Global Trends in Telecom Oversight of Online Platforms

Executive snapshot: why telecom regulators now police online platforms

The walls separating traditional telecom oversight from platform regulation are collapsing. What began as distinct regulatory domains—voice networks governed by national telecommunications authorities, and digital platforms loosely supervised under information society rules—has merged into a unified governance challenge. As mobile networks evolve to support everything from social media streaming to cloud-native enterprise applications, telecom regulators find themselves policing entities that look nothing like the circuit-switched carriers of decades past.

This convergence reflects a fundamental shift in how governments view critical infrastructure. When a messaging app carries more traffic than SMS, when cloud providers underpin financial markets, and when app stores control what software reaches billions of connected devices—the old distinctions between “carriage” and “content” become meaningless. Regulators are responding by extending telecom-style duties to digital platforms while simultaneously importing content-governance concepts into traditional telecoms law.

The headline trends shaping this space:

• Online safety rules now impose content moderation duties on services historically treated as neutral pipes, with telecom operators increasingly accountable for what flows through their networks

• Data and competition remedies target “gatekeeper” platforms with obligations borrowed from telecom interconnection frameworks

• Infrastructure-style duties extend to Very Large Online Platforms (VLOPs) and search engines, treating them as essential facilities requiring regulatory supervision

• Telecom–platform disputes over data traffic intensify as operators push for “fair share” contributions from bandwidth-heavy services

• Cross-border enforcement accelerates through regional cooperation, model laws, and mutual recognition agreements

The 2023–2026 window represents the decisive implementation phase. The EU’s Digital Services Act (DSA) and Digital Markets Act (DMA) are now fully operational. The UK’s Online Safety Act entered force in late 2023, with Ofcom rolling out phased codes through 2026. Brazil continues debating its “PL das Fake News” while India advances drafts of its Digital India Act. Even the traditionally light-touch US sees mounting state-level initiatives targeting platform conduct.

What this means for telecom groups and large digital platforms: regulatory convergence is no longer theoretical. Compliance costs are climbing—telecom companies report 15-20% operational expenditure increases from new mandates. Organizations need integrated governance structures spanning network operations, content policy, competition law, and cybersecurity. The era of treating telecom oversight and platform regulation as separate disciplines is over.

Redrawing the boundary: when is a platform a telecom service?

The distinction between “electronic communications services” and “information society services” once seemed straightforward. Telecom meant phone calls and SMS. Information services meant websites and apps. But over-the-top (OTT) messaging, VoIP calling, and cloud-based communications thoroughly blurred this line, forcing regulators to rethink fundamental classifications.

The EU’s European Electronic Communications Code (EECC), in force since December 2020, represents the most comprehensive attempt to redraw these boundaries. It introduced the concept of “number-based interpersonal communications services,” bringing WhatsApp-style calling and Skype Out–type services into telecom oversight when they connect to traditional numbering systems. These services now face obligations around emergency access, lawful intercept capabilities, and network security requirements previously reserved for licensed carriers.

• Germany’s EECC implementation explicitly covers number-based OTT services, requiring providers to support emergency calling and comply with interception orders

• France’s ARCEP issued detailed guidance distinguishing number-based services (subject to telecom rules) from number-independent services (lighter obligations)

• Spain’s 2022 transposition included specific OTT obligations, bringing major messaging platforms into the national regulatory framework

• The US maintains a contrasting approach, with the FCC largely treating messaging and most OTT communications as “information services” outside core telecom rules, though classification debates continue

• India’s Telecom Bill 2023 drafts explored inclusion of OTT communication services, reflecting government concerns about regulatory arbitrage between licensed carriers and internet-based alternatives

• Gulf states like Saudi Arabia (CITC) and Qatar (CRA) require VoIP licensing, directly regulating services that bypass traditional international calling revenue streams

• African regulators experiment with registration requirements for large OTT messaging apps, seeking to extend at least basic oversight to platforms commanding massive user bases

This reclassification matters enormously for digital services operating across borders. A messaging platform that qualifies as a telecom service in one jurisdiction but an information service in another faces fragmented compliance obligations, different liability regimes, and varying enforcement exposure.

