The AliExpress DSA fine and the UK marketplace gap
In short: The AliExpress DSA EU fine of €550 million, imposed on 20 July 2026, is the first penalty for breaching the systemic-risk duties in Articles 34 and 35 of the EU Digital Services Act. UK law applies to the same listings through Ofcom, the CMA and existing product safety enforcement, though none of those imposes the advance systemic risk-assessment duty AliExpress was fined for breaching.
A marketplace that carries third-party listings must decide how much moderation is enough and be able to justify that decision. The AliExpress DSA fine of €550 million, imposed by the European Commission on 20 July 2026, is the first time a platform has been penalised for getting that wrong: AliExpress had not properly assessed the risk of illegal, unsafe and counterfeit products on its service, nor taken effective steps to reduce it. It is the first Digital Services Act penalty for a failure of risk management rather than of transparency. UK law applies to the same listings, but by a different route, and the route depends on how each listing is characterised.
Key findings (European Commission, 20 July 2026)
- The Commission imposed a fine of €550 million, the largest under the Digital Services Act to date. Source: European Commission press release IP/26/1654.
- The infringements were a failure to assess systemic risk and a failure to mitigate it, the duties in Articles 34 and 35 of Regulation (EU) 2022/2065. Source: IP/26/1654.
- Proceedings opened on 14 March 2024. On 18 June 2025 the Commission made a set of AliExpress commitments binding under Article 71, and issued preliminary findings the same day on the two grievances the commitments did not resolve. Source: IP/26/1654.
- The infringement ran at least until June 2025. The Commission treated the novelty of the Digital Services Act as a mitigating factor. Source: IP/26/1654.
- AliExpress has until 20 October 2026 to submit an action plan under Article 75, after which the European Board for Digital Services has one month to give an opinion and the Commission a further month to adopt its final decision. Source: IP/26/1654.
- The comparator is the €120 million fine imposed on X on 5 December 2025, the first non-compliance decision under the regulation, which concerned transparency and interface design rather than systemic risk. Source: European Commission press release IP/25/2934.
| What the Commission decided | Position | Provision |
|---|---|---|
| Fine imposed | €550 million, 20 July 2026 | Article 74 |
| Duties breached | Risk assessment and risk mitigation | Articles 34 and 35 |
| Grievances settled without a finding | Commitments made binding, 18 June 2025 | Article 71 |
| Formal finding of infringement | Non-compliance decision, 20 July 2026 | Article 73 |
| Remedy process | Action plan by 20 October 2026, then Board opinion | Article 75 |
| Exposure if the plan fails | Periodic penalty payments | Article 76 |
What behaviour led to the AliExpress DSA fine
The Commission’s finding is about how AliExpress reasoned about the counterfeits on its platform, not about their presence. Article 34 of the Digital Services Act requires a very large online platform to assess systemic risk, and Article 35 to take reasonable, proportionate and effective measures against the risks it identifies. Both are in Section 5 of Chapter III, which is why the Article 75 action-plan procedure applies here and not to an ordinary decision.
AliExpress did not evaluate whether it had enough staff to review potentially illegal products, so it never confronted the gap between the number of moderators and their workload. It did not adequately assess how its own recommender and advertising systems spread illegal products, and the Commission’s testing found such products recommended and advertised before removal. Its risk assessment relied on a single quantitative indicator, which did not measure whether illegal products reappeared in similar form. An Article 34 assessment therefore has to record moderator capacity against workload, the effect of the platform’s own recommender and advertising systems, and whether removed products return.
Detection failed too, and listings that were detected stayed up for weeks. The penalty policy for offending traders was not enforced, so penalised stores kept trading. Compliance checks were evaded by mis-categorising products to attract lighter requirements. The mandatory brand-authorisation system meant to stop counterfeit sales was understaffed and easily bypassed. The standard the Commission applied is whether the platform measured its controls against the volume of listings it carries.
How UK law handles the same listings
The same listing can be more than one kind of legal wrong in the UK, and each wrong has its own regulator. Which regime applies depends on what is actually wrong with the listing. There are three cases.
Counterfeits: Passing off a fake as the real thing deceives the buyer, and that is fraud. The Online Safety Act 2023 makes fraud one of its priority offences, so a marketplace has to assess the risk of fraudulent listings and take steps against them, and Ofcom is the regulator. The provisions are paragraph 33(a) of Schedule 7, which lists fraud, and the duties in sections 9 and 10.
