Ad Tech Compliance
DSA advertising transparency: Article 26 labels, profiling bans and Article 39 ad repositories
Published · Last updated
Next scheduled review:
DSA advertising transparency rests on three articles. Article 26 makes online platforms label each ad and show who paid and why the user sees it. Articles 26(3) and 28(2) ban ads based on profiling with sensitive data, or of known minors. Article 39 makes very large platforms publish searchable ad repositories (Regulation (EU) 2022/2065).
The Digital Services Act (DSA) binds platforms, not the ad tech companies behind them. In practice the data a platform must show comes from advertisers, agencies, DSPs and SSPs. This page sets out the law, then what the Commission and the courts have done with it, then what it means for the bidstream.
Contents
Key facts
- In force for everyone since 17 February 2024. Very large platforms were bound earlier, four months after their designation (DSA, Articles 92 and 93). The first designations date from 25 April 2023 (Commission, list of VLOPs and VLOSEs).
- The first ad-related fine. The Commission fined X €120 million on 5 December 2025, for its ad repository among three breaches (Commission, 5 December 2025).
- Commitments instead of a fine. TikTok committed on 5 December 2025 to publish full ad content within 24 hours, with targeting criteria and reach data (Commission, 5 December 2025).
- The repository duty survived a court challenge. The General Court dismissed Amazon's action against its designation on 19 November 2025 (BEUC, 19 November 2025).
- Guidance on minors since July 2025. The Commission published guidelines under Article 28 on 14 July 2025 (Commission, 14 July 2025; OJ C/2025/5519).
- Fines up to 6%. The Commission can fine very large platforms up to 6% of worldwide turnover (Article 74); national caps are also set at 6% (Article 52(3)).
Definition
An advertisement, under DSA Article 3(r), is "information designed to promote the message of a legal or natural person" that an online platform presents on its interface "against remuneration specifically for promoting that information" (Regulation (EU) 2022/2065).
Two parts of that definition (Article 3(r)) matter in practice. It covers political and cause messages as well as commercial ones. And it applies only where a platform presents the ad on its own interface for payment, which is why a publisher's website outside a platform sits outside Article 26.
Who the DSA advertising rules apply to
The law. The ad duties attach to service types defined in the regulation. Article 26 and Article 28 sit in the section for online platforms, which does not apply to micro and small enterprises unless they are designated as very large (Article 19). Article 39 applies to very large online platforms (VLOPs) and very large online search engines (VLOSEs), meaning services with at least 45 million average monthly active recipients in the EU (Article 33(1)).
4 of 4 rows
Online platforms (not micro or small) | Label each ad; show advertiser, payer and main targeting parameters; no special-category profiling ads; no profiling ads to known minors | 26, 28 | National Digital Services Coordinator (Article 52) |
VLOPs and VLOSEs | All of the above, plus a public ad repository and risk assessment of ad systems | 26, 28, 34(2)(d), 35(1)(e), 39 | European Commission (Article 74) |
Ad tech intermediaries (DSPs, SSPs, ad servers) | No direct duty under Articles 26 or 39; named in voluntary codes | 46 | Not applicable |
Websites that are not platforms | No Article 26 duty | n/a | n/a |
Online platforms (not micro or small)
- Ad duties
Label each ad; show advertiser, payer and main targeting parameters; no special-category profiling ads; no profiling ads to known minors
- Articles
26, 28
- Who enforces
National Digital Services Coordinator (Article 52)
VLOPs and VLOSEs
- Ad duties
All of the above, plus a public ad repository and risk assessment of ad systems
- Articles
26, 28, 34(2)(d), 35(1)(e), 39
- Who enforces
European Commission (Article 74)
Ad tech intermediaries (DSPs, SSPs, ad servers)
- Ad duties
No direct duty under Articles 26 or 39; named in voluntary codes
- Articles
46
- Who enforces
Not applicable
Websites that are not platforms
- Ad duties
No Article 26 duty
- Articles
n/a
- Who enforces
n/a
Table by AdSovereign, CC BY 4.0.
Several retail marketplaces are designated VLOPs, so their sponsored listings sit inside this regime. They include Amazon Store with 181.3 million average monthly users, Shein with 108 million and Temu with 75 million, alongside Zalando, AliExpress and Google Shopping (Commission, list of VLOPs). Our guide to marketplace retail media covers how those networks sell ads.
Codes of conduct. Article 46 asks the Commission to encourage voluntary codes for "providers of online advertising intermediary services" and other actors in "the programmatic advertising value chain". The codes should cover passing Article 26 data to platforms, feeding Article 39 repositories, and data monetisation. The target dates were 18 February 2025 for drafting and 18 August 2025 for application (Article 46).
