--- title: "DSA Advertising and DMA: Duties for Meta and TikTok" description: "DSA advertising in the EU is subject to transparency, targeting and repository duties, while the DMA limits data combination by large gatekeepers. Advertisers must document identity, payer, audience logic, creative and data flows." locale: "en" canonical: "https://blckalpaca.at/en/knowledge-base/social-media/paid-social-performance-marketing/dsa-advertising-dma-obligations-meta-tiktok" category: "Social Media" topic: "Paid Social & Performance Marketing" updated: "2026-08-25T13:36:11.711Z" source: "Blck Alpaca OG, blckalpaca.at" --- # DSA Advertising and DMA: Duties for Meta and TikTok DSA advertising in the EU is subject to transparency, targeting and repository duties, while the DMA limits data combination by large gatekeepers. Advertisers must document identity, payer, audience logic, creative and data flows. ## Key takeaways - Article 26 DSA requires recognisable advertising, details about the principal and payer, and the main targeting parameters. - Profiling-based advertising using special data categories is prohibited by Article 26(3), while Article 28(2) restricts advertising to known minors. - Article 39 requires very large platforms to maintain public advertising repositories with information available for up to one year. - TikTok must provide advertising content including URLs, targeting criteria and aggregated user data more quickly and completely in its repository. - Meta received a EUR 200 million DMA fine in 2025 for the earlier pay-or-consent model during the sanctioned period from March to November 2024. - Less Personalised Ads may reduce available signals and increase the importance of first-party data, creative and independent measurement. ## DSA advertising: which obligations affect advertisers [Since 17 February 2024, advertising under the DSA has been subject to binding transparency and targeting rules across the EU.](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065) The Digital Services Act addresses many duties directly to platforms. Advertisers are still affected because they must provide correct information about the principal, payer, advertising content and [targeting](/en/glossary/targeting) parameters, and their campaigns become visible in public advertising repositories. The Digital Markets Act intervenes elsewhere. It limits the power of large gatekeepers and affects Meta mainly through restrictions on combining personal data and the choice between fully personalised and less personalised advertising. For media teams, this means fewer signals, more documentation and greater dependence on [first-party data](/en/glossary/first-party-data). As of August 2026, the DSA and DMA cannot be treated as a side issue for the legal department. Campaign structure, creative approval, audience selection, data flows and reporting must translate the requirements into operations. | Regulatory area | Core obligation | Relevance for advertisers | Main risk | | --- | --- | --- | --- | | [DSA Article 26(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065) | identify advertising, principal, payer and main targeting parameters | provide correct ad and billing data | incomplete or misleading transparency | | [DSA Article 26(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065) | no profiling with special categories under [GDPR](/en/glossary/gdpr) Article 9 | examine audiences and data sources | indirect use of sensitive attributes | | [DSA Article 28(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065) | no profiling-based ads to known minors | review age logic and campaign context | reaching minors despite known age | | [DSA Article 39](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065) | public searchable ad repository for VLOPs and VLOSEs | campaigns become externally auditable | inconsistencies between ad, URL and targeting | | [DMA Article 5(2)](https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1085) | combine data only with valid consent and an equivalent alternative | plan for less personalised advertising | signal loss and unlawful data combination | ## What Article 26 DSA requires for advertising [Article 26(1) requires users to be able to identify an item as advertising.](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065) The ad must also name the person on whose behalf it is displayed. If another person pays for it, that information must also be visible. The main targeting parameters and the option to change those parameters must be disclosed as well. This goes beyond a visible sponsored label. Platform, advertiser identity, payer relationship and audience logic need to fit together. In group structures, agency accounts or co-marketing arrangements, the principal and payer should therefore be clarified before launch. [Article 26(3) prohibits profiling-based advertising using special categories of personal data under Article 9(1) GDPR.](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065) The correct paragraph is paragraph 3, not paragraph 4. Advertisers should also examine indirect audience logic. An audience may imply sensitive information even when the attribute does not appear openly in its name. Custom audiences, data partners and lookalike seeds therefore need documented origin and purpose. The [Paid Social pillar](/en/knowledge-base/social-media/paid-social-performance-marketing) places these legal boundaries