Online safety and content governance led by telecom regulators

Telecom regulators traditionally focused on network-layer harms: spam, malware, illegal interception, spectrum interference. User-generated content remained outside their mandate, handled—if at all—through separate media or information society frameworks. That separation is dissolving rapidly as regulators recognize that connectivity providers and platform operators are increasingly the same entities, and that network access enables content-related harms at unprecedented scale.

The UK Online Safety Act 2023 represents the most ambitious attempt to create unified content governance. Ofcom, historically a telecom and broadcasting regulator, now oversees duties of care for “user-to-user” services and search engines. The 2024–2026 implementation phases progressively introduce requirements around illegal content, child safety, and—for platforms exceeding user thresholds—“legal but harmful” content affecting adults. Many UK-based telecom operators with content, hosting, or app ecosystem arms fall directly under this regime, requiring them to conduct risk assessments, implement age verification, and maintain rapid takedown processes.

The EU Digital Services Act (DSA), fully applicable to all intermediaries from February 2024, creates a tiered system of obligations. Basic intermediaries must respond to court orders and maintain transparency. Hosting services add notice-and-action requirements. Online platforms must trace traders on their marketplaces. Very Large Online Platforms (VLOPs) and Very Large Search Engines (VLOSEs)—those with 45 million or more EU users—face systemic risk assessments, external audits, and algorithmic transparency requirements. Telecom-operated marketplaces, app stores, and cloud platforms may qualify as VLOPs, subjecting them to the full compliance stack.

Australia’s eSafety regime, anchored in the Online Safety Act 2021 with updated 2024 industry standards, takes a different approach. It imposes expectations on ISPs and carriage service providers to support age assurance technologies, block abhorrent violent material, and cooperate proactively with the eSafety Commissioner. This model explicitly treats telecom infrastructure as a vector for content enforcement, requiring connectivity providers to take action even when they don’t host the offending material.

Canada’s Bill C-63 (Online Harms Act), introduced in 2024 and likely to see revisions through 2025–2026, will interact with the CRTC’s telecom powers and existing Broadcasting Act reforms. The proposed framework creates a Digital Safety Commission with authority to impose significant penalties for safety failures, and specifically contemplates how telecom and broadcasting regulators coordinate enforcement.

Emerging markets are moving even faster, often using telecom licensing and infrastructure controls to enforce content rules on platforms:

• Brazil’s PL 2630/2020 (“Fake News Bill”) would require platforms to maintain local representatives, respond rapidly to court orders, and face liability for paid content—with telecom regulators playing supporting roles in enforcement

• Indonesia’s MR5 and Kominfo’s content takedown rules give authorities sweeping powers to order blocking and removal, enforced through telecom licensing conditions

• Turkey’s social media law leverages BTK’s licensing authority and bandwidth throttling capabilities to compel platform compliance with local content rules, effectively treating access degradation as a regulatory tool

The pattern is clear: content governance increasingly flows through telecom channels, and organizations operating telecommunications infrastructure must now understand and manage content-related obligations that would have seemed alien a decade ago.

Competition and “gatekeeper” oversight: DMA, app stores, and zero-rating

Competition law historically targeted dominant telecom operators, breaking up monopolies and mandating interconnection. That toolkit is now pivoting toward large digital platforms—yet telecom regulators and antitrust authorities increasingly work in tandem, recognizing that platform market power affects telecom ecosystem dynamics and vice versa.

The EU Digital Markets Act (DMA), in force since November 2022 and fully applicable from March 2024, defines “gatekeepers”—platforms meeting quantitative thresholds for core platform services like app stores, messaging, search, and operating systems. Designated gatekeepers face obligations on app store fairness, self-preferencing bans, and data portability that directly affect how telecom operators negotiate access, bundle services, and compete for retail customers.

Key competition developments affecting telecom-platform dynamics:

• South Korea’s 2021 legislation on in-app payment choice requires app stores to allow alternative payment methods, impacting commission structures and local MNO partnerships that relied on carrier billing integration

• Japan’s Act on Improving Transparency and Fairness of Digital Platforms mandates disclosure obligations for major app stores and online marketplaces, increasing visibility into terms that affect telecom partners

• The EU DMA’s interoperability requirements for messaging services may eventually require dominant platforms to exchange data with smaller competitors, potentially including telecom-operated messaging services

• BEREC’s 2022 net-neutrality guidelines clarify when zero-rating arrangements violate open internet principles, directly affecting telecom providers’ ability to differentiate through content partnerships