Article 26: what every ad label must show
The law. For each ad shown to each user, the platform must let that user identify "in a clear, concise and unambiguous manner and in real time" four things (Article 26(1)):
- that the content is an advertisement, including through prominent markings;
- the person on whose behalf the ad is presented;
- the person who paid for it, if different;
- "meaningful information" about the main parameters used to choose the recipient and, where applicable, how to change them.
Platforms must also give users a way to declare that their own content contains commercial communications, such as an influencer's paid post, and then label it for everyone else (Article 26(2)). Recital 68 asks for markings that are salient, "including through standardised visual or audio marks".
What the Commission did. The Commission opened proceedings against Meta on 30 April 2024 over "deceptive advertising and political content" on Facebook and Instagram (Commission, IP/24/2373). We found no Commission decision that applies Article 26(1) alone by 9 November 2026.
What the industry built. IAB Tech Lab publishes a DSA Transparency extension for OpenRTB, last updated on 26 January 2024. It lets an SSP signal whether DSA data is required, and lets a DSP return the advertiser, the payer and the targeting parameters with each bid (IAB Tech Lab, DSA Transparency extension). The example below follows that specification. The field values are illustrative.
{
"id": "req-7f3a",
"regs": {
"ext": {
"dsa": {
"dsarequired": 3,
"pubrender": 0,
"datatopub": 2,
"transparency": [
{ "domain": "platform.example", "dsaparams": [1] }
]
}
}
},
"seatbid": [
{
"bid": [
{
"id": "1",
"adomain": ["brand.example"],
"ext": {
"dsa": {
"behalf": "Example Brand SA",
"paid": "Example Agency Ltd",
"transparency": [
{ "domain": "dsp.example", "dsaparams": [1, 2] }
],
"adrender": 0
}
}
}
]
}
]
}How the fields line up with the law, as we read them:
6 of 6 rows
| DSA object required; the publisher is an online platform | Article 26 applies to the seller |
| Who draws the transparency icon: publisher or advertiser | Article 26(1) "in real time" display |
| Name of whose behalf the ad is shown (max 100 characters) | Article 26(1)(b); Article 39(2)(b) |
| Who paid, always sent even if the same | Article 26(1)(c); Article 39(2)(c) |
| Codes 1 profiling, 2 basic advertising, 3 precise geolocation | Article 26(1)(d) main parameters |
| Send the data to the publisher for audit | Article 39 repository records |
dsarequired = 3
- Meaning in the specification
DSA object required; the publisher is an online platform
- DSA hook
Article 26 applies to the seller
pubrender = 0, adrender
- Meaning in the specification
Who draws the transparency icon: publisher or advertiser
- DSA hook
Article 26(1) "in real time" display
behalf
- Meaning in the specification
Name of whose behalf the ad is shown (max 100 characters)
- DSA hook
Article 26(1)(b); Article 39(2)(b)
paid
- Meaning in the specification
Who paid, always sent even if the same
- DSA hook
Article 26(1)(c); Article 39(2)(c)
transparency.dsaparams
- Meaning in the specification
Codes 1 profiling, 2 basic advertising, 3 precise geolocation
- DSA hook
Article 26(1)(d) main parameters
datatopub = 2
- Meaning in the specification
Send the data to the publisher for audit
- DSA hook
Article 39 repository records
Table by AdSovereign, CC BY 4.0.
The request and response are merged into one object above to keep the example short; in OpenRTB they are separate messages. Our guide to OpenRTB 2.6 explains where regs and seatbid sit.
Article 26(3) and Article 28(2): the two profiling bans
The law on sensitive data. Platforms "shall not present advertisements to recipients of the service based on profiling" that uses special categories of personal data under GDPR Article 9(1) (Article 26(3)). Recital 69 extends this to "profiling categories based on those special categories", so an interest segment that stands in for religion or health is caught.
The law on minors. Platforms may not present ads based on profiling with the user's personal data "when they are aware with reasonable certainty" that the user is a minor (Article 28(2)). The same article says platforms are not obliged to process extra personal data to work out whether a user is a minor (Article 28(3)).
What the Commission did on sensitive data. On 14 March 2024 the Commission asked LinkedIn how it complied with Article 26(3), after a civil-society complaint (Commission, 14 March 2024). On 7 June 2024 the Commission noted that LinkedIn had disabled ad targeting by LinkedIn Group membership in the EU. The complaint argued that group membership could reveal ethnic origin, political opinions or trade union membership (Commission, 7 June 2024).