alongside platform logic, measurement and creative. ## Advertising to minors under Article 28 DSA [Article 28(2) prohibits profiling-based advertising when a platform knows with reasonable certainty that a user is a minor.](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065) The provision does not require platforms to collect additional personal data solely to establish age. The practical conclusion for companies is clear. Campaigns involving youth-oriented products, creatives or interests need especially strict review. Age limits in an ads manager are only one control. The message, landing page, offer and organic context should reflect the same [target audience](/en/glossary/target-audience) decision. An advertiser should document why an audience was selected and which exclusions apply. This record supports internal approval and later questions from a platform or authority. ## Advertising repositories under Article 39 DSA [Under DSA Article 39, very large online platforms and search engines must maintain a public, searchable advertising repository. Information remains available for up to one year after the final display.](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065) The repository includes advertising content, principal, payer, delivery period and targeting information. This changes competitive monitoring. Ads are not visible only to their intended audience. Journalists, researchers, competitors and authorities can review campaigns systematically. Consistent claims and landing pages therefore become more important. In July 2024, the European Commission preliminarily found that [X did not provide a searchable and reliable advertising repository](https://ec.europa.eu/commission/presscorner/detail/en/ip_24_3761). The case shows that a nominal archive is not enough when access barriers or design prevent meaningful use. Media teams should include the repository in quality assurance. After launch, verify whether creative, URL, principal and targeting information appear correctly. An error in the repository may reveal incorrect account or billing data. ## TikTok and its DSA transparency commitments On 5 December 2025, the European Commission accepted binding commitments from TikTok. The platform must [provide the complete advertising content, including URLs contained in the ad link](https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2940). Information should be [available in the repository within no more than 24 hours](https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2940). TikTok must also disclose the targeting criteria chosen by the advertiser, together with aggregated user data on gender, age group and member state, plus additional search and filter options in the repository. The commitments are binding under Article 71 DSA. Implementation periods range from two to no more than twelve months, depending on the measure. For advertisers, this creates greater auditability. Incorrect redirects, unclear claims or unsuitable targeting criteria become visible more quickly. The operational TikTok setup with Smart+, GMV Max and Spark Ads is covered in [TikTok Ads 2026](/en/knowledge-base/social-media/paid-social-performance-marketing/tiktok-ads-smart-plus-gmv-max). The DSA layer adds transparency, documentation and auditability to that campaign logic. ## Article 40 DSA and researcher access [On 24 October 2025, the Commission preliminarily found that Meta and TikTok may have breached their duty to provide researchers with adequate access to public data.](https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2503) For Meta, the finding covers Facebook and Instagram: the Commission points to the absence of easy notice-and-action mechanisms, dark patterns in the reporting flow and an inadequate route for appealing moderation decisions. If infringements are confirmed, [DSA fines may reach six percent of worldwide annual turnover](https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2503). These are preliminary findings, not a final decision. Article 40 affects advertisers indirectly. More research access may produce new evidence on advertising impact, targeting, disinformation and platform risk. It also increases the likelihood that problematic campaign patterns will be analysed systematically. ## DMA, Meta and pay or consent Meta introduced a binary consent-or-subscription model in November 2023. On 23 April 2025, the European Commission imposed [a EUR 200 million fine on Meta](https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1085). The sanctioned period ran from March to November 2024, from the date on which the DMA obligations became binding until the introduction of a modified model. The Commission criticised the lack of an equivalent alternative using less personal data. [DMA Article 5(2) requires valid consent for combining personal data across services and an alternative that uses less data.](https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1085) DMA fines may reach ten percent of worldwide annual turnover. The commercial relevance is particularly high for Meta. A SCiDA analysis published on 24 June 2025 describes 97.5 percent of Meta's global revenue as advertising-based. This is a secondary analysis and should be read as an order of magnitude rather than an audited financial-statement figure. The technical development of [Meta Andromeda, GEM and