Digital Services Act – Advertising Repository Guidelines

1. The guidelines are overdue: two years of self-designed repositories have failed

Article 39 DSA has applied since February 2024, and the enforcement record is unambiguous. The first DSA non-compliance decision (X, 5 December 2025) confirmed a breach of Article 39: missing advertisement content and payer information, access barriers, no searchable and reliable tool. Preliminary findings against TikTok (May 2025) documented missing content, targeting and funding data; the binding commitments that followed (24-hour updates, targeting criteria, reach per member state) show what the Commission has to negotiate piece by piece where no uniform structure exists. The Meta Ad Library and the Google Ads Transparency Center have never been formally examined under Article 39 at all – Google’s repository is searchable by advertiser only, and its bulk transparency data lags by roughly ninety days.

Independent scoring today finds that not one repository fully delivers five of the eleven Article 39 requirements: who paid, how advertisements were targeted, searchability, API access, and currency of data. The lesson is structural: where the platform designs the repository, the repository protects the platform. GISAD welcomes the announced guidelines, but they must not become a collection of best practices. They should close the design discretion that made case-by-case enforcement necessary in the first place. Deadlines protect no one; structure protects.

2. Searchability requires a stable, standardized taxonomy – not free text

Multicriteria queries only work if the fields and values mean the same thing on every platform. The guidelines should define a uniform minimum structure for all VLOP and VLOSE repositories: verified advertiser identity, the payer where different, the period of presentation, the targeting parameters including the parameters used to exclude groups, and reach broken down per member state – a decisive field for the integrity of elections.

Targeting parameters in particular must be disclosed from a stable, machine-readable taxonomy. Free-text labels such as “interests” or “demographics” cannot be compared across platforms or over time; a dynamic, self-invented label system makes every repository an island. GISAD’s experience with category systems is: transparent categories with validated assignments, condensed once and then kept stable, are the only basis on which search, research and supervision can build. Search must cover the content of the advertisement itself – creative, product, subject matter – not only the advertiser. An advertiser lookup is not a search.

3. API access without barriers – transparency must not profile its users

API access is a legal requirement of Article 39(1), not a courtesy. The guidelines should make explicit what follows from it: no registration walls, no login obligations, no rate limits that make systematic research impossible. Access to a transparency tool must not itself become a data source about who is scrutinizing. Query metadata, where kept at all, must be anonymous and aggregate – interoperability is not linkability. The door to participation must not be behind a door to identity verification.

The repositories should furthermore offer documented, machine-readable schemas and bulk export. The one-year retention window applies to the platform’s obligation, but rolling windows destroy longitudinal research. Independent mirroring and archiving by researchers and civil society must not be obstructed technically; it is part of public scrutiny that Article 39 exists to enable.

4. Completeness must be measurable – accuracy is not a self-attestation

Article 39(1) demands “reasonable efforts” to ensure the information is accurate and complete. Reasonable is only what can be verified. The guidelines should therefore define measurable indicators: updates within 24 hours as the general standard (already a binding commitment for TikTok – a single platform must not hold a better record than the rule), completeness statistics on the share of entries with full payer and targeting data, and reconciliation against the platform’s own delivery and billing data.

Verification must be possible outside the manipulable area: independent audits with published methodology, not platform self-grading. Concept fidelity is created by measurement, not by examples. And whoever is audited must be auditable: platforms should keep an examinable protocol of repository operations – omissions, delays, corrections – so that supervision can reconstruct not only what the repository shows, but how it was made.

5. Removals must remain part of the record

Under Article 39(3), removed advertisements lose their content, advertiser and payer entries, but the removal itself stays in the repository. The guidelines should standardize this: machine-readable reason codes distinguishing removals under own terms, for illegal content, and on the order of a competent authority, with the legal basis stated. A repository that lets removed advertisements vanish without a trace launders moderation out of the record. The patterns that matter for systemic risks – scam advertisements repeatedly approved, funded and removed – must remain visible and countable.

6. The repository documents profiling – it does not cure it

An honest frame matters: Article 39 makes targeting visible; it does not limit it. The repository should therefore feed directly into systemic-risk supervision under Articles 34 and 35 – targeting of proxy attributes for minors, sensitive proxy categories, and reach spikes during election periods are patterns the repository itself reveals and the supervisor should act upon.

The structural alternative remains advertising that needs no profiles: contextual, category-based advertising, and payment models beyond the sale of attention. Minors should not be profiled for advertising at all – no repository can undo that. Whoever sells attention also sells the quarrel; the amplification economy is documented by the repository, not ended by it. The guidelines should say so plainly, because they will otherwise be read as what they must not be: proof that the problem is solved.

What GISAD recommends

1. A uniform, testable minimum structure for all VLOP and VLOSE repositories – field by field, closing design discretion.
2. A stable, standardized taxonomy for targeting parameters, including exclusion parameters; search over advertisement content, not advertiser lookup only.
3. Open APIs without registration or identity barriers; no profiling of repository users; bulk export for independent archiving.
4. Measurable completeness: 24-hour updates, reconciliation and completeness indicators, independent audits with published methodology.
5. Standardized removal reason codes – moderation remains part of the record.
6. Repository data as a standing input into systemic-risk supervision, and a clear statement that transparency documents profiling rather than legitimizing it.