance team will need evidence from both sides of the product: how creators produced and cleared a game, and how Roblox recommended it to users.
ChatGPT makes private influence hard to classify
ChatGPT gives each user a private response. OpenAI can repeat that conversational interface across a large user base even though no public feed displays the combined audience.
The available sources do not establish that private chatbot sessions create the same systemic risks as public feeds, or how the Commission would measure any such effects. They do show why regulators may examine more than the visible size of an audience when a product supplies personalized advice.
Pennsylvania sued Character.AI after alleging that one character posed as a psychiatrist, and the state sought to prevent chatbots from impersonating doctors. The allegation does not establish comparable behavior by ChatGPT. It illustrates the role confusion a regulator may examine when a system presents advice in a human-sounding exchange.
If the Commission designates ChatGPT, OpenAI will need to define which product surfaces belong to the regulated service and document how it assesses risks in personalized responses. Its compliance team must also decide when a user can reach a person, what context that reviewer can inspect, and how the company records the outcome.
The Commission asks companies to expose their controls
The Commission’s investigation of X examined illegal-content handling, disinformation, advertising transparency, deceptive design, and data access. In July 2026, the EU accepted X’s plan to meet transparency obligations and provide researcher access, giving the company six months to implement it after a €120 million fine in 2025.
The Commission is also seeking technical access closer to the model layer. In May, it said it was discussing access to the latest AI models with OpenAI and Anthropic, with OpenAI proactively offering access. Those talks do not establish what formal access the Commission might require or whether the parties reached an agreement.
Designated VLOPs must assess and mitigate systemic risks, undergo independent audits, and provide specified access to vetted researchers. OpenAI and Roblox would have to connect those duties to different evidence: response evaluations and escalation records for ChatGPT; age signals, publishing decisions, recommendation settings, and review results for Roblox.
Roblox already faces country-specific demands. Russia blocked the service in December 2025 and restored access in June 2026 after Interfax reported that authorities had found the company compliant with local legal requirements. The reports do not identify the exact product changes that secured restoration.
OpenAI and Roblox can answer regulators only if their records show who acted, what the system presented, which rule applied, and whether a person intervened.
At 45 million average monthly EU recipients, a qualifying online platform reaches the DSA’s VLOP line. The reported ChatGPT case turns on whether the chatbot is an online platform at all, a question the number cannot answer.
Roblox’s path from publishing controls to possible platform designation
- 2026-04-14 — Roblox said developers would need the $4.99-per-month Roblox Plus subscription to publish games for Kids and Select accounts.
- 2026-06-16 — Roblox said it would roll out biometric age checking to place users into age-based accounts; Kids and Select accounts launched in four countries.
- 2026-07-16 — Roblox unveiled Build, which creates basic mobile games from text prompts using Roblox and open-source models.
- 2026-07-30 — The European Commission was reported to be planning VLOP designations for Roblox and ChatGPT in August; the move remained rumored.
Frequently asked questions
Has the European Commission designated ChatGPT and Roblox as VLOPs?
No designation has been announced. A report says the Commission may act in August, but it provides neither the relevant EU-recipient counts nor the Commission’s legal reasoning.
Why doesn’t having 45 million EU users automatically make ChatGPT a VLOP?
The threshold applies only to a service first classified as an online platform under the DSA. ChatGPT’s private, one-to-one responses create uncertainty over whether it stores and disseminates user-requested information to the public.
What does the WhatsApp Channels decision establish?
It shows that the Commission can draw the regulated boundary around one qualifying distribution feature rather than an entire app. It does not establish that a private conversational interface qualifies on the same basis.
How could VLOP rules change Roblox?
Roblox would need to connect creator eligibility, game reviews, age-based access, chat permissions, parental settings, and recommendation systems to its systemic-risk controls. It would also have to offer a recommender option that does not rely on profiling.
What obligations follow a VLOP designation?
Designated services must assess and mitigate systemic risks, undergo independent audits, and provide specified access to vetted researchers. Compliance therefore requires records showing what users encountered, which rules applied, and when people intervened.