DSA and DMA Readiness for Ad-Funded Platforms

Article 26(1) asks for four things on every ad: that it is an advertisement, on whose behalf it is presented, who paid for it where that is a different person, and meaningful information about the main parameters used to select this particular recipient together with how to change them. Most transparency panels we open ship the first two. The fourth is where the engineering sits, and it is the one a Digital Services Coordinator asks about first. The platform side: This is the work if you run an online platform in the DSA sense: a marketplace, an app store, a social product, a forum carrying ads, a listings site. We go through the obligations that attach to your size and type rather than the whole regulation. The notice and action mechanism under Article 16, and whether yours produces a statement of reasons a machine can read. Submission of those statements to the Transparency Database, which is where non-compliance becomes publicly visible without anybody investigating you. The Article 26(3) prohibition on ads based on profiling using special category data, which in practice means auditing which audience segments your ad server will accept rather than which ones your policy forbids. The Article 28(2) ban on profiling-based ads to a recipient you know with reasonable certainty to be a minor, and what reasonable certainty can mean without building an age verification wall you do not want. Contact points, a legal representative if you are established outside the Union, and the transparency report with the counts you will need to have been keeping. The buying side: Most clients are not gatekeepers and never will be, but they buy from several. Here the work is different. What the Article 5(2) consent requirement did to cross-service data combination and therefore to your audience strategy. What Article 6(8) entitles you to in performance measurement tools and verification data, and how to request it rather than accept the default export. What the daily price and fee disclosure under Article 5(9) and 5(10) lets you check in an invoice you currently take on trust. This half frequently pays for the engagement on its own. What we hand over: A per-obligation table with the article, your current state, the evidence we saw, and the change required, ordered by how quickly an authority would find it. A specification for the ad transparency panel down to field wording and placement relative to the ad. A statement-of-reasons payload tested against the Transparency Database schema. And a written note on every obligation we think does not apply to you, argued so it survives being read by somebody who wants it to apply. Explicitly not in scope: Content moderation policy design and trust-and-safety staffing. The systemic risk assessment regime under Articles 34 and 35, which attaches to very large platforms; if it attaches to you, you need several firms and none of them is this one. We do not draft your terms of service, and we do not represent you before a Coordinator or the Commission. Wrong fit: You are pre-launch and want the compliance shape decided before the product is. You want a certificate. Or Article 33 designation is a live question for you, in which case the ad repository alone is larger than this engagement. Who does the work: The same two people throughout, one reading the regulation and one reading your ad server. We refuse to split that, because every finding in this work lives in the gap between the two.