A source-based guide for online platforms assessing the EU Digital Services Act duties on minors' privacy, safety, security, and profiling-based advertising.
Use it to separate binding Article 28 duties from the Commission's voluntary 2025 guideline measures, including age assurance and safer platform design.
Structured answer sets in this page tree.
Cited legal and guidance references.
Article 28 of the EU Digital Services Act requires an online platform to put appropriate and proportionate measures in place for a high level of minors' privacy, safety, and security. It also prohibits profiling-based advertising when the platform is aware with reasonable certainty that the recipient is a minor. Article 28 does not require extra personal-data processing solely to determine whether a recipient is a minor.
Determine the service's scope before selecting controls. Recital 71 says an online platform is when its terms allow minors to use it, it is directed at or predominantly used by minors, or the provider is otherwise aware that some recipients are minors. Record the terms, intended audience, actual use, and reliable age information already available to the provider.
Article 19 exempts qualifying micro and small enterprises from the DSA's additional online-platform obligations, including Article 28, unless they are designated as a very large online platform. After a provider loses micro or small enterprise status, the exemption continues for 12 months. Other DSA duties outside that section may still apply.
Article 28 sets an outcome and proportionality standard; it does not prescribe one control set for every service. The platform should connect each measure to the risks created by its purpose, design, size, and user base. The Commission's 2025 guidelines recommend specific measures, but following them is voluntary and does not by itself establish compliance.
Article 28 prohibits an online platform from presenting advertisements on its interface based on profiling, as defined by the GDPR, using the recipient's personal data when the provider is aware with reasonable certainty that the recipient is a minor. The Article 28 ban is limited to profiling-based advertising. Non-profiled advertising still requires assessment under the DSA and any other applicable consumer, privacy, advertising, or national child-protection rules.
The DSA does not define one universal signal for 'reasonable certainty.' A provider should document which information it already has, why that information reaches or does not reach the standard, and how its ad systems act on the result. Article 28 also says compliance does not oblige a platform to process additional personal data solely to assess whether a recipient is a minor.
The Commission published its Article 28 guidelines on 14 July 2025. They are non-binding: implementation is voluntary, does not automatically establish compliance, and may inform Commission and national-regulator assessments. Use them as a control catalogue, then document why each selected or omitted measure fits the service's risks.
The official source recommendations cover privacy-by-default, safer recommender systems, user controls, limits on unwanted sharing of minors' content, safeguards against excessive-use features, harmful commercial-practice controls, and improved moderation, reporting, feedback, and parental-control tools.
Other DSA provisions may overlap with Article 28. Article 27 requires online platforms using recommender systems to explain the main parameters in plain and intelligible language and provide options to modify or influence them. For VLOPs and VLOSEs, Article 38 adds at least one recommender option that is not based on profiling.
For very large services, minors protection can also appear inside systemic-risk work. The DSA risk-assessment and mitigation provisions refer to children's rights, protection of minors, physical and mental well-being, recommender systems, advertising systems, interface design, content moderation, and internal documentation.
An Article 28 file should show why the service is or is not , what the provider knew, which risks it identified, which controls it selected, and why those controls are proportionate. It should also distinguish a decision not to collect more age data under Article 28(3) from a decision to use age assurance because the service's risks or another applicable rule supports it.
The record should let design, advertising, trust and safety, data science, policy, legal, privacy, and compliance teams test the same scope and control claims.
No. Article 28 requires appropriate and proportionate minors-protection measures and restricts profiling-based ads to minors when the platform is aware with reasonable certainty that the recipient is a minor. It also says compliance does not oblige platforms to process additional personal data to assess whether a recipient is a minor.
The voluntary guidelines recommend age assurance that is accurate, reliable, robust, non-intrusive, and non-discriminatory. They recommend age verification for access to adult content such as pornography and gambling and where national rules set a minimum age for specified services. They recommend age estimation in other cases, including where terms set a minimum age below 18 because of identified risks to minors. The correct method still depends on the service, risk, and other applicable law.
A provider that qualifies as a micro or small enterprise is exempt from the DSA section containing Article 28 unless the service has been designated as a very large online platform. If the provider later loses that enterprise status, the exemption continues for 12 months. This exception does not remove DSA duties that sit outside the additional online-platform section or obligations under other law.
Sorena can help structure Article 28 scope, targeted-ad restrictions, recommender controls, guideline recommendations, and age-assurance rationale into a reusable evidence record.
Ask questions tied to cited sources about Article 28, targeted advertising to minors, recommender systems, and Commission guidance using the cited sources on this page.
Walk through your minors-protection controls, age-assurance rationale, ad-system evidence, and source gaps with Sorena.