The Digital Services Act and Advertising Transparency

The Digital Services Act obliges the largest platforms to publish every advertisement they carry, who paid for it, and how many people it reached in each member state — and almost no marketer opens them. Article 39 created the most comprehensive competitive intelligence resource in the history of European advertising, as a byproduct of a transparency obligation, and the industry response has largely been to file it under compliance. Meanwhile the enforcement is real: the provider of X was fined €45 million specifically for a non-compliant advertising repository.

A regulatory analysis from Digital, Ecommerce & Performance Marketing in Europe. Read alongside the DMA analysis — different instrument, different purpose, frequently confused. Not legal advice. Last reviewed August 2026.

1. What the DSA actually does to advertising

The DSA is mostly known as a content moderation regime. Several of its provisions are squarely advertising rules, and they constrain European ecommerce marketing more tightly than most teams realise.

Sources: European Commission DSA materials; academic analysis of DSA advertising provisions including Article 28(2) on profiling-based advertising to minors and the ban on profiling using special categories of data; Article 39 repository obligations for platforms with at least 45 million monthly EU users. Legal characterisations are general — the obligations bind platforms rather than advertisers.

Note who is bound. These are obligations on platforms, not on you. Their practical effect on European digital marketing is that certain audiences stopped being purchasable and certain data became public.

2. The repositories are free competitive intelligence

Article 39 requires very large online platforms to publish information about the content of advertisements on their platforms, the identities of the advertisers, and a breakdown of the users targeted and reached in each member state.

Read that as a marketer rather than as a lawyer. It is a mandated, continuously updated, cross-platform record of what your competitors are running, to whom, and at what scale, by country.

Sources: Article 39 DSA requirements; European Commission acceptance of TikTok’s binding commitments on 5 December 2025, under which TikTok will provide the complete content of advertisements as shown to users including embedded URLs and update its repository within 24 hours, with implementation deadlines of up to 12 months monitored under Article 71. Repository completeness and usability vary considerably by platform — verify what each actually publishes.

3. Minor targeting is already gone

This is not a forthcoming change to plan for. It has happened. Reported Commission material confirms that Snapchat, TikTok and Meta’s Instagram and Facebook no longer allow advertisers to show targeted ads to underage users.

Article 28(2) prohibits platforms from presenting profiling-based advertisements where they are aware with reasonable certainty that the recipient is a minor. The platforms complied by removing the capability rather than by asking advertisers to police it.

Operational assessment based on the documented removal of minor targeting capability by major platforms. If your performance shifted in a category with a young audience, this belongs on the list of possible causes alongside creative and auction factors.

4. Sensitive categories and who it affects

The DSA bans profiling-based advertising using special categories of personal data — religion, ethnicity, health, race, sexual orientation and similar. Under the GDPR such processing was permitted with explicit consent; the DSA removes that route for platform advertising entirely.

Sector analysis based on the documented ban on profiling using special categories of data. Whether a specific targeting approach constitutes profiling on sensitive data is a legal question — take advice rather than relying on this table.

Note how neatly this converges with the constraint described in the Washington health data analysis on the other side of the Atlantic. Two entirely separate legal systems have arrived at the same practical instruction: reach the context, not the condition.

5. Enforcement is real and revealing

Sources: European Commission DSA enforcement materials and eucrim’s overview of developments November 2025 to February 2026. Over 60 trusted flaggers have been appointed by national authorities, and Digital Services Coordinators supervise enforcement in each member state.

The €45 million repository fine is the one worth dwelling on. X was not penalised for harmful advertising. It was penalised for inadequate documentation of its advertising. That tells you how seriously the transparency obligation is being taken, and it is the reason the repositories are likely to keep improving as an intelligence source.

6. The transparency regime is contested

Honest note: Article 39 has drawn significant scrutiny, including academic work examining whether very large online platforms can escape its reporting obligations. Repository quality has varied enough that the Commission has had to open proceedings and negotiate binding commitments to obtain compliance from TikTok and AliExpress.

The repositories are valuable and incomplete at the same time. Use them, and do not assume what you find is the whole picture.

There is also a geopolitical dimension that may affect the regime’s trajectory. Reported commentary describes the disagreement escalating, with the US administration accusing EU regulators of censoring American speech and targeting US companies, and visa restrictions imposed on EU figures involved in DSA enforcement. Whatever view you take of that dispute, it is a source of uncertainty about how the regime develops.

7. DSA versus DMA versus GDPR

These three are constantly conflated, including by people selling compliance services. They do different jobs.

Comparative summary. A useful distinction: the GDPR and ePrivacy bind you, while the DSA and DMA bind the platforms you buy from. All four shape European ecommerce marketing, but only two create direct obligations for an ordinary advertiser.

8. What advertisers should actually do

Operational recommendations. The first row is the one nearly everyone skips and is the cheapest competitive research available in European performance marketing.

9. What this page does not cover

Scope statement. This page covers the advertising provisions of a much larger regulation.

10. The 90-day plan

Indicative sequencing. The repository pull sits first because it costs nothing, requires no approval and frequently changes what a team believes about its competitive set.

11. Mistakes to avoid

Recurring errors in responding to the DSA commercially; illustrative.

12. What changes next

Repository quality should improve. TikTok’s commitments run to deadlines of up to twelve months from December 2025 and are monitored under Article 71, and the €45 million repository fine sets a clear precedent for platforms treating the obligation lightly.

Minors protection is expanding. Guidelines cover privacy defaults for minors’ accounts, restrictions on addictive design features and enhanced moderation tools, and TikTok has received preliminary findings on the safety of minors’ accounts.

The regime faces simplification pressure. The DSA has been named alongside the DMA as a possible target in the Commission’s digital fitness check, and the transatlantic dispute over enforcement adds further uncertainty about its trajectory.

Key Takeaways

• Article 39 repositories publish competitor creative, advertiser identity and reach by member state. Almost nobody uses them.
• The provider of X was fined €45 million for a non-compliant repository — a penalty for documentation, not for harmful ads.
• Minor targeting is already gone on Snapchat, TikTok, Instagram and Facebook. Your youth-audience benchmarks predate the change.
• Sensitive-category profiling is banned outright for platform advertising, with no consent route.
• Reach the context, not the condition — the same instruction two unrelated legal systems have arrived at.
• The DSA binds platforms, not advertisers. Its effect on you is that audiences disappeared and data became public.
• Repositories are valuable and incomplete. Use them without assuming they are the whole picture.

Frequently Asked Questions

Conclusion

The Digital Services Act did two things to European advertising that pull in opposite directions. It removed audiences — minors entirely, sensitive categories outright, with no consent route back — and it made the advertising market more visible than it has ever been, by requiring the largest platforms to publish what runs on them, who paid, and who saw it in which country.

Most marketers have absorbed the first half and ignored the second. That is the wrong way round, because the constraints are already priced into your results whether you have noticed or not, while the repositories are an asset sitting unused. Open them for your category before you renew a competitive intelligence subscription, re-baseline anything that spans the loss of youth targeting, and audit whether your audience building infers a sensitive category without declaring one. The regulation took something from European digital marketing and handed something back. Only one of those has to be discovered deliberately.