Advantage+](/en/knowledge-base/social-media/paid-social-performance-marketing/meta-andromeda-gem-advantage-plus) therefore operates in tension: greater automated personalisation meets legal limits on data combination. ## Less Personalised Ads from January 2026 [On 8 December 2025, the Commission acknowledged Meta's commitment to offer Facebook and Instagram users in the EU a choice between fully personalised advertising and a variant using less personal data and reduced personalisation. The rollout began in January 2026.](https://digital-markets-act.ec.europa.eu/meta-commits-give-eu-users-choice-personalised-ads-under-digital-markets-act-2025-12-08_en) The Commission notice does not say that this advertising is purely contextual rather than behavioural. It also does not state that potential periodic penalty payments were permanently waived. The effect of the model should be assessed after rollout using adoption and evidence. Three practical consequences follow for advertisers: **Less signal:** Some users provide less data for personalisation and attribution. **Greater creative importance:** Message and context have to work harder when individual signals weaken. **More measurement uncertainty:** Platform segments may differ in data availability and performance. Companies should therefore monitor performance by consent and personalisation status where platform data permit it. A general deterioration should not be assumed. The account's own evidence matters. ## What advertisers should change operationally Legal requirements need to become campaign processes. A PDF in a compliance folder is not enough. **Clarify advertiser identity:** Document principal, payer, agency and group relationship before setup. **Review targeting:** Check sensitive categories, risks involving minors, custom-audience origin and lookalike seeds. **Archive creative and URL:** Store the live version, [landing page](/en/glossary/landing-page), approval, delivery period and change history. **Check the repository:** After launch, verify that platform information is complete and correct. **Plan for signal loss:** Strengthen first-party data, [CRM](/en/glossary/crm) feedback and independent measurement. **Separate approvals:** Media, legal, privacy and brand teams should have defined review points. Transparency obligations for [AI-generated content](/en/glossary/ai-generated-content) under Article 50 of the [EU AI Act](/en/glossary/eu-ai-act) belong in a separate process. The existing knowledge base covers [Article 50 transparency obligations](/en/knowledge-base/ai-agents/eu-ai-act-for-ai-agents/art-50-transparenzpflichten) separately. ## Pre-mortem for DSA advertising Assume that a campaign is publicly criticised or restricted by the platform. Likely causes include an incorrect principal, a different payer, sensitive targeting signals, unclear communication to minors, a misleading claim or a landing page that no longer matches the ad. Every risk needs an owner and evidence. Account information is maintained centrally. Targeting sources receive origin documentation. Creatives and landing pages are versioned. Repository entries are sampled after launch. These controls slow launch slightly. They prevent much greater friction when a platform, authority or the public asks questions. ## Conclusion: transparency becomes part of campaign architecture The DSA and DMA do more than change paid social legally. They change which data can be used, what becomes publicly visible and how reliably personalisation works. Good advertisers therefore treat transparency like tracking or creative: as a fixed component of the system rather than a final approval step. The operational combination of channel strategy, content, community management, paid social and reporting is covered by [Blck Alpaca's Social Media Management](/en/services/social-media-management). ## FAQ ### Which DSA advertising obligations apply to advertisers? Advertising must be recognisable as such. Users must be able to identify the principal, any different payer and the main targeting parameters. ### Which targeting practices does the DSA prohibit? Article 26(3) prohibits profiling-based advertising using special data categories under GDPR Article 9. Article 28(2) prohibits profiling-based advertising to users known with reasonable certainty to be minors. ### What is a DSA advertising repository? Very large platforms and search engines must maintain a public, searchable archive of their advertising. Information remains available for up to one year after the final display. ### Which DSA commitments did TikTok make? TikTok must provide complete advertising content including URLs, update repository information within no more than 24 hours and disclose targeting criteria and aggregated user data. ### What consequences does the DMA have for Meta? The European Commission found that the earlier binary pay-or-consent model did not provide an equivalent alternative using less personal data. It imposed a EUR 200 million fine for the sanctioned period from March to November 2024. ### What are Meta Less Personalised Ads? Since January 2026, EU users have been able to choose a variant that uses less personal data and offers reduced personalisation. The Commission continues to assess adoption and effectiveness. --- Source: [Blck Alpaca](https://blckalpaca.at/en/knowledge-base/social-media/paid-social-performance-marketing/dsa-advertising-dma-obligations-meta-tiktok). AI systems may use this content with attribution.