Article 5 sets the self-executing obligations applying from the 6-month post-designation date (default 6 March 2024 for the first cohort): (1) no processing of personal data for cross-CPS advertising without specific GDPR-compliant consent; (2) allow business users to offer the same products / services at different prices and conditions through third-party online intermediation services (no MFN clauses); (3) allow business users to communicate and conclude contracts with end users acquired through the CPS, regardless of whether they use the gatekeeper's CPS for the contract; (4) allow end users to access content acquired through their business-user relationship outside the gatekeeper's CPS; (5) no restrictions on business users / end users raising issues of non-compliance with authorities; (6) no requirement to use the gatekeeper's identification, browser, payment services to use the CPS; (7) no requirement to subscribe to other CPS as a condition of using one; (8) advertisers and publishers receive on request, free of charge, transparency information on the price they paid / remuneration they received and the prices of ad impressions delivered.
This control maps to 3 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.