What the Commission said on minors. The July 2025 guidelines restate Article 28(2). They then list measures for commercial practices, such as protecting minors from "harmful, unethical and unlawful advertising" and from excessive volumes of commercial content (OJ C/2025/5519, paras 68 to 69). The guidelines apply to platforms accessible to minors, except micro and small enterprises (Commission, 14 July 2025).
Pending. On 17 September 2026 the Commission proposed the EU KIDS Act, COM(2026) 681, procedure 2026/0286(COD). Its provision on data protection in age assurance says age assurance solutions shall not "locate, track, target, advertise to or profile recipients for any purpose" (COM(2026) 681). It is a proposal; we read the text on EUR-Lex on 9 November 2026 and did not track later procedural steps.
Article 39: what a DSA ad repository must contain
The law. VLOPs and VLOSEs must publish a searchable repository, with multi-criteria queries and APIs, covering every ad for as long as it runs and for one year after it last appeared. The repository must not contain personal data of the users who saw the ad (Article 39(1)).
7 of 7 rows
(a) Content | Content of the ad, including the product, service or brand and its subject matter |
(b) On whose behalf | The person on whose behalf it is presented |
(c) Payer | The person who paid, if different |
(d) Period | When it was presented |
(e) Targeting | Whether it targeted particular groups and the main parameters, including exclusions |
(f) Commercial communications | Content users declared as commercial under Article 26(2) |
(g) Reach | Total recipients reached and, where applicable, numbers per member state for targeted groups |
(a) Content
- What Article 39(2) requires
Content of the ad, including the product, service or brand and its subject matter
(b) On whose behalf
- What Article 39(2) requires
The person on whose behalf it is presented
(c) Payer
- What Article 39(2) requires
The person who paid, if different
(d) Period
- What Article 39(2) requires
When it was presented
(e) Targeting
- What Article 39(2) requires
Whether it targeted particular groups and the main parameters, including exclusions
(f) Commercial communications
- What Article 39(2) requires
Content users declared as commercial under Article 26(2)
(g) Reach
- What Article 39(2) requires
Total recipients reached and, where applicable, numbers per member state for targeted groups
Table by AdSovereign, CC BY 4.0.
Where a platform removes an ad as illegal or against its terms, fields (a) to (c) are replaced by the information from its statement of reasons (Article 39(3)). The Commission may issue guidelines on the structure of repositories after consulting the Board, researchers and the public. Very large platforms must also assess how "systems for selecting and presenting advertisements" affect systemic risks (Article 34(2)(d)).
Commission enforcement on DSA ad rules: timeline
Each row is a Commission or court act. "Preliminary findings" and "proceedings" are steps, not findings of breach.
13 of 13 rows
27 Sep 2023 | Amazon Store | General Court President suspends the repository duty as an interim measure | |
14 Mar 2024 | Request for information on ads based on sensitive data | ||
27 Mar 2024 | Amazon Store | Court of Justice Vice-President sets the suspension aside; the duty applies | |
30 Apr 2024 | Meta | Proceedings opened, including deceptive ads and political content | |
7 Jun 2024 | Commission notes group-based ad targeting disabled in the EU | ||
12 Jul 2024 | X | Preliminary findings on Articles 25, 39 and 40(12) | |
15 May 2025 | TikTok | Preliminary findings: repository lacks content, targeting and payer data | |
18 Jun 2025 | AliExpress | Commitments made binding, including advertising transparency | |
19 Nov 2025 | Amazon Store | General Court dismisses Amazon's action against its designation | |
5 Dec 2025 | X | €120 million fine: blue checkmark, ad repository, researcher access | |
5 Dec 2025 | TikTok | Ad repository commitments accepted | |
16 Jul 2026 | X | Action plan accepted: better repository search, faster responses, API access | |
20 Jul 2026 | AliExpress | €550 million fine for risk assessment failures, including how ad systems spread illegal products |
27 Sep 2023
- Who
Amazon Store
- Act
General Court President suspends the repository duty as an interim measure
- Source
14 Mar 2024
- Who
LinkedIn
- Act
Request for information on ads based on sensitive data
- Source
27 Mar 2024
- Who
Amazon Store
- Act
Court of Justice Vice-President sets the suspension aside; the duty applies
- Source
30 Apr 2024
- Who
Meta
- Act
Proceedings opened, including deceptive ads and political content
- Source
7 Jun 2024
- Who
LinkedIn
- Act
Commission notes group-based ad targeting disabled in the EU
- Source
12 Jul 2024
- Who
X
- Act
Preliminary findings on Articles 25, 39 and 40(12)
- Source
15 May 2025
- Who
TikTok
- Act
Preliminary findings: repository lacks content, targeting and payer data
- Source
18 Jun 2025
- Who
AliExpress
- Act
Commitments made binding, including advertising transparency
- Source
19 Nov 2025
- Who
Amazon Store
- Act
General Court dismisses Amazon's action against its designation
- Source
5 Dec 2025
- Who
X
- Act
€120 million fine: blue checkmark, ad repository, researcher access
- Source
5 Dec 2025
- Who
TikTok
- Act
Ad repository commitments accepted
- Source
16 Jul 2026
- Who
X
- Act
Action plan accepted: better repository search, faster responses, API access
- Source
20 Jul 2026
- Who
AliExpress
- Act
€550 million fine for risk assessment failures, including how ad systems spread illegal products
- Source
Table by AdSovereign, CC BY 4.0.
