DSA Advertising and DMA: Duties for Meta and TikTok

DSA advertising: which obligations affect advertisers

Since 17 February 2024, advertising under the DSA has been subject to binding transparency and targeting rules across the EU. The Digital Services Act addresses many duties directly to platforms. Advertisers are still affected because they must provide correct information about the principal, payer, advertising content and targeting parameters, and their campaigns become visible in public advertising repositories.

The Digital Markets Act intervenes elsewhere. It limits the power of large gatekeepers and affects Meta mainly through restrictions on combining personal data and the choice between fully personalised and less personalised advertising. For media teams, this means fewer signals, more documentation and greater dependence on first-party data.

As of August 2026, the DSA and DMA cannot be treated as a side issue for the legal department. Campaign structure, creative approval, audience selection, data flows and reporting must translate the requirements into operations.

What Article 26 DSA requires for advertising

Article 26(1) requires users to be able to identify an item as advertising. The ad must also name the person on whose behalf it is displayed. If another person pays for it, that information must also be visible. The main targeting parameters and the option to change those parameters must be disclosed as well.

This goes beyond a visible sponsored label. Platform, advertiser identity, payer relationship and audience logic need to fit together. In group structures, agency accounts or co-marketing arrangements, the principal and payer should therefore be clarified before launch.

Article 26(3) prohibits profiling-based advertising using special categories of personal data under Article 9(1) GDPR. The correct paragraph is paragraph 3, not paragraph 4.

Advertisers should also examine indirect audience logic. An audience may imply sensitive information even when the attribute does not appear openly in its name. Custom audiences, data partners and lookalike seeds therefore need documented origin and purpose.

The Paid Social pillar places these legal boundaries alongside platform logic, measurement and creative.

Advertising to minors under Article 28 DSA

Article 28(2) prohibits profiling-based advertising when a platform knows with reasonable certainty that a user is a minor. The provision does not require platforms to collect additional personal data solely to establish age.

The practical conclusion for companies is clear. Campaigns involving youth-oriented products, creatives or interests need especially strict review. Age limits in an ads manager are only one control. The message, landing page, offer and organic context should reflect the same target audience decision.

An advertiser should document why an audience was selected and which exclusions apply. This record supports internal approval and later questions from a platform or authority.

Advertising repositories under Article 39 DSA

Under DSA Article 39, very large online platforms and search engines must maintain a public, searchable advertising repository. Information remains available for up to one year after the final display. The repository includes advertising content, principal, payer, delivery period and targeting information.

This changes competitive monitoring. Ads are not visible only to their intended audience. Journalists, researchers, competitors and authorities can review campaigns systematically. Consistent claims and landing pages therefore become more important.

In July 2024, the European Commission preliminarily found that X did not provide a searchable and reliable advertising repository. The case shows that a nominal archive is not enough when access barriers or design prevent meaningful use.

Media teams should include the repository in quality assurance. After launch, verify whether creative, URL, principal and targeting information appear correctly. An error in the repository may reveal incorrect account or billing data.

TikTok and its DSA transparency commitments

On 5 December 2025, the European Commission accepted binding commitments from TikTok. The platform must provide the complete advertising content, including URLs contained in the ad link. Information should be available in the repository within no more than 24 hours. TikTok must also disclose the targeting criteria chosen by the advertiser, together with aggregated user data on gender, age group and member state, plus additional search and filter options in the repository. The commitments are binding under Article 71 DSA.

Implementation periods range from two to no more than twelve months, depending on the measure. For advertisers, this creates greater auditability. Incorrect redirects, unclear claims or unsuitable targeting criteria become visible more quickly.

The operational TikTok setup with Smart+, GMV Max and Spark Ads is covered in TikTok Ads 2026. The DSA layer adds transparency, documentation and auditability to that campaign logic.

