DSA approved: Targeted Advertising Rules explained

This article, relating to Irish law, was written by the team in our Dublin office for Browne Jacobson Ireland LLP

The Digital Services Act (the “DSA”) has today (27 October) been given the go-ahead by the EU Council and will enter into force by early 2024.

The DSA ushers in wide-ranging obligations for digital platforms - this article focuses on how the DSA will impact targeted advertising, but the impact is considerably wider.

Digital platforms increasingly trade in personal data. In return for user interfaces with easy functionality, platforms receive personal data and facilitate online ads. The EU is recognising with the DSA that a transaction happens when we use free online services and that users need protection.

The DSA is part of a suite of new measures, including the Audio-Visual Media Services Directive, the now familiar GDPR, which reign in large platforms as they interact with individuals and vulnerable individuals in particular. The DSA compliments the GDPR and makes use of concepts in the GDPR which have already become familiar to businesses and individuals alike.

Who do these rules apply to?

The DSA’s rules apply to online platforms, search engines and hosting services, all of which are broadly defined. This will include household online platforms with which we are familiar, such as online marketplaces, social media platforms, and household name search engines.

Protecting children and vulnerable

There are robust new rules protecting minors from targeted advertising. Online platforms must now ensure security and safety of minors on their platforms. This is a very topical conversation, with several platforms in regulatory crosshairs at present for failure to protect children online. New rules are welcome and provide for a clear ban on presenting advertising to minors which is based on profiling of personal data. This is the case where the online platform is aware or have a “reasonable certainty” that a person is a minor.

Separately, the use of so-called “special category” data, as referred to in Article 9(1) of the GDPR, is now prohibited for targeted advertising, with no exempting legal basis provided for. This means for example, that people cannot be targeted by ads which use their vulnerabilities to sell goods and services.

Profiling and advertisements

The DSA builds on the extensive existing protections in the GDPR – current rules relating to the right to object to targeted advertising and automated individual decision making are not affected by the DSA. Online platforms will now be obliged to ensure that recipients of a service are entitled to information on the main parameters of why a specific ad is presented to them.

Taking a step back, this means that a digital platform must be transparent with its end users where personal profiling is used. Users of a service will also now be entitled to have individualised information enabling them to know when and, on whose behalf, a targeted ad is presented. This information must be provided for every user, and this could present a significant operational challenge for online platforms.

Next steps

The DSA will mean significant changes to targeted advertising, and data practitioners ought to be aware of these changes. If you need assistance navigating this complex area, or if there are other provisions in the DSA which are likely to impact your business, please get in touch with a member of our team who will be happy to assist.