• The Netherlands banned certain zero-rating plans involving Facebook and WhatsApp, setting precedent for how competition and network neutrality interact

• India’s TRAI 2016 prohibition on discriminatory tariffs ended Facebook’s Free Basics and similar arrangements, establishing that telecom operators cannot offer preferential pricing for specific platforms

• The ongoing US FCC debate over “net neutrality 2.0” continues to shape expectations around traffic management and potential platform prioritization

The “fair share” or network usage fee debate intensifies. Telecom providers argue that bandwidth-heavy platforms should contribute to network costs, noting that data traffic from major content providers consumes disproportionate infrastructure investment. The EU conducted consultations in 2022–2023, but no legislative change emerged by 2024. South Korea’s network usage fee debates continue, with local courts and regulators weighing competing claims.

Practical implications for platforms: commercial arrangements with telecom companies require competition-law awareness. Non-discrimination in traffic management applies to connectivity services offered by platforms themselves. Where platforms operate infrastructure-like functions, they may face telecom-style wholesale access or interconnection obligations.

Data, privacy, and cybersecurity duties crossing telco–platform boundaries

The convergence between telecom confidentiality rules and broader data protection regimes governing platforms accelerated dramatically following large-scale breaches and cross-border data controversies. Organizations operating telecommunications infrastructure or digital platforms now face overlapping—and sometimes conflicting—obligations from multiple regulatory frameworks.

The EU exemplifies this layering. Traditional ePrivacy rules established telecom-specific confidentiality requirements and lawful interception frameworks. GDPR added comprehensive data protection obligations. Under the EECC, OTT communications services classified as electronic communications services now face both regimes simultaneously, requiring data privacy impact assessments, consent management, and retention policies that satisfy telecom-origin and general privacy rules.

The NIS2 Directive, applicable from October 2024, significantly expands cybersecurity obligations. Operators of essential services—including major telecom networks and certain digital infrastructure providers—must meet strict security baselines, report incidents within 24 hours of detection, and manage supply chain risks systematically. Cloud providers, CDNs, and managed service providers fall within scope, creating direct cybersecurity obligations for entities that platforms depend on for edge computing and content delivery.

The UK Telecommunications (Security) Act 2021 and subsequent codes (updated through 2024) require operators to manage vendor risk and protect core networks against supply chain threats. Similar security concepts now appear in cloud and platform security expectations, as regulators recognize that telecommunications infrastructure and platform infrastructure share common vulnerabilities and interdependencies.

Regional developments in data security and privacy:

• India’s CERT-In 2022 rules mandate six-hour incident reporting, detailed logging requirements, and VPN/cloud provider registration, creating comprehensive visibility into network-connected services

• The US FCC’s 2023–2024 focus on data breach reporting for carriers parallels FTC enforcement actions against major platforms, creating dual regulatory exposure for organizations operating in both spaces

• The EU–US Data Privacy Framework (adopted 2023) provides transfer mechanisms post-Schrems II, but requires organizations to monitor ongoing adequacy decisions and implement supplementary measures for customer data flows

Cross-border data transfer oversight directly affects how multinational telecom networks and content delivery platforms structure global operations. Compliance requires:

• Logging and audit trails meeting jurisdiction-specific retention periods

• Incident reporting capabilities aligned with 24-hour or faster notification windows

• Vendor audit programs addressing supply chain resilience and third-party security

• Data localization awareness for markets imposing residency requirements on certain data categories

The practical task is data integration—bringing visibility to where customer information resides, how it flows, and what obligations attach at each stage. Organizations cannot manage compliance obligations they cannot see.

Telecom oversight of app distribution, billing, and identity functions

Regulators increasingly view app stores, mobile payment rails, and digital identity systems as “bottleneck” functions—chokepoints where gatekeeping power concentrates. Because these functions often depend on or interoperate with telecom infrastructure, traditional telecom authorities assert oversight alongside competition and financial regulators.

App distribution oversight is expanding:

• India’s TRAI has conducted consultations examining carrier billing arrangements and app store market power, with potential implications for how telecom operators partner with or compete against global app stores

• The EU DMA’s side-loading and alternative app store obligations require designated gatekeepers to permit installation of apps from sources other than their own stores on mobile devices

• National authorities oversee compliance on devices tied to carrier contracts, meaning telecom operators face scrutiny over device configurations they influence through subsidy arrangements

Carrier billing and payments attract multi-regulator attention. The EU’s PSD2 treats some telecom billing as regulated payment services, with PSD3 proposals clarifying scope. This means telecom companies operating mobile wallets or facilitating in-app purchases may need payment service licensing alongside their telecom authorizations.