What the X decision says about repositories. The Commission found that X's repository lacked "the content and topic of the advertisement, as well as the legal entity paying for it". It also found that design features and "excessive delays in processing" undermined the tool (Commission, 5 December 2025). Under the July 2026 action plan, X has six months to implement changes and must then submit an external audit. The Board for Digital Services had called the plan's audit measures insufficient (Commission, 16 July 2026).
What the Amazon case says. At the interim stage, the Court of Justice Vice-President found Amazon's fundamental-rights argument against the repository not "lacking in seriousness", yet refused suspension after balancing the interests (CJEU press release 60/24, 27 March 2024). On the merits, BEUC reports that the General Court accepted that the DSA may interfere with Amazon's rights but found the interference justified (BEUC, 19 November 2025). We did not read the judgment itself, and appeal status is n/d.
What DSA advertising transparency means for ad tech
This section is our analysis. The DSA puts the duty on the platform, and the platform can only meet it with data it receives from the buy side.
5 of 5 rows
Advertiser or agency | Legal names for "on whose behalf" and "who paid" | Article 26(1)(b) and (c); Article 39(2)(b) and (c) |
DSP | Main targeting parameters, including exclusions; reach by member state | Article 26(1)(d); Article 39(2)(e) and (g) |
SSP or exchange | Flags telling buyers that DSA data is required on this inventory | Platform must display data in real time |
Data and segment providers | Segment taxonomies with no sensitive-data proxies when used on platforms | Article 26(3); recital 69 |
Retail media on a VLOP marketplace | Repository entries for paid placements that meet the Article 3(r) definition | Article 39 |
Advertiser or agency
- What the platform will need from it
Legal names for "on whose behalf" and "who paid"
- Why
Article 26(1)(b) and (c); Article 39(2)(b) and (c)
DSP
- What the platform will need from it
Main targeting parameters, including exclusions; reach by member state
- Why
Article 26(1)(d); Article 39(2)(e) and (g)
SSP or exchange
- What the platform will need from it
Flags telling buyers that DSA data is required on this inventory
- Why
Platform must display data in real time
Data and segment providers
- What the platform will need from it
Segment taxonomies with no sensitive-data proxies when used on platforms
- Why
Article 26(3); recital 69
Retail media on a VLOP marketplace
- What the platform will need from it
Repository entries for paid placements that meet the Article 3(r) definition
- Why
Article 39
Table by AdSovereign, CC BY 4.0.
Three points shape implementation. First, the special-category ban is narrower than the GDPR. It covers ads on platforms, while GDPR Article 9 governs the processing everywhere; our guide to GDPR, ePrivacy and RTB consent signals covers that side, and the CNIL cookie rules cover device access in France. Second, Article 28(3) means a platform is not obliged to collect more data to guess age, but the guidelines expect age assurance in some cases. Third, AI-generated ads raise separate labelling duties under the AI Act, covered in EU AI Act and advertising.
Reports on the DSA itself are due in 2027 under Article 91; our ad tech regulation calendar tracks those dates. Related frameworks sit in our ad tech compliance hub.
FAQ
What does DSA advertising transparency require?
Does the DSA ban targeted advertising?
What is a DSA ad repository?
Does the DSA apply to DSPs and SSPs?
Why did the Commission fine X under the DSA?