Misleading listings: A listing that misleads without being an outright fraud, such as a product dressed up as something it is not, or a lookalike built to pass for a well-known brand. Consumer protection law bans both, whether or not a buyer actually loses money, and the CMA can act on its own without going to court. The bans are paragraphs 10 and 15 of Schedule 20 to the Digital Markets, Competition and Consumers Act 2024. Parliament put these with the CMA rather than Ofcom on purpose, by an amendment that took effect on 6 April 2025.
Dangerous goods: Product safety law requires consumer goods to be safe and places positive duties to that end on the people who make and move them. A manufacturer, an own-brand seller, and, where the manufacturer is based abroad, the UK importer, must place only safe products on the market, give buyers the information they need, and act if a product turns out to be dangerous, by warning, withdrawal or recall (regulations 5 and 7 of the General Product Safety Regulations 2005). A distributor, which includes most retailers, must not supply goods it knows or should treat as dangerous, must help trace them, and must cooperate in a withdrawal or recall (regulation 8). Trading standards and OPSS enforce these duties and can order a specific dangerous listing to be taken down (regulation 14). The Online Safety Act does not address this, because it covers fraud but not product safety (section 59(6)), so Ofcom has no role here.
On AliExpress those duties fell on the third-party sellers, as the producers, importers or distributors of the goods, and the sellers ignored them. The live question is whether the marketplace owes anything of its own on top. Under statute it does only if it steps into one of those roles, by importing, owning, fulfilling or own-branding the goods. A marketplace that merely hosts other sellers’ listings is not automatically caught, and the power in section 2 of the Product Regulation and Metrology Act 2025 to place duties on marketplaces has not been used.
Whether the common law fills the gap with a duty of care owed by the platform to consumers is arguable but untested. A claimant could point to the platform’s control of the listings, its handling of payment and fulfilment, and any safety promises in its own terms; but English law is slow to make one party liable for another’s wrongdoing, and no reported UK decision has yet imposed such a duty on a marketplace for third-party goods. And even if the duty exists, there is no regulator to enforce a common law duty of care. A duty of care is enforced by an injured consumer suing for damages after the harm, not by a regulator requiring the platform to run safe systems before any harm occurs. That regulator-enforced, up-front, whole-platform duty is what the EU imposed under Articles 34 and 35, and what it fined AliExpress for lacking. The government has said it will create one here too: the Department for Business and Trade consulted on marketplace duties under the 2025 Act between 31 March and 23 June 2026, but has not yet published its response.
| How the listing is characterised | Which UK regime applies | Who acts | What the platform owes |
|---|---|---|---|
| Counterfeit sold as genuine | Online Safety Act 2023, priority illegal content via Schedule 7 paragraph 33(a) | Ofcom | Illegal content risk assessment and safety duties, sections 9 and 10 |
| Product misleadingly presented, or one that cannot lawfully be sold | DMCC Act 2024, Schedule 20 paragraphs 10 and 15 | CMA | Direct enforcement under Part 3 Chapter 4, no detriment test |
| Reviews on the listing are fake or misleadingly published | DMCC Act 2024, Schedule 20 paragraph 13(3) | CMA | Reasonable and proportionate steps to prevent and remove |
| Goods unsafe: the goods themselves | General Product Safety Regulations 2005, regulations 5, 7 and 8, plus sector-specific rules; outside the Online Safety Act by section 59(6)(a)(ii) | OPSS and Trading Standards | Manufacturer, importer and distributor must ensure goods are safe; a marketplace is bound if it acts as one of those roles; enforcers can order a listing down under regulation 14 |
| Goods unsafe: systemic platform duty | PRM Act 2025 section 2 powers unexercised; no equivalent in force | None | No duty on the platform to assess and prevent dangerous listings in advance |
| Any of the above, EU-facing | Digital Services Act, Articles 34 and 35 | European Commission | One systemic risk assessment and proportionate mitigation |
What the AliExpress DSA fine means for UK-facing marketplaces
A UK-facing marketplace must identify, for each kind of problem listing, which regulator has jurisdiction and on what test. The moderation shortfall that cost AliExpress €550 million in Brussels would, in London, raise an Ofcom question about fraud, a CMA question about misleading presentation, and, for the unsafe goods, product safety duties on whoever makes, imports or sells them and a power to remove the individual listing, but no systemic duty on the platform to have prevented it. The Digital Services Act sets a single obligation on the platform as a whole: assess and mitigate the systemic risk, whatever the character of the individual listing. A marketplace in both markets therefore carries one systemic assessment for the Commission and three separate sets of rules in the UK. The other EU digital instruments divide the same way, as the gatekeeper obligations in the DMA specification decisions on Google show.
