Article 5 sets the self-executing obligations applying from the 6-month post-designation date (default 6 March 2024 for the first cohort): (1) no processing of personal data for cross-CPS advertising without specific GDPR-compliant consent; (2) allow business users to offer the same products / services at different prices and conditions through third-party online intermediation services (no MFN clauses); (3) allow business users to communicate and conclude contracts with end users acquired through the CPS, regardless of whether they use the gatekeeper's CPS for the contract; (4) allow end users to access content acquired through their business-user relationship outside the gatekeeper's CPS; (5) no restrictions on business users / end users raising issues of non-compliance with authorities; (6) no requirement to use the gatekeeper's identification, browser, payment services to use the CPS; (7) no requirement to subscribe to other CPS as a condition of using one; (8) advertisers and publishers receive on request, free of charge, transparency information on the price they paid / remuneration they received and the prices of ad impressions delivered.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.