Artifact GuideEU

EU Digital Services Act (DSA) Ads & Recommender Systems

How to implement DSA ad transparency and recommender transparency as real UX and data controls.

Covers platform and VLOP/VLOSE layers: per-ad disclosures, recommender parameter transparency, ad repositories, and non-profiling options.

Author
Sorena AI
Published
Feb 21, 2026
Updated
Feb 21, 2026
Sections
8

Structured answer sets in this page tree.

Primary sources
2

Cited legal and guidance references.

Publication metadata
Sorena AI
Published Feb 21, 2026
Updated Feb 21, 2026
Overview

DSA advertising and recommender obligations are user-facing controls. Compliance isn't a policy statement - it's UI behavior, logging, and the ability to prove what a user saw and why. This page translates Articles 25-28 and (for VLOPs/VLOSEs) Articles 38-39 into implementable requirements, UX patterns, and evidence expectations.

Section 1

Ads and recommenders: what the DSA is trying to achieve

The DSA adds transparency and user control where ranking and targeting influence what people see.

The obligations focus on: clear labeling, attribution (who benefits and who paid), meaningful targeting explanations, and user control over recommender parameters.

  • User clarity: recipients should be able to tell what is advertising and why they're seeing it.
  • Control: recipients should be able to influence ranking and recommendations where options exist.
  • Accountability: VLOPs/VLOSEs have additional public transparency (ad repositories and non-profiling options).
Section 2

Article 26 - Advertising transparency (per-ad, real-time disclosures)

If you present advertisements on your online interface, Article 26 requires that for each specific ad and each recipient, they can identify certain information clearly, concisely, unambiguously and in real time.

Treat this as a UI requirement plus an instrumentation requirement.

  • Labeling: clearly indicate that the information is an advertisement (prominent marking).
  • Beneficiary: identify the natural or legal person on whose behalf the ad is presented.
  • Payer: identify who paid for the ad if different from the beneficiary.
  • Targeting parameters: provide meaningful information directly and easily accessible from the ad about main parameters used to determine the recipient, and (where applicable) how to change those parameters.
  • Commercial communications declaration: provide a way for recipients posting content to declare commercial communications and label it accordingly (Article 26(2)).
Section 3

Article 27 - Recommender system transparency (parameters + user options)

If you use recommender systems, Article 27 requires you to explain the main parameters in your terms and conditions, and describe options for recipients to modify or influence those parameters.

In practice, this means "why am I seeing this?" plus a control surface (where options exist).

  • Explain "why suggested": criteria most significant in determining what is suggested and the reasons for their relative importance.
  • Document user options: how recipients can modify or influence parameters (e.g., following/interest signals, mute/hide, chronology vs relevance).
  • If multiple ranking options exist: provide a directly accessible functionality to select and modify preferred option from the prioritized section (Article 27(3)).
Section 4

Article 25 - Interface integrity (anti-dark-pattern duty)

Article 25 prohibits designing/organising/operating interfaces in a way that deceives or manipulates recipients or materially impairs their ability to make free and informed decisions.

Ads and recommender controls are common dark-pattern surfaces (consent, personalization toggles, cancellation flows).

  • Avoid: making cancellation harder than subscription; repeated coercive popups after choices are made; deceptive defaults.
  • Make controls discoverable: personalization controls should be easy to find, not hidden behind multi-step flows.
  • Prove compliance: run UX audits and store evidence (screenshots, user flows, change logs).
Section 5

Article 28 - Minors: privacy, safety, and ad restrictions

If your platform is accessible to minors, Article 28 requires appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors on the service.

Article 28 also restricts presenting ads to minors based on profiling when you are aware with reasonable certainty the recipient is a minor, without forcing additional personal data processing solely to assess age.

  • Define minors-accessibility: document how minors can access the service and what protections apply.
  • Ads: implement "no profiling-based ads to minors" control path where you can reasonably determine minor status.
  • Safety controls: consider defaults, friction, reporting mechanisms, and safeguards that reduce harmful exposure for minors.
Section 6

VLOP/VLOSE upgrade - Article 38: non-profiling option for each recommender system

For VLOPs/VLOSEs that use recommender systems, Article 38 adds a specific requirement: provide at least one option for each recommender system that is not based on profiling (GDPR profiling definition referenced).

This is a major product requirement: you need an alternative ranking mode and a control surface.

  • Identify "each recommender system": define the surfaces (feed, search ranking, suggested accounts, recommended products).
  • Provide a non-profiling option per surface: e.g., chronological ordering, contextual popularity, or explicit user-selected topics without profiling.
  • Make it selectable: integrate with Article 27 option-selection functionality.
  • Instrument it: log option selection and ensure the system actually runs without profiling for that option.
Section 7

VLOP/VLOSE upgrade - Article 39: ad repository + APIs (searchable, reliable, no personal data)

Article 39 requires VLOPs/VLOSEs presenting ads to make a public repository available via a searchable tool (multi-criteria queries) and via APIs, covering the period the ad is shown and for one year after it was last shown.

