Chapter 3|Due Diligence Obligations - Online Platforms|📖 7 min read
1. Providers of online platforms that present advertisements on their online interfaces shall ensure that, for each specific advertisement presented to each individual recipient, the recipients of the service are able to identify, in a clear, concise and unambiguous manner and in real time:
(a) that the information is an advertisement, including through prominent markings, which might follow standards pursuant to Article 44;
(b) the natural or legal person on whose behalf the advertisement is presented;
(c) the natural or legal person who paid for the advertisement if that person is different from the natural or legal person referred to in point (b);
(d) meaningful information directly and easily accessible from the advertisement about the main parameters used to determine the recipient to whom the advertisement is presented and, where applicable, about how to change those parameters.
2. Providers of online platforms shall provide recipients of the service with a functionality to declare whether the content they provide is or contains commercial communications.
3. Where recipients of the service use the functionality referred to in paragraph 2, providers of online platforms shall ensure that other recipients of the service can identify, in a clear, concise and unambiguous manner and in real time, that the content provided by those recipients is or contains commercial communications, including through the use of prominent markings, which might follow standards pursuant to Article 44.
4. Providers of online platforms shall not present advertisements to recipients of the service based on profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679 using special categories of personal data referred to in Article 9(1) of Regulation (EU) 2016/679.
Understanding This Article
Article 26 creates comprehensive advertising transparency requirements for online platforms, addressing three distinct but related issues: (1) platform-served ads must be clearly labeled with advertiser information and targeting explanations; (2) user-generated commercial content must be identifiable; (3) targeting based on sensitive personal data is absolutely prohibited.
Paragraph 1's requirements apply to EVERY ad shown to EVERY user in REAL TIME. This isn't a general policy disclosure - it's per-advertisement transparency. When Facebook shows you a specific ad, you must be able to immediately identify: (a) that it's an ad (not organic content), (b) who the advertiser is (Nike, Coca-Cola, etc.), (c) who paid if different (advertising agency paid on behalf of Nike), and (d) why you're seeing this ad (targeted based on age 25-34, interest in running shoes, location in Munich).
'Clear, concise and unambiguous' means users should understand ad disclosure without effort or confusion. Tiny 'Sponsored' text in low-contrast gray isn't compliant. 'Prominent markings' suggests visual distinction - borders, labels, icons - making ads obviously identifiable at a glance.
Paragraph 1(d)'s 'meaningful information' about targeting parameters is crucial transparency. Platforms must explain not just that targeting occurred, but WHAT parameters were used: demographic data (age, gender, location), behavioral data (purchase history, browsing behavior), interest inferences, remarketing, lookalike audiences, etc. Users deserve to know WHY they're seeing specific ads - what about their profile or behavior triggered ad delivery.
'How to change those parameters' requires platforms to enable users to modify targeting - opting out of certain categories, adjusting ad preferences, limiting data use for targeting. If YouTube targets ads based on search history, users should be able to disable search history targeting.
Paragraphs 2-3 address influencer marketing and user-generated commercial content. When Instagram users post sponsored content, TikTokers promote products, or YouTubers include paid integrations, they must declare it. Platforms must provide declaration tools and ensure declared commercial content is clearly labeled to viewers. This prevents 'native advertising' where paid promotions masquerade as authentic user content.
Paragraph 4 is THE sensitive data protection. Platforms CANNOT show targeted ads based on 'special categories' of personal data under GDPR Article 9(1): racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification, health data, or sex life/sexual orientation data. This absolute prohibition prevents discriminatory targeting and protects privacy regarding sensitive attributes. If Facebook infers you have depression based on posts, it cannot target mental health treatment ads using that inference.
The prohibition on sensitive data profiling protects both discrimination concerns (preventing ads from being shown/hidden based on race, religion, etc.) and privacy concerns (preventing exploitation of health data, political beliefs, sexual orientation for commercial targeting).
Key Points
All ads must be clearly and prominently labeled as advertisements in real time
Users must see who the advertiser is (on whose behalf ad is presented)
Must disclose who paid for ad if different from advertiser
Must provide meaningful information about targeting parameters used
Must explain how users can change their targeting parameters
Platforms must provide functionality for users to declare commercial content
User-declared commercial content must be clearly marked to other users
ABSOLUTE prohibition on targeted ads using sensitive personal data (race, health, religion, politics, etc.)