In markets like Nigeria, Kenya, and Brazil (with PIX), central banks coordinate with telecom regulators where operators run mobile money services or super-apps integrating payments. The overlap between financial regulation and telecom licensing creates compliance complexity for connectivity providers expanding into financial services.

SIM registration and identity linkage policies directly impact platforms:

• Mandatory SIM registration and KYC requirements in Nigeria, South Africa, Mexico, and India create verified identity layers that platforms use for account security, OTP delivery, and fraud prevention

• Regulatory requirements for accurate SIM registration affect how platforms design onboarding flows, particularly in markets where prepaid mobile connectivity dominates

• Identity verification regulations increasingly reference telecom-origin data as authoritative sources for remote monitoring of user authenticity

Fraud and spam controls bridge telecom and platform oversight:

• The US STIR/SHAKEN deployment (mandatory from 2021) requires carriers to authenticate caller ID, reducing robocall spoofing—and creating compliance obligations for business messaging platforms working with A2P aggregators

• Australia mandates SMS sender ID registry participation from July 2026, requiring registration of alphanumeric sender IDs to combat international spoofing

• Spain’s 2025 rules similarly target fraudulent sender identification, with enforcement touching both telecom operators and messaging platforms

Practical guidance for platforms and telecom companies: design onboarding, KYC, and messaging flows anticipating that identity and fraud regulations will increasingly treat telecom-verified identity as foundational. Systems built assuming anonymous or pseudonymous access face mounting regulatory friction in markets adopting identity-linked oversight.

Emerging model laws and regional cooperation on platform oversight

Digital platforms operate globally while telecom and media laws remain stubbornly national. This mismatch drives increasing regional and international coordination, as regulators recognize that fragmented approaches create arbitrage opportunities and enforcement gaps.

The EU functions as a de facto regulatory exporter. DSA/DMA concepts influence laws across jurisdictions:

• The UK’s post-Brexit Online Safety Act and digital competition frameworks draw on EU models while tailoring requirements to UK market conditions

• Brazil’s ongoing platform legislation debates reference DSA transparency and accountability concepts

• South Korea’s platform governance builds on EU competition frameworks while addressing local market dynamics

• African Union member states reference EU data protection and cybersecurity models in developing national legislation

International bodies shape regulatory agendas:

• The International Telecommunication Union (ITU-T) maintains focus groups examining OTT services and digital platforms, producing reports that inform national regulatory strategies

• OECD recommendations on online platforms and artificial intelligence provide frameworks that telecom regulators incorporate into strategic planning

• These international workstreams don’t create binding law but establish conceptual foundations that appear in national rulemaking

Regional telecom bodies facilitate coordination:

• BEREC (Body of European Regulators for Electronic Communications) coordinates implementation guidance on net neutrality, OTT classification, and platform oversight across EU member states

• CITEL (Inter-American Telecommunication Commission) runs consultations on OTT services and cross-border content issues affecting Americas-region markets

• ATU (African Telecommunications Union) addresses roaming-like interoperability for messaging, spam control, and harmonized approaches to platform registration

Bilateral and plurilateral mechanisms expand:

• EU–US Trade and Technology Council digital working groups address platform governance, AI, and data flows

• eSafety regulators’ networks facilitate information-sharing on online harms enforcement

• Cross-border incident-sharing arrangements connect cybersecurity agencies dealing with emerging threats affecting both telecom operators and platforms

These cooperative structures influence national priorities by establishing common problem definitions, sharing enforcement experiences, and developing technical standards that shape how telecom environments evolve. Organizations operating across borders must monitor not only national law but also the regional coordination shaping future requirements.

Enforcement, penalties, and practical compliance playbook (2024–2027)

The “design phase” of major platform and telecom regulations is over. 2024–2027 represents the active supervision, audit, and penalty period—when theoretical obligations become enforcement actions and compliance failures translate into substantial fines and operational disruptions.

