Brussels Prepares VLOP Designation for ChatGPT and Roblox

Two Platforms, Two Trajectories, One Regulatory Threshold

The European Commission is set to designate ChatGPT and Roblox as "very large online platforms" in August, placing them alongside Facebook, Instagram, TikTok, YouTube, and other services already subject to the EU's most rigorous digital oversight. The move reflects how quickly both platforms have scaled: ChatGPT reached global ubiquity within eighteen months of its public launch, while Roblox has grown into one of the world's most popular social gaming environments, particularly among children and teenagers.

At DailyTechWire, we've tracked the rapid expansion of the Digital Services Act's VLOP list since the regulation came into force. The designation applies automatically to any platform or search engine that logs more than 45 million monthly active users in the EU. While neither OpenAI nor Roblox Corporation has publicly confirmed their European user counts, the threshold suggests both services have achieved significant penetration across the bloc's 27 member states.

The timing is notable. Both companies are navigating intense scrutiny over safety and moderation practices. OpenAI faced criticism in early 2025 after it emerged that the company had banned an account linked to a mass shooting suspect without informing law enforcement. Roblox, meanwhile, is defending itself against multiple lawsuits alleging it failed to protect minors from predatory behavior on its platform. The VLOP designation will formalize obligations that advocacy groups and regulators have long argued should apply to platforms of this scale.

What the Designation Demands

Once formally listed, ChatGPT and Roblox will have four months to establish compliance infrastructure. The DSA requires VLOPs to appoint a dedicated point of contact for both users and authorities, rewrite terms of service to meet plain-language standards, and disclose the logic behind their recommendation algorithms, advertising systems, and content moderation decisions.

Risk assessment is the most demanding requirement. Platforms must identify and evaluate systemic risks in seven categories: illegal content, threats to electoral integrity, gender-based violence, infringement of freedom of expression, media freedom, discrimination, and harm to minors. After mapping these risks, they must implement mitigation measures and document their effectiveness. The process is not a one-time exercise. VLOPs must undergo annual independent audits, share data with the European Commission, and grant access to vetted researchers.

For Roblox, the child safety dimension is particularly acute. The platform's user-generated content model allows millions of creators to build games and social experiences, many of which are consumed by players under 13. The DSA's risk assessment framework will require Roblox to demonstrate how it identifies grooming behavior, enforces age-appropriate content filters, and responds to reports of abuse. The company has already introduced parental controls and content ratings, but the VLOP designation will demand granular transparency about how these systems perform at scale.

ChatGPT's risk profile is different but no less complex. OpenAI must address concerns around misinformation, particularly in electoral contexts, as well as the platform's potential to generate harmful content related to self-harm, violence, or discrimination. The company has pledged to report credible threats to authorities following the 2025 incident, but the DSA will formalize this obligation and extend it to a broader set of risk categories. OpenAI will also need to clarify how its moderation systems handle non-English languages, a persistent challenge for AI-driven content platforms operating across the EU's linguistic diversity.

Enforcement and the Compliance Clock

The European Commission has shown it is willing to use the DSA's enforcement powers. In the past year, it has opened investigations into several VLOPs for alleged failures to comply with transparency and risk mitigation requirements. Fines can reach up to 6% of global annual revenue, a figure that would run into hundreds of millions of dollars for both OpenAI and Roblox.

The four-month compliance window is tight, especially for platforms that have not previously operated under this level of regulatory oversight. OpenAI, for instance, will need to build out legal and policy teams in Europe, establish data-sharing protocols with the Commission, and potentially redesign parts of ChatGPT's interface to meet transparency standards. Roblox, which already has a significant European user base and localized operations, may be better positioned, but the depth of the DSA's requirements still represents a step change from its current practices.

Both companies will also need to navigate the DSA's reporting obligations. VLOPs must publish regular transparency reports detailing the volume and nature of content moderation actions, the number of user complaints, and the outcomes of internal appeals processes. For platforms that have historically been opaque about their decision-making, this will be a cultural shift as much as a technical one.

Implications for the VLOP Regime

The addition of ChatGPT and Roblox expands the VLOP list beyond its original cohort of social media giants and search engines. ChatGPT is the first generative AI service to receive the designation, setting a precedent for how the EU will regulate large language models and other AI-driven platforms under the DSA. The framework was drafted before ChatGPT's public debut, and regulators are now adapting its provisions to fit a category of service that does not neatly align with traditional social media or search.

Roblox, meanwhile, occupies a hybrid space between gaming platform, social network, and creator economy. Its designation underscores the EU's broad interpretation of what constitutes an "online platform" under the DSA. If Roblox is a VLOP, other gaming-adjacent services with significant social features and user-generated content, such as Fortnite's Creative mode or Minecraft's multiplayer servers, may eventually face similar scrutiny.

The VLOP regime is also becoming a de facto global standard. While the DSA applies only within the EU, platforms often find it easier to implement changes globally rather than maintain separate compliance systems for different jurisdictions. OpenAI and Roblox may roll out new transparency features, moderation tools, and reporting mechanisms to all users, not just those in Europe. That would amplify the DSA's influence far beyond the bloc's borders, a dynamic we have seen play out with GDPR and other EU regulations.

What Comes Next

Neither OpenAI nor Roblox has publicly commented on the expected designation, and the European Commission typically does not confirm VLOP additions until they are formally announced. If the August timeline holds, both companies will need to move quickly to stand up compliance programs before the end of the year.

For users in the EU, the changes should bring greater transparency and more robust safety mechanisms. For the platforms themselves, the VLOP designation represents a new operating reality: one in which regulatory obligations are as central to product design as engineering and user growth. The next few months will reveal whether ChatGPT and Roblox can meet those obligations without compromising the features that made them successful in the first place.