Strict regulations shape ad policies on digital platforms
European Data Protection Board (EDPB) Issues New Guidelines on GDPR and DSA Interplay
The European Data Protection Board (EDPB) has released new guidelines addressing the interplay between the General Data Protection Regulation (GDPR) and the Digital Services Act (DSA). These guidelines, adopted on September 11, 2025, provide clarity on the rules surrounding online platform advertising and the use of sensitive user data, even with explicit consent.
According to the EDPB, the prohibition on serving targeted ads based on personal data processing stands, regardless of consent under the GDPR. This ban extends to online platform providers presenting ads with reference to user profiling using special category data, as outlined in the DSA.
Dr. Nils Rauer, a technology law expert, has welcomed the EDPB's move to provide guidance on the interplay of the GDPR and the DSA. However, he has expressed concern over the EDPB's rigid interpretation of the DSA's advertising provisions. Dr. Rauer emphasised the need for restrictive measures, particularly in the protection of children's data.
Recital to the GDPR states that protections should apply to the use of personal data of children for marketing or creating personality or user profiles. The DSA prohibits serving targeted ads to children based on personal data processing, regardless of consent under the GDPR. Furthermore, the DSA requires providers of online profiles accessible to minors to implement appropriate and proportionate measures for privacy, safety, and security.
The EDPB's guidelines are not binding, as they have not been tested in court. However, they offer valuable insights into the interpretation and application of the GDPR and DSA in the context of online advertising and user data protection.
The EDPB is also working on guidelines addressing the interplay between the GDPR and the EU Digital Markets Act (DMA) and the GDPR and the AI Act. These upcoming guidelines are expected to further clarify the application of data protection rules in the digital marketplace.
London-based Meghan Higgins noted a broader push across jurisdictions to recognise and address potential harms children face online. The EDPB's guidelines reflect this global trend towards stricter data protection measures for minors.
The DSA provides for a tiered system of regulation affecting online intermediaries and contains provisions relevant to online advertising. The GDPR governs the processing of personal data, with the strictest conditions applicable to the processing of special categories of data. One basis for processing special category data under the GDPR is where an organization has obtained the explicit consent of the data subject.
The EDPB has invited comment on the guidelines until 31 October 2025. Stakeholders are encouraged to engage with the EDPB to ensure that the guidelines accurately reflect the complexities and nuances of the interplay between the GDPR and the DSA.
Read also:
- Overcoming Yielding Regulations Hurdles in Indian Export Sector for EU Markets
- Vaccinations Explained: An Overview of Immunization Processes
- Shaping production and consumption tendencies via cosmetic certification
- Increased Investment in AI, Machine Learning, Internet of Things, and Quantum Computing to Propel Growth in the Digital Economy (2020 Budget)