How this works on owned infrastructure
The DSA asks a platform to answer, for every ad, who it ran for, who paid and which parameters chose the viewer, and to keep that answer for a year after the ad stops. Those facts are scattered across an advertiser's contract, a DSP's targeting setup and an SSP's logs. AdSovereign is an enterprise, on-premise RTB stack (DSP, SSP, exchange and clean room) designed to keep the bid, the DSA fields that came with it and the delivery record together in the operator's own log store, so a repository feed can be built from one source. It does not decide whether a placement is an advertisement under Article 3(r). The architecture page shows the log flow, and the integrations page lists the OpenRTB extensions supported.
Sources
- Regulation (EU) 2022/2065 (Digital Services Act), OJ L 277, 27 October 2022: Articles 3, 19, 26, 28, 33, 34, 35, 39, 46, 52, 74, 92, 93; recitals 68, 69, 71. EUR-Lex. https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng
- European Commission, Supervision of the designated very large online platforms and search engines under DSA (list and enforcement actions, checked 9 November 2026). https://digital-strategy.ec.europa.eu/en/policies/list-designated-vlops-and-vloses
- European Commission, "Commission fines X €120 million under the Digital Services Act" (5 December 2025). https://digital-strategy.ec.europa.eu/en/news/commission-fines-x-eu120-million-under-digital-services-act
- European Commission, "Commission sends preliminary findings to X for breach of the Digital Services Act" (12 July 2024). https://digital-strategy.ec.europa.eu/en/news/commission-sends-preliminary-findings-x-breach-digital-services-act
- European Commission, "Commission accepts X's action plan to comply with the Digital Services Act" (16 July 2026). https://digital-strategy.ec.europa.eu/en/news/commission-accepts-xs-action-plan-comply-digital-services-act
- European Commission, "Commission preliminarily finds TikTok's ad repository in breach of the Digital Services Act" (15 May 2025). https://digital-strategy.ec.europa.eu/en/news/commission-preliminarily-finds-tiktoks-ad-repository-breach-digital-services-act
- European Commission, "Commission accepts TikTok's commitments on advertising transparency under the Digital Services Act" (5 December 2025). https://digital-strategy.ec.europa.eu/en/news/commission-accepts-tiktoks-commitments-advertising-transparency-under-digital-services-act
- European Commission, "Commission accepts commitments offered by AliExpress under the Digital Services Act and takes further action on illegal products" (18 June 2025). https://digital-strategy.ec.europa.eu/en/news/commission-accepts-commitments-offered-aliexpress-under-digital-services-act-and-takes-further
- European Commission, "Commission fines AliExpress €550 million for breaching the Digital Services Act", IP/26/1654 (20 July 2026). https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1654
- European Commission, "Commission opens formal proceedings against Facebook and Instagram under the Digital Services Act", IP/24/2373 (30 April 2024). https://ec.europa.eu/commission/presscorner/detail/en/ip_24_2373
More sources (8)
- European Commission, request for information to LinkedIn on targeted advertising based on sensitive data (14 March 2024). https://digital-strategy.ec.europa.eu/en/news/commission-sends-request-information-linkedin-potentially-targeted-advertising-based-sensitive-data
- European Commission, statement by Commissioner Breton on steps announced by LinkedIn (7 June 2024). https://digital-strategy.ec.europa.eu/en/news/statement-commissioner-breton-steps-announced-linkedin-comply-dsa-provisions-targeted-advertisement
- European Commission, Guidelines on measures to ensure a high level of privacy, safety and security for minors online, pursuant to Article 28(4) of Regulation (EU) 2022/2065, OJ C/2025/5519 (10 October 2025). https://eur-lex.europa.eu/eli/C/2025/5519/oj
- European Commission, "Commission publishes guidelines on the protection of minors" (14 July 2025). https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-protection-minors
- European Commission, Proposal for a Regulation, EU KIDS Act, COM(2026) 681 final (17 September 2026). EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52026PC0681
- Court of Justice of the EU, press release 60/24, order of the Vice-President in C-639/23 P(R), Commission v Amazon Services Europe (27 March 2024). https://curia.europa.eu/jcms/upload/docs/application/pdf/2024-03/cp240060en.pdf
- BEUC, "BEUC welcomes the EU court's decision to uphold Amazon's designation as a Very Large Online Platform", BEUC-PR-2025-035 (19 November 2025). https://www.beuc.eu/sites/default/files/publications/BEUC-PR-2025-035_Amazon_DSA_Court_decision.pdf
- IAB Tech Lab, OpenRTB community extension "DSA Transparency" (last commit 26 January 2024). https://github.com/InteractiveAdvertisingBureau/openrtb/blob/main/extensions/community_extensions/dsa_transparency.md
Changelog
- 9 November 2026: page created. Enforcement timeline runs from 27 September 2023 to 20 July 2026.