The European Union's Digital Services Act (DSA) has turned advertising transparency and user protections into concrete obligations for covered online platforms. Ads must be identifiable as advertising, users must receive information about who is promoting them and why they are seeing them, and platforms cannot use sensitive personal data for ad targeting. The law also prohibits targeted advertising based on profiling when the user is known to be a minor.
For ad-tech providers, platform operators, and AI-enabled services that deliver or support advertising, the practical challenge is not simply changing an ad label. Compliance depends on whether systems can reliably identify ads, preserve provenance information, apply targeting restrictions, and produce the records needed for regulatory scrutiny. Recent European Commission enforcement activity across major platforms underlines that the DSA is an operating compliance framework, not only a policy statement.
What the DSA requires for online advertising
The DSA's advertising provisions focus on giving users meaningful context about commercial content and limiting the use of particularly sensitive or vulnerable-user data. In its April 2023 communication, the Commission stated that platforms must label ads, disclose who is promoting them, and explain why users see them. The same communication says advertisements cannot be displayed using sensitive user data, including ethnic origin, political opinions, or sexual orientation, and that profiling-based targeted advertising to children is no longer permitted. These requirements are set out in the European Commission's official DSA press release.