Build this as a product and data platform capability, with privacy protections.

  • Repository content includes: ad content/subject matter, beneficiary, payer (if different), period shown, and targeting parameters (including exclusion parameters) for intended groups.
  • Public access + API: provide a reliable search tool and APIs; design rate limits and abuse controls that do not undermine access.
  • Privacy: ensure repository does not contain personal data of recipients to whom the ad was/could be presented.
  • Quality: make reasonable efforts to keep repository information accurate and complete.
Section 8

Evidence pack (what to retain and how to prove compliance)

Ads and recommender compliance is often challenged by "prove it" questions: what did the user see, what did it mean, and what options existed?

Build evidence and testing into your release process.

  • UI evidence: ad labeling screenshots, "why this ad" disclosures, targeting parameter explanations, recommender option selectors.
  • Policy evidence: terms & conditions sections describing recommender parameters and user options (Article 27).
  • Data evidence: logs showing ad metadata and disclosures served per impression; recommender option selection and effect.
  • VLOP evidence: ad repository dataset schema, API docs, and validation checks; non-profiling option test results.
Recommended next step

Use EU Digital Services Act (DSA) Ads & Recommender Systems as a cited research workflow

Research Copilot can take EU Digital Services Act (DSA) Ads & Recommender Systems from getting cited answers and faster research on this topic to a reusable workflow inside Sorena. Teams working on EU Digital Services Act (DSA) can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Primary sources

References and citations

eur-lex.europa.eu
Referenced sections
  • Primary DSA text for ad transparency (Article 26), recommender transparency (Article 27), anti-manipulation interface duty (Article 25), minors protections (Article 28), VLOP recommender option (Article 38), and VLOP ad repository (Article 39).
Related guides

Explore more topics

DSA Applicability Test | Is the EU Digital Services Act Applicable to You?
A step-by-step applicability test for the EU Digital Services Act (DSA, Regulation (EU) 2022/2065): EU offering triggers.
DSA Enforcement & Investigations | DSCs, Commission Powers, Audits & Procedures
A practical guide to DSA enforcement (Regulation (EU) 2022/2065): how Digital Services Coordinators (DSCs) supervise services.
DSA Notice & Action Workflow | Article 16 Requirements + Templates
A deep implementation guide for DSA notice & action (Regulation (EU) 2022/2065, Article 16): intake design, required notice elements.
DSA Penalties & Fines | Digital Services Act Enforcement Exposure (6% / 1% / 5%)
How DSA penalties work under Regulation (EU) 2022/2065.
DSA Transparency Report Template | Article 15 + Article 24 + VLOP Article 42
Copy and paste ready DSA transparency report template aligned to Regulation (EU) 2022/2065 and Implementing Regulation (EU) 2024/2835.
DSA Transparency Reporting | Articles 15, 24 & 42 Reporting Requirements
A practical guide to EU Digital Services Act transparency reporting: what to publish for Article 15, what to add for Article 24.
DSA vs DMA | Digital Services Act vs Digital Markets Act (What's the Difference?)
A practical comparison of the EU Digital Services Act (DSA, Regulation (EU) 2022/2065) and the EU Digital Markets Act (DMA.
DSA vs UK Online Safety Act | EU vs UK Online Safety Compliance
A practical comparison of the EU Digital Services Act (DSA, Regulation (EU) 2022/2065) and the UK Online Safety Act: scope (EU recipients vs UK users).
EU Digital Services Act (DSA) Requirements | Obligations by Service Type & Tier
A practical breakdown of DSA requirements (Regulation (EU) 2022/2065): obligations for intermediary services, hosting services, online platforms.
EU DSA Checklist | Digital Services Act Compliance Checklist (Audit-Ready)
An audit-ready EU Digital Services Act (DSA) compliance checklist for Regulation (EU) 2022/2065: scope memo, terms transparency.
EU DSA Compliance Guide | Digital Services Act Implementation Playbook
A practical EU Digital Services Act (DSA) compliance guide for Regulation (EU) 2022/2065: scope memo and tiering.
EU DSA Deadlines & Compliance Calendar | Key Dates, Cadence and Milestones
A DSA compliance calendar for Regulation (EU) 2022/2065: entry into force, general applicability, Digital Services Coordinator designation, Article 15, 24.
EU DSA FAQ | Digital Services Act Questions & Answers (Practical)
Practical answers to the most searched EU Digital Services Act (DSA) questions: who is in scope, what "hosting" and "online platform" mean.
EU DSA Service Types & Scope | Hosting vs Platform vs Marketplace
How to classify your service under the EU Digital Services Act (DSA, Regulation (EU) 2022/2065): intermediary service types (mere conduit, caching, hosting).
VLOP/VLOSE Systemic Risk Assessment (DSA) | Articles 34-36 + Mitigation
A deep guide to DSA systemic risk management for VLOPs/VLOSEs: how to run the Article 34 systemic risk assessment (risk categories, frequency.