DSA and DMA Advertising Obligations for Platforms

Article 26(1) of the DSA asks four things of every ad on your surface: that it is recognisable as an ad in real time, that the advertiser is named, that whoever paid is named where that is a different party, and that the main parameters used to select this recipient are explained, with a way to change them. Four facts, per impression, including impressions filled by a partner network whose response you do not control. The disclosure component takes a week. Getting those four facts out of the supply chain and into the slot is the engagement. Where the work sits: I take platforms that carry third-party advertising, meaning marketplaces, classifieds, publishers running a self-serve booking tool, app stores, review sites, and rebuild the ad surface so it answers the regulation from live data rather than a hardcoded string. In practice that is a field-by-field mapping from your ad server response and each demand partner's payload to the four disclosures, a fallback rule for when a partner returns nothing, which is to withhold the impression rather than print something untrue, Article 26(3) enforced as a filter on targeting inputs rather than as a clause in your advertiser terms, and Article 28(2) applied wherever you hold a reasonable-certainty signal about a minor. The piece platforms miss: Self-serve advertising makes you a hosting service for the creative. When you reject a submitted ad, that rejection is a statement of reasons under Article 17 and belongs in the Commission's DSA Transparency Database under Article 24(5). Most self-serve review queues were built as trust and safety tooling with no export at all, and the fix is a schema decision made once, early, inside the review tool, rather than a scraping job bolted on afterwards. If designation is on the horizon: The Article 39 ad repository gets designed before 45 million average monthly recipients, not after. It is public, queryable by advertiser, machine-readable, and holds each ad for a year past last display, including ads pulled for breaching your own terms. An ad server that never persisted creative assets cannot grow this feature. It needs a store, and that is a quarter of backend work, so the decision belongs in this year's roadmap rather than in the month after the letter arrives. DMA, honestly: Most buyers here are not gatekeepers. They sit on the other side of Articles 5(9) and 5(10) as advertiser or publisher, entitled to daily per-ad price and fee reporting from the designated platforms. I write the request, read what comes back, and tell you what is missing from it. If you are the gatekeeper, you already have counsel and I am not it. Not included: Content moderation policy, trusted flagger onboarding, and the Article 16 notice-and-action pipeline, unless the object being flagged is an ad. Systemic risk assessment under Articles 34 and 35. Filings or correspondence in my name with the Commission or your Digital Services Coordinator. Age verification vendor procurement: I will tell you why a signal-based default beats an identity check for Article 28 and I will not run the tender. Who should not book this: Platforms wanting a letter that says compliant. Nobody issues that, and it would not survive the first look at your ad payload. Also teams whose ad stack is one vendor's closed SDK with no access to the response. If you cannot read what the partner returns, no disclosure you write is true, and the first conversation is with the partner, not with me.