Transparency requirements apply per-ad, in real-time, for each user
Practical Application
For Social Media Ads: When Instagram shows a Nike running shoe ad, users must see: (1) Prominent 'Sponsored' label at top; (2) 'Nike' identified as advertiser; (3) If advertising agency paid, 'Paid by AdvertisingAgency on behalf of Nike'; (4) Expandable 'Why am I seeing this ad?' showing 'You're seeing this because: age 25-34, interest in fitness, recently viewed running content, location in Germany.' (5) Link to 'Manage ad preferences' where you can opt out of fitness-based targeting or limit location use.
For Search Ads: When Google shows sponsored search results, each ad must have clear 'Ad' label, advertiser identity visible, and 'Why this ad?' link explaining 'This ad was matched to your search query [running shoes] and your location [Berlin].' Users can click through to manage whether location affects ads.
For Programmatic Ads: When YouTube shows programmatic display ad, the ad must show: '[Ad]' label, advertiser name (even if buying through ad exchange), and targeting explanation. If user was targeted via remarketing (visited advertiser's website previously), that must be disclosed: 'You're seeing this because you visited ExampleShop.com within the last 30 days.'
For Influencer Content: When YouTube creator posts sponsored video, they use YouTube's built-in declaration tool marking video as 'Includes paid promotion.' YouTube then displays prominent 'Includes paid promotion' label on video thumbnail, player, and description. Viewers immediately know content is commercial, not purely editorial. Creators who fail to declare sponsorships violate both Article 26 and potentially platform terms.
For Instagram Sponsored Posts: When influencer posts sponsored Instagram story, they tick 'Paid Partnership with [Brand]' declaration. Instagram displays 'Paid partnership with Nike' at top of story, ensuring followers recognize commercial nature. Without declaration, followers might think genuine product recommendation when it's actually paid advertisement.
For TikTok Brand Deals: TikTok creator makes video featuring product. Creator uses TikTok's 'Branded Content' toggle. TikTok displays 'Paid partnership' label on video. Viewers seeing the video know it's commercial content, enabling informed consumption. This transparency prevents deceptive 'native advertising' where paid promotions appear as authentic content.
For Sensitive Data Prohibition: Facebook analyzes posts suggesting user has diabetes (discusses insulin, blood sugar monitoring). Under GDPR, this is health data. Article 26(4) ABSOLUTELY PROHIBITS Facebook from using this for ad targeting - Facebook cannot show diabetes medication ads, glucose monitor ads, or diabetes-related content based on this health data inference. Even if user might benefit from relevant ads, the sensitive data protection takes precedence.
For Political Targeting: Twitter analyzes tweets suggesting user is politically conservative. Political opinions are sensitive data under GDPR Article 9(1). Article 26(4) prohibits Twitter from targeting political ads based on inferred political orientation. Political campaigns cannot micro-target 'conservatives aged 45+' using Twitter's profiling. They must use non-sensitive parameters like general interest categories or geographic targeting.
For Health Ads: YouTube user watches many pregnancy-related videos. YouTube might infer pregnancy (health data). Article 26(4) prohibits using this for targeted ads - cannot show pregnancy product ads, fertility treatment ads, or pregnancy-related targeting based on inferred health status. Advertisers can still show these ads using non-sensitive targeting (e.g., 'women aged 25-40 who watched parenting content' without health data inference).
For Religious Targeting: If Instagram infers user's religion from followed accounts or posted content (religious or philosophical beliefs are sensitive data), Article 26(4) prohibits using this for targeting. Religious organizations cannot target ads to 'Muslims' or 'Christians' using platform's profiling. They must use general parameters like 'interested in religious content' without specific religious categorization.
For Sexual Orientation: Dating app analyzes behavior and infers user is gay (sex life/sexual orientation data). Article 26(4) absolutely prohibits using this for ad targeting. LGBTQ+ focused advertisers cannot target based on inferred sexual orientation. They must use self-selected interest categories ('LGBTQ+ community,' 'Pride events,' etc.) where users actively opt in, not passive profiling.
For IAB Standards: The Interactive Advertising Bureau (IAB) Europe developed technical specifications for Article 26 compliance, enabling standardized ad transparency across platforms. Advertisers and platforms can adopt these standards ensuring consistent disclosure format: machine-readable ad labels, standardized targeting parameter explanations, uniform commercial content declarations. Article 44 authorizes the Commission to endorse such industry standards.
For Non-Compliant Ads: A platform shows ads with only tiny 'Sponsored' in light gray text, doesn't identify advertiser (just 'Click here!'), provides no targeting explanation, and uses health data for targeting. This violates all Article 26 requirements: insufficient labeling (not prominent), no advertiser disclosure, no targeting transparency, prohibited sensitive data use. Regulators can impose fines, require immediate compliance changes, and potentially order temporary ad suspension until compliance achieved.