Penalty levels now match the stakes:

Regulation	Maximum Penalty	Key Trigger
EU DSA	6% of global turnover	Systemic failures on content, transparency
EU DMA	10% (20% for repeat offenses)	Gatekeeper obligation breaches
EU AI Act	7% of global turnover	High-risk AI misuse
UK Online Safety Act	£18m or 10% of qualifying turnover	Duty of care failures
NIS2 Directive	€10m or 2% of turnover	Cybersecurity failures

Early enforcement signals regulatory priorities:

• DSA investigations into VLOPs focus on child safety controls, disinformation during elections, and algorithmic transparency failures

• National regulators fine telecom companies for broadband transparency breaches and network quality misrepresentations

• UK ICO and Ofcom coordinate enforcement against platforms failing age verification or content moderation duties

• Australia’s eSafety Commissioner takes action against platforms slow to remove abhorrent violent material

A practical compliance blueprint for 2024–2027:

1. Group-wide governance structures — Establish board-level oversight of regulatory compliance spanning network operations, content policy, and data protection. Cross-functional teams bridging legal, technical, and policy functions are essential.

2. Unified risk registers — Maintain integrated risk documentation covering DSA systemic risks, NIS2 cybersecurity requirements, DMA gatekeeper obligations, and jurisdiction-specific content duties. Siloed risk management fails in converged regulatory environments.

3. Audit-ready documentation — Prepare for external audits mandated under DSA (for VLOPs), NIS2 (for essential service operators), and AI Act (for high-risk AI systems). Documentation must demonstrate not just policies but actual operational compliance.

4. Continuous monitoring systems — Implement real-time monitoring of algorithmic systems, content moderation effectiveness, and network management practices. Regulators increasingly expect demonstrable ongoing compliance, not point-in-time assessments.

5. Cross-border coordination protocols — Establish procedures for multi-jurisdictional incident response, regulatory notification, and enforcement cooperation. Incidents affecting customer experience rarely respect national borders.

Key compliance timeline:

• 2024–2025: Full DSA and DMA enforcement ramp-up; NIS2 audits begin; Online Safety Act codes progressively implemented

• 2025–2026: AI Act high-risk system requirements phase in; first major penalty decisions establish enforcement precedents

• 2026–2027: Mature enforcement environment; secondary legislation and regulatory guidance refine initial rules

Organizations treating compliance as a one-time project rather than an ongoing operational function will struggle. The integration of telecom oversight and platform regulation means that network capabilities, content systems, and data practices face simultaneous scrutiny from multiple regulators applying overlapping frameworks.

Conclusion: towards a unified oversight model for networks and platforms

Telecom oversight and platform regulation are converging into a single, layered governance model covering connectivity services, data handling, and content moderation. The traditional separation between “dumb pipes” and “smart services” no longer reflects how regulators understand digital ecosystem risks—or how they intend to manage them.

The 2024–2027 period will define the long-term pattern of obligations. Enforcement decisions, judicial interpretations, and secondary guidance produced now will shape compliance requirements for the next decade. Organizations that wait for regulatory certainty before acting will find themselves perpetually behind.

Strategic choices for industry players:

• Engage proactively with regulators — Participate in consultations, provide implementation feedback, and build relationships before enforcement becomes adversarial

• Invest in compliance technology — Automated monitoring, audit management, and incident response systems pay dividends across multiple overlapping regulatory frameworks

• Build cross-border policy teams — Regulatory affairs functions must span jurisdictions, understanding not just local law but regional coordination and international developments

• Design new business models with regulation built in — Revenue streams dependent on practices that conflict with emerging rules face existential risk; cost efficiency requires compliance by design

Anticipated future debates will extend these trends further. 6G development will embed new regulatory concepts around sensing, artificial intelligence integration, and sustainability requirements. Network usage fee discussions will continue reshaping commercial relationships between telecom providers and content providers. AI-powered content curation and autonomous networks will test existing frameworks and likely prompt additional rulemaking.

The convergence of telecom oversight and platform regulation isn’t a temporary phenomenon to be waited out. It reflects fundamental recognition that digital transformation has fused infrastructure, content, and data into an integrated system requiring integrated governance. Organizations operating at this intersection—whether they began as telecom companies or digital platforms—must treat regulatory engagement as a core business function, not a compliance afterthought.

Monitoring global trends in telecom oversight of online platforms is now essential strategic work for executives across the digital economy.