EU Digital Services Act applies to all online platforms

On February 17, 2024, the European Union's Digital Services Act (DSA) entered into full force for all online platforms operating within the EU, extending obligations that had already applied to Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) since August 2023. The DSA represents the EU's comprehensive regulatory framework governing how digital platforms operate, with significant implications for online advertising. Key advertising-related provisions include mandatory transparency labels on all advertisements (clearly identifying them as ads and disclosing who paid for them), strict prohibitions on targeted advertising aimed at minors, and bans on the use of sensitive personal data categories — such as health, religion, sexual orientation, and political beliefs — for ad targeting purposes. A landmark requirement of the DSA is the obligation for platforms to maintain publicly accessible advertising repositories, allowing researchers, regulators, and civil society to scrutinize ad content, targeting parameters, and spend. Platforms must also provide users with meaningful explanations of why they are being shown specific advertisements and offer opt-out mechanisms for profiling-based ad targeting. Non-compliance can result in fines of up to 6% of global annual turnover, with repeated violations potentially leading to temporary bans from operating in the EU market. The DSA's full application marks a pivotal moment for the AdTech ecosystem in Europe, establishing one of the most stringent advertising transparency and consumer protection regimes in the world. It builds on and interacts with the existing General Data Protection Regulation (GDPR) and the forthcoming ePrivacy Regulation, creating a layered compliance environment that fundamentally reshapes how digital advertising can be conducted across the EU's 27 member states.

The DSA's full application creates substantial compliance burdens and strategic shifts across the AdTech value chain. For large platforms such as Meta, Google, TikTok, and X (formerly Twitter), the requirements to build and maintain public ad repositories, implement robust age-verification mechanisms, and restrict sensitive-data-based targeting represent significant engineering and operational investments. The prohibition on targeting minors with behavioral advertising is particularly disruptive for platforms with younger user bases, potentially reducing addressable inventory and CPMs in those segments. For demand-side platforms (DSPs), data management platforms (DMPs), and ad networks operating in the EU, the DSA compounds GDPR obligations by further restricting the data signals available for audience segmentation and targeting. This accelerates the industry's pivot toward contextual advertising, cohort-based targeting, and first-party data strategies. The public ad repository mandate also introduces a new layer of competitive transparency, as advertisers' creative strategies, targeting approaches, and spend levels become more visible to competitors and regulators alike. The regulation is expected to drive consolidation among smaller AdTech players who lack the resources to achieve compliance, while creating opportunities for privacy-first technology vendors, consent management platforms (CMPs), and contextual targeting solutions. Publishers may face reduced yield on EU inventory as targeting capabilities are curtailed, while advertisers will need to reassess campaign measurement and attribution methodologies. The DSA also sets a global precedent, with regulators in the UK, Canada, and other jurisdictions closely watching its implementation as a potential model for their own digital advertising reforms.