A landmark European Union legislative framework (Regulation (EU) 2022/2065) designed to create a safer digital space by regulating online intermediaries, social media networks, digital marketplaces, and search engines.
Fully applicable across all EU member states as of February 17, 2024, the DSA updates and expands upon the EU’s 2000 e-Commerce Directive. While the law targets online safety, content moderation, and systemic platform risks, it introduces stringent requirements directly impacting digital marketing, programmatic advertising, recommender algorithms, and consumer data profiling.
Key Provisions Affecting Digital Marketing & AdTech
For marketers, media buyers, and adtech platforms, the DSA fundamentally alters how digital ads can be targeted, rendered, and documented:
1. Mandatory Real-Time Ad Disclosures
For every advertisement displayed on an in-scope platform, users must be presented with immediate, clear, and unambiguous disclosures:
- Ad Labeling: Explicit visual designation that the content is a paid commercial communication.
- Entity Identification: Clear disclosure of the advertiser on whose behalf the ad is displayed and the entity paying for the ad (if different).
- Targeting Criteria: Accessible information explaining the main parameters used to determine why that specific user is seeing the ad.
2. Ban on Profiling Based on Sensitive Data
Article 26(3) of the DSA strictly prohibits presenting advertisements based on profiling using special categories of personal data (as defined under Article 9 of the GDPR). Advertisers can no longer target users based on:
- Health conditions or medical history
- Political opinions or religious beliefs
- Sexual orientation or philosophical views
- Trade union membership or genetic/biometric data
Critical Difference: Unlike the GDPR—which allows processing of special category data under explicit consent—the DSA’s ban on sensitive data profiling for advertising cannot be overridden by user consent.
3. Absolute Ban on Targeted Ads to Minors
Platforms are completely forbidden from displaying profiling-based advertisements to users when the platform knows with reasonable certainty that the recipient is a minor.
4. Prohibition of “Dark Patterns”
Under Article 25, online platforms cannot design, organize, or operate their user interfaces in a way that deceives, manipulates, or impairs a user’s ability to make free and informed choices. This directly impacts consent banners, cancellation flows, and subscription pop-ups.
5. Algorithmic & Recommender Choice
Platforms that use algorithmic recommender systems (e.g., social feeds, product recommendations) must explain their key parameters and provide users with at least one option that is not based on profiling (e.g., a purely chronological feed).
Tiered Scope of Application
The DSA applies to all digital intermediary services offering access to users within the EU, regardless of where the platform provider is established. However, obligations scale according to platform size and function:
| Tier Level | Category | Examples | Core Marketing / Data Impact |
| Tier 1 | Intermediary Services | Internet Service Providers (ISPs), Domain Registrars | Core transparency obligations, annual moderation reports. |
| Tier 2 | Hosting Services | Cloud hosting, Web hosting, CDNs | Notice and action obligations for the removal of illegal content. |
| Tier 3 | Online Platforms | App stores, online marketplaces, forums | Full ad-transparency disclosures, dark-pattern bans, and minor protection. |
| Tier 4 | VLOPs & VLOSEs (Very Large Platforms/Search Engines >45M EU users) | Meta, Google, TikTok, Amazon, YouTube | Mandatory public Ad Repositories (searchable ad archives), systemic risk assessments, independent audits. |
DSA vs. GDPR vs. DMA: Navigating EU Compliance
| Dimension | GDPR | DSA (Digital Services Act) | DMA (Digital Markets Act) |
| Primary Focus | User data privacy & legal processing bases | Platform governance, ad transparency & online safety | Fair competition among market Gatekeepers |
| Target Entities | Any business processing EU citizen data | Online intermediaries, platforms & search engines | Designated Big Tech Gatekeepers |
| Ad Impact | Consent requirements for cookie tracking & profiling | Ban on sensitive/minor ad profiling, mandatory ad labeling | Ban on cross-service data combination without explicit consent |
| Max Penalty | 4% of global annual turnover or €20M | Up to 6% of global annual turnover | Up to 10% of global annual turnover (20% for repeat) |
Operational Roadmap for Modern Martech Teams
- Audit Ad Targeting Parameters: Inspect audience segmentation lists across platform partners (Meta, Google, LinkedIn) to ensure zero custom audiences rely on sensitive inferences or proxy metrics.
- Standardize Ad Disclosure Payloads: Ensure programmatic ad creative pipelines include metadata compatible with major platform ad transparency interfaces (e.g., OpenRTB updates for DSA disclosure fields).
- Eliminate UI Dark Patterns: Audit user acquisition flows, lead-generation forms, and cookie banners to ensure equivalent visual weight for opt-out or reject actions.
- Leverage Public Ad Repositories: Use the public ad archives mandated for VLOPs (e.g., Meta Ad Library, Google Ads Transparency Center) as competitive intelligence tools to analyze market positioning and messaging across the EU.
