EU Data Act for ad tech: requirements, cloud switching and connected-device data

Our ad tech regulation calendar places these dates alongside the other 2027 deadlines.

The law. Providers of data processing services must remove "pre-commercial, commercial, technical, contractual and organisational obstacles" that stop customers from leaving. That covers terminating the contract, signing with a rival, and porting "exportable data and digital assets" to another provider or to on-premises infrastructure (Article 23). Exportable data means the input and output data, including metadata, generated by the customer's use of the service. It excludes the provider's own IP and trade secrets (Article 2(38)).

The contract must say so in writing. Required terms include a notice period of no more than two months to start switching. A transition of at most 30 calendar days follows, during which the old provider keeps the service running and helps (Article 25(2)). Infrastructure providers must also take reasonable steps toward "functional equivalence" on the destination service (Article 30(1)).

Charges. Since 11 January 2024 switching charges may not exceed the provider's costs directly linked to the switch. From 12 January 2027 they must be zero (Article 29). Providers must publish standard fees and early termination penalties before contract signature (Article 29(4) to (6)).

What the Commission said. Parallel use is treated differently. Where a customer runs several clouds at once instead of switching, the provider "may still bill the customer for the costs incurred for data egress, even after 12 January 2027" (Commission FAQ v1.4, Q54). The Commission was due to recommend non-binding standard contractual clauses for cloud contracts (FAQ v1.4, Q58). Its Data Act page still links a draft recommendation on our check of 9 November 2026 (Commission, Data Act page).

Exemptions. Three switching duties (Article 23(d), Article 29 and Article 30(1) and (3)) do not apply to services that are mostly custom-built for one customer and not sold from a broad catalogue. Test and evaluation versions are outside Chapter VI (Article 31).

A worked scenario (our analysis). A retailer runs its retail media log-level data and clean room on a cloud data warehouse and wants to move both to another provider in 2027. The questions follow the articles. Is the warehouse a data processing service under Article 2(8)? Are the logs and audience tables "exportable data", or partly the provider's trade secrets? Does the contract give a notice period of two months or less and a 30-day transition? Is the retailer switching, so no charge applies, or adding a second cloud in parallel, where the FAQ allows egress billing?

Our comparison of clean room architectures shows which designs keep the data in the customer's own account, and the analysis of the real cost of cloud DSPs covers data ownership in buying platforms.

The law. Open interoperability specifications and harmonised standards for data processing services must aim at interoperability between services of the same type, portability of digital assets, and functional equivalence, without harming security (Article 35(1)). Article 36 sets essential requirements for smart contracts that execute data sharing agreements.

Pending change. The Commission proposed removing the essential requirements for smart contracts (COM(2025) 837), and the Council mandate deletes Article 36 (Council document 14756/26). For ad tech, the interoperability rules matter less than the switching rules today: they work through standards that do not yet exist for ad platforms.

The law. A connected product is an item that "obtains, generates or collects data concerning its use or environment" and can communicate that product data (Article 2(5)). Products placed on the market after 12 September 2026 must be designed so that the user can reach product data and related service data by default. Access must be free of charge and in a machine-readable format (Articles 3(1) and 50). Where the user cannot reach the data directly, the data holder must make it available without undue delay (Article 4(1)).

Two rules bind the data holder's own use. It may use readily available non-personal data only on the basis of a contract with the user. And it "shall not make available non-personal product data to third parties for commercial or non-commercial purposes other than the fulfilment of their contract with the user" (Article 4(13) and (14)). Personal data stays under the GDPR and the ePrivacy Directive, which prevail in a conflict (Article 1(5)).

Third parties and gatekeepers. A user can ask for data to go to a third party. That third party may not use it "for the profiling" unless necessary for the service the user asked for, and may not pass it to a designated gatekeeper (Article 6(2)(b) and (d)). Gatekeepers under the Digital Markets Act are not eligible recipients at all (Article 5(3)).

What is excluded. Recital 15 leaves out data "inferred or derived" through proprietary algorithms. Recital 16 leaves out content, and data generated "when the user records, transmits, displays or plays content" (Regulation (EU) 2023/2854). The Commission's FAQ adds that content means something "akin to copyrightable material" (FAQ v1.4, Q6).

The table applies those rules to CTV data types. The first column is our classification; the last column names the open question.

If a TV maker's ad business uses non-personal viewing or usage data, Article 4(13) ties that use to a contract with the user. Article 4(14) limits making non-personal product data available to third parties. Whether an aggregated audience report counts as product data or as derived data is the question that decides most CTV cases. Our guide to SSAI and CTV ad serving explains where these logs are produced.

The law. Cloud providers must take "adequate technical, organisational and legal measures, including contracts" to prevent third-country government access to non-personal data held in the EU where it would conflict with EU or national law (Article 32(1)). This sits beside the GDPR transfer rules for personal data.

The Council mandate would also move the ban on unjustified data localisation from the Free Flow Regulation into the Data Act and repeal Regulation (EU) 2018/1807 (Council document 14756/26, recital 19). Country rules that do require local storage are tracked in our data residency requirements by country, and provider options in sovereign cloud providers compared.

Nothing below is law. The Commission proposed the changes on 19 November 2025, the Council agreed its mandate on 21 October 2026, and Parliament has no position (EU Digital Omnibus tracker).

The switching-charge ban survives in both texts. Every carve-out keeps Article 29, so the 12 January 2027 date stands on the texts we read (Council document 14756/26, pp. 79 to 80). The Council text amends Articles 4 and 5 only on trade secrets (paragraphs 6, 8, 9 and 11). We found no change to Articles 3, 4(13), 4(14), 5(3) or 6(2), the provisions that matter most for CTV.

Penalties. Member states set penalties and had to notify them by 12 September 2025 (Article 40). Related frameworks are collected in our ad tech compliance hub.

1. Regulation (EU) 2023/2854 (Data Act), OJ L, 22 December 2023: Articles 1, 2, 3, 4, 5, 6, 23, 25, 29, 30, 31, 32, 35, 36, 40, 50; recitals 15 and 16. EUR-Lex. https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng
2. European Commission, Data Act policy page (checked 9 November 2026). https://digital-strategy.ec.europa.eu/en/policies/data-act
3. European Commission, Frequently Asked Questions on the Data Act, version 1.4 (22 January 2026; library page updated 3 March 2026). https://ec.europa.eu/newsroom/dae/redirection/document/108144
4. European Commission, "Commission publishes Frequently Asked Questions about the Data Act" (library page). https://digital-strategy.ec.europa.eu/en/library/commission-publishes-frequently-asked-questions-about-data-act
5. European Commission, Proposal for a Regulation (Digital Omnibus), COM(2025) 837 final (19 November 2025), explanatory memorandum on Data Act changes. EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025PC0837
6. Council of the European Union, document 14756/26, mandate for negotiations (22 October 2026; agreed by Coreper 21 October 2026), Data Act amendments at pp. 7 to 15 and 60 to 80. https://data.consilium.europa.eu/doc/document/ST-14756-2026-INIT/en/pdf