Digital Services Act (DSA)

The Digital Services Act (Regulation (EU) 2022/2065) sets rules for online services used by people in the EU, including marketplaces, social networks, app stores and travel and accommodation platforms. It was adopted on 19 October 2022 and has applied to all online platforms since 17 February 2024. Obligations scale with a service's size: platforms and search engines with over 45 million monthly users in the EU carry the most.

Ad labelling. Platforms that show ads must let each user identify, clearly and in real time, that something is an ad, on whose behalf it is shown, who paid for it if that is someone else, and meaningful information about the main parameters used to decide who sees it.

Limits on targeting. Platforms may not show ads based on profiling that uses the special categories of personal data defined in the GDPR; the Commission gives sexual orientation, religion and race as examples. Nor may they show ads based on profiling with a user's personal data when they are aware with reasonable certainty that the user is a minor.

Ad repositories. Very large online platforms and search engines must publish a searchable repository of the ads they show, also available through APIs. It covers each ad's content, the advertiser, who paid, when it ran, the main targeting parameters and its reach, and is kept until one year after the ad last ran. It must not contain personal data of the people the ad was shown to.

Enforcement. The Commission supervises the very large platforms and search engines, whose designated providers include Amazon, Google, Meta and TikTok; national Digital Services Coordinators supervise platforms established in their territory. The Commission can fine a very large platform or search engine up to 6% of its total worldwide annual turnover.