By Operator One Editorial — 22 May 2026
Two pieces of EU legislation reshaped what marketplaces are required to verify about the sellers and products they host: the General Product Safety Regulation (GPSR, Regulation (EU) 2023/988, applicable from 13 December 2024) and DAC7 (Council Directive (EU) 2021/514, transposed into national law and effective from 1 January 2023 with first reporting due 31 January 2024).
Eighteen months into GPSR and over two years into DAC7, the marketplace landscape has shifted in concrete, visible ways. Here is what we are seeing on the operational floor.
GPSR: the responsible person requirement is being enforced
Article 4 of GPSR requires every product placed on the EU market to have an economic operator established in the Union responsible for product safety, identifiable on the product, on its packaging, or in accompanying documentation. For products imported from outside the EU, this typically falls to the importer or to an authorised representative.
What this has meant in practice on marketplaces:
- Amazon EU's compliance dashboard now flags listings without a verified responsible person and removes them after a grace period
- Bol.com began requiring responsible-person details at listing creation in Q1 2026 for all non-EU sellers
- eBay sends quarterly reminders to verify responsible-person assignments per listing
- Cdiscount has integrated responsible-person fields into its product feed schema
The pattern: marketplaces are no longer waiting for incident reports. They are blocking at upload.
DAC7: the data is being collected and reported
DAC7 places marketplaces (digital platforms) in the role of mandatory tax-data reporters. They must collect Tax Identification Numbers, business names, addresses, financial-account identifiers, and consideration paid per seller per quarter, and report it to the local tax authority by 31 January each year for the prior calendar year.
The first reports for 2023 activity went in on 31 January 2024. The 2024 reports were filed in January 2025. The 2025 reports were filed by 31 January 2026.
What that means for a brand: any seller account active on an EU marketplace in 2025 has now had its identity, address, and turnover reported to at least one national tax authority. Inconsistencies between marketplace-reported data and the seller's own VAT filings are now being matched. We have already seen a number of audits triggered by exactly this mismatch.
What is being suspended
From our own operational data across 100+ marketplaces in the last 18 months, the most frequent reasons for listing or account suspension tied to GPSR/DAC7 enforcement:
- Missing or unverifiable EU responsible person on a non-EU branded product
- Mismatch between the seller's registered legal name and the name on the consumer-facing invoice
- Missing or stale Tax Identification Number for DAC7 reporting purposes
- Inability to produce a Declaration of Conformity within the marketplace's stated response window
- Product category restrictions (cosmetics, toys, electrical) where CE evidence cannot be linked to the listing
The Merchant of Record angle
For brands without a permanent EU establishment, the GPSR responsible-person obligation and the DAC7 data-collection obligation both land on either the brand directly or on a Merchant of Record acting on its behalf. When Operator One sells a product as MoR, we are the responsible person on file with the marketplace, our VAT and DAC7 records reconcile to the marketplace's reporting, and our team is the contactable EU address for product-safety queries.
Looking forward
The compliance net keeps tightening. GPSR enforcement is now routine. DAC7's annual reporting cycle is now ordinary practice. The next wave — the Digital Product Passport under the Ecodesign for Sustainable Products Regulation (ESPR) — begins to bite from 2027 onward, starting with batteries. We covered the implications in our April note.
Related