Article 40 DSA and researcher access

On 24 October 2025, the Commission preliminarily found that Meta and TikTok may have breached their duty to provide researchers with adequate access to public data. For Meta, the finding covers Facebook and Instagram: the Commission points to the absence of easy notice-and-action mechanisms, dark patterns in the reporting flow and an inadequate route for appealing moderation decisions.

If infringements are confirmed, DSA fines may reach six percent of worldwide annual turnover. These are preliminary findings, not a final decision.

Article 40 affects advertisers indirectly. More research access may produce new evidence on advertising impact, targeting, disinformation and platform risk. It also increases the likelihood that problematic campaign patterns will be analysed systematically.

DMA, Meta and pay or consent

Meta introduced a binary consent-or-subscription model in November 2023. On 23 April 2025, the European Commission imposed a EUR 200 million fine on Meta. The sanctioned period ran from March to November 2024, from the date on which the DMA obligations became binding until the introduction of a modified model.

The Commission criticised the lack of an equivalent alternative using less personal data. DMA Article 5(2) requires valid consent for combining personal data across services and an alternative that uses less data.

DMA fines may reach ten percent of worldwide annual turnover. The commercial relevance is particularly high for Meta. A SCiDA analysis published on 24 June 2025 describes 97.5 percent of Meta's global revenue as advertising-based. This is a secondary analysis and should be read as an order of magnitude rather than an audited financial-statement figure.

The technical development of Meta Andromeda, GEM and Advantage+ therefore operates in tension: greater automated personalisation meets legal limits on data combination.

Less Personalised Ads from January 2026

On 8 December 2025, the Commission acknowledged Meta's commitment to offer Facebook and Instagram users in the EU a choice between fully personalised advertising and a variant using less personal data and reduced personalisation. The rollout began in January 2026.

The Commission notice does not say that this advertising is purely contextual rather than behavioural. It also does not state that potential periodic penalty payments were permanently waived. The effect of the model should be assessed after rollout using adoption and evidence.

Three practical consequences follow for advertisers:

Less signal: Some users provide less data for personalisation and attribution.

Greater creative importance: Message and context have to work harder when individual signals weaken.

More measurement uncertainty: Platform segments may differ in data availability and performance.

Companies should therefore monitor performance by consent and personalisation status where platform data permit it. A general deterioration should not be assumed. The account's own evidence matters.

What advertisers should change operationally

Legal requirements need to become campaign processes. A PDF in a compliance folder is not enough.

Clarify advertiser identity: Document principal, payer, agency and group relationship before setup.

Review targeting: Check sensitive categories, risks involving minors, custom-audience origin and lookalike seeds.

Archive creative and URL: Store the live version, landing page, approval, delivery period and change history.

Check the repository: After launch, verify that platform information is complete and correct.

Plan for signal loss: Strengthen first-party data, CRM feedback and independent measurement.

Separate approvals: Media, legal, privacy and brand teams should have defined review points.

Transparency obligations for AI-generated content under Article 50 of the EU AI Act belong in a separate process. The existing knowledge base covers Article 50 transparency obligations separately.

Pre-mortem for DSA advertising

Assume that a campaign is publicly criticised or restricted by the platform. Likely causes include an incorrect principal, a different payer, sensitive targeting signals, unclear communication to minors, a misleading claim or a landing page that no longer matches the ad.

Every risk needs an owner and evidence. Account information is maintained centrally. Targeting sources receive origin documentation. Creatives and landing pages are versioned. Repository entries are sampled after launch.

These controls slow launch slightly. They prevent much greater friction when a platform, authority or the public asks questions.

Conclusion: transparency becomes part of campaign architecture

The DSA and DMA do more than change paid social legally. They change which data can be used, what becomes publicly visible and how reliably personalisation works. Good advertisers therefore treat transparency like tracking or creative: as a fixed component of the system rather than a final approval step.

The operational combination of channel strategy, content, community management, paid social and reporting is covered by Blck Alpaca's Social Media Management.