What the Commission penalised was an absence of measurement: AliExpress had not weighed moderator numbers against workload, had not assessed its own amplification, and kept no metric showing whether removed products returned. Those are the records Ofcom would look for on a section 9 risk assessment, and the CMA on the reasonable-steps limb of Schedule 20 paragraph 13(3). Evidence built around the adequacy of the controls answers both the UK and the EU questions; evidence built around the type of listing has to be reassembled for each regulator. Our platform terms and policies page sets out the usual scope for reviewing seller terms, enforcement policies and takedown records, and the digital regulation page covers the wider divergence.
Viewpoint
The AliExpress DSA fine is a decision about documentation, not about counterfeits. The Commission’s own testing established that the controls failed; the penalty attaches to AliExpress never having asked whether they could work. That is a lower threshold than proving harm, and it is the part that carries across to Ofcom under section 9 without any change in the law.
The UK division of labour is defensible, with one real gap. Parliament’s choice to send fraud to Ofcom and misleading practices to the CMA is coherent, and product safety law already places positive duties on whoever makes, imports or sells the goods. On AliExpress the third-party sellers owed those duties and ignored them. The gap is not the goods; it is the platform. No UK regulator can require a marketplace to assess and mitigate, in advance, the risk that dangerous products appear at all. A common-law duty of care might one day be recognised, but it would be enforced by an injured buyer after the event, not by a regulator before it. Section 2 of the Product Regulation and Metrology Act 2025 has held the power to close it since 21 July 2025, and the first use of that power needs an affirmative instrument under section 13(4), so it will be visible before it takes effect. I would watch how the Department for Business and Trade responds to its June 2026 consultation, and in particular whether it drafts a systemic duty of the Article 35 kind or a list of specific obligations.
Frequently asked questions
What was the AliExpress DSA fine for?
The European Commission fined AliExpress €550 million on 20 July 2026 for breaching its obligations to assess and mitigate the systemic risk of illegal, unsafe and counterfeit products, the duties in Articles 34 and 35 of Regulation (EU) 2022/2065. The findings concerned the adequacy of the platform’s risk assessment and the effectiveness of its detection, trader-penalty and brand-authorisation controls.
Could Ofcom bring the same case in the UK?
Partly. Where a counterfeit is sold as genuine, the listing is capable of amounting to fraud by false representation under section 2 of the Fraud Act 2006, which is a priority offence under Schedule 7 paragraph 33(a) of the Online Safety Act 2023, so the section 9 and section 10 duties apply. Where the objection is that goods are unsafe, section 59(6)(a)(ii) excludes offences concerning the safety or quality of goods and Ofcom holds no power; the lever there is product safety law, under which OPSS or Trading Standards can require the specific listing to be withdrawn, rather than a systemic duty on the platform.
Does the Online Safety Act apply to online marketplaces at all?
Yes. Schedule 1 to the Online Safety Act 2023 contains no exemption for marketplaces, and the limited-functionality exemption covers comments, reviews and ratings on a provider’s own content rather than third-party listings. A listing uploaded by a seller and encountered by other users is regulated user-generated content, so a marketplace is a regulated user-to-user service.
Do UK marketplaces owe any product safety duty now?
It depends on what the marketplace does. Product safety law places positive safety duties on producers, importers and distributors under regulations 5, 7 and 8 of the General Product Safety Regulations 2005, and a marketplace owes them if it acts as one of those, for example by importing, owning, fulfilling or own-branding the goods. On AliExpress those duties fell on the third-party sellers. A marketplace that only hosts third-party listings is not automatically caught; whether it owes a common-law duty of care is arguable but untested, and no UK regulator can require it to prevent dangerous listings in advance. Regulators can still order a specific dangerous listing to be taken down under regulation 14, and sections 2(2)(e) and 2(3)(e) of the Product Regulation and Metrology Act 2025 could add marketplace duties, though the consultation that closed on 23 June 2026 has not yet produced regulations.
What happens to AliExpress next?
Under Article 75 of the Digital Services Act, AliExpress must submit an action plan to the Commission by 20 October 2026 setting out measures sufficient to remedy the infringement. The European Board for Digital Services then has one month to give an opinion, and the Commission a further month to adopt a final decision and set an implementation period. Failure to comply may attract periodic penalty payments under Article 76.
If you operate a marketplace with UK or EU users and are assessing how these duties apply to your seller controls and takedown records, contact Rob Bratby at Bratby Law.
