On 4 November 2026, the European Commission opened a call for evidence (running until 2 December 2026) on upcoming technical guidelines for the advertising repositories („ad libraries“) that very large online platforms and search engines must maintain under Article 39(3) of the Digital Services Act. The guidelines are to advise on how repositories can be made easily searchable, how insights into targeting and reach can be provided, and how the content of advertisements can be made accessible. A targeted consultation on the draft will follow in 2027; publication is planned for the second quarter of 2028.

1. Guidelines overdue, timetable too long

The repository obligations have applied since August 2023 – for three years, enforcement has taken place without a yardstick: a fine here, binding commitments there, every platform a special case. Non-compliance has already been sanctioned in individual proceedings (the EUR 45 million fine against X for its non-compliant advertising repository; TikTok’s binding commitments of 5 December 2025). Even TikTok itself criticised that guidance was being delivered through preliminary findings rather than clear, public guidelines. Guidelines arriving in Q2 2028 would mean five years of obligations without binding functional criteria. What is needed are binding interim benchmarks – searchability, completeness, timeliness – that can be benchmarked and independently measured. Deadlines do not protect; structure protects.

2. Searchability as a measurable criterion, not a claim

The guidelines must define minimum requirements: multi-criteria search across all mandatory fields (the party on whose behalf the advertisement was presented, the payer, the period, the targeting parameters, reach per Member State), an open API without registration hurdles, complete data records (creative content including destination URLs, not placeholders), and publication of fresh entries within 24 hours – the TikTok commitments show that all of this is achievable. The door to participation must not stand behind a door to identity verification – neither for researchers, nor for civil society, nor for citizens without an institutional budget.

3. One data structure instead of 25 incompatible archives

Every platform currently builds its own format; anyone who wants to examine advertising across Europe has to learn 25 interfaces. For political advertising, a common data structure with standardised metadata and API logic already exists (Implementing Regulation (EU) 2026/818). The same standard logic must be transferred to the DSA advertising repositories so that cross-cutting analyses – scams, disinformation campaigns, misleading commercial practices – become possible in the first place.

4. Transparency of advertising, not of people

Article 39(1) of the DSA rightly prohibits personal data of the recipients to whom an advertisement was or could have been presented – the guidelines must operationalise this: evaluation and researcher access without recipient profiles, no correlation identifiers across platform boundaries – interoperability is not linkability. And: removals and deletions in the repository under Article 39(3) must remain traceable and logged – whoever audits must be auditable themselves – otherwise a transparency hole opens up precisely for the most problematic content.

5. Participation instead of an expert tool

Advertising repositories are public instruments of scrutiny, not tools for a small circle of vetted researchers. Search interfaces must be multilingual and usable by citizens without programming skills – participation instead of instruction.

6. The archive shows the advertising, not the structure

A repository reveals who paid and who was meant to be reached – it does not measure how recommender systems amplify advertising and organic content. This amplification must be named in the guidelines as a separate, measurable risk point; otherwise transparency stops at the cheque and never reaches the system. Whoever sells attention also sells the conflict – the structural answer to that (categories instead of profile feeds) must be pursued beyond the advertising repository.

The initiative in brief

In May 2026 the Commission opened a call for evidence for a targeted legislative initiative – expected as a directive – to adjust the EU copyright framework for the competitiveness of the creative sectors and for innovation, in parallel to the Article 30 review of the Copyright in the Digital Single Market Directive (EU) 2019/790. A legislative proposal is provisionally scheduled for the first quarter of 2027. The initiative covers four areas: challenges faced by creators linked to artificial intelligence, including licensing between rightsholders and AI providers and AI-generated imitations of performers; online piracy of time-sensitive content including live events; the remuneration of music performers and producers for sound recordings of third-country nationals; and the use of protected content in scientific research, with a possible EU-wide secondary publication right. Building on this call, the Commission launched a targeted consultation on 29 September 2026. The context is well documented: the text and data mining opt-out of Article 4(3) has not delivered on its central promise – rightsholders who opted out struggle to enforce their rights, to license and to be remunerated – while the AI Act obliges providers of general-purpose AI models to comply with EU copyright law and to publish training-data summaries, and machine-readable opt-out protocols are being developed with the support of the EUIPO.

Five points GISAD recommends

1. An opt-out that nobody reads is not an exercise of rights. On paper, the TDM opt-out gives rightsholders control; in practice it is a leaf in the wind. Machine-readable, standardised opt-out protocols must be mandatory, not optional. And the training-data summaries under Article 53 of the AI Act must be verifiable: whoever verifies must be verifiable themselves. Logging at a neutral instance, examination outside the manipulable area.

2. Structural remuneration instead of gatekeeper licensing. Small rightsholders must not be left to individual negotiations with AI corporations – negotiations they lose. Collective licensing, collecting societies and micropayment infrastructures turn remuneration into structure. Participation applies to creators as well.

3. AI imitation of performers: structure instead of hindsight. AI-generated fakes must be recognised structurally, not litigated individually: AI detects AI fakes at the point of publication, and every publication carries a signed instance number – responsibility becomes assignable without building profiles. Concept fidelity arises through measurement, not through examples.

4. Live-event piracy without filters 2.0. Enforcement is right – but the answer must not be a revival of the upload-filter debate. Structure instead of filters: signed transmission paths and provenance evidence, while the audience remains WAN-anonymous. Filters recognise copies – structure recognises origin.

5. Research as an infrastructure of participation. Preserve the TDM research exception, harmonise the InfoSoc research exception across the EU and introduce a binding EU-wide secondary publication right; contractual circumvention of research exceptions must be ineffective. Knowledge is infrastructure – access to it decides participation, including in the 2,500 written languages for which GISAD’s companion project getmySense develops translation capability.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: Targeted initiative for a better copyright environment for European creativity and innovation · European Commission – Call for evidence on the review of EU copyright rules · European Commission – Targeted consultation on the effect of technology on copyright

The initiative in brief

With proposal COM(2025) 838, adopted on 19 November 2025, the European Commission proposes a regulation establishing European Business Wallets: a secure digital tool with which companies, the self-employed, sole traders and public sector bodies can identify and authenticate themselves across all Member States, hold and present attestations issued by authentic sources, sign, seal and timestamp documents with legal effect, manage mandates given to authorised representatives, and exchange legally valid notifications through a qualified electronic registered delivery service.

Use of the wallet is voluntary for economic operators. All public sector bodies, by contrast, will be obliged to accept it for identification, signing, document submission and notifications. A European Digital Directory will support discoverability without centralising data, and the European Unique Identifier (EUID) is designated as the identifier of wallet owners. The Commission estimates savings of up to €150 billion per year if the wallet is widely adopted. The Council adopted its negotiating position on 9 June 2026; the European Parliament’s ITRE committee followed on 10 September 2026, adding requirements that wallet providers and their cloud infrastructure be established in the EU and that data be stored and processed exclusively on EU territory. A political agreement is targeted for the end of 2026.

What GISAD welcomes

The European Business Wallet transfers the logic of the citizen wallet – decentralised storage, attestations from authentic sources, once-only submission instead of repeatedly presented paper evidence – to the economic operator. This addresses precisely the level at which Trusted WEB 4.0 aims to integrate businesses into a sovereign European digital system. The division of roles is correct: freedom of provision and of use for companies, obligation to accept for public administrations. A directory that finds without storing, notifications with provable single-step delivery, and legal equivalence of digital actions are structure, not bureaucracy.

Five corrections GISAD recommends

1. The identity card of a company must not become a movement profile of its trade. The proposed obligation to log all transactions – including those that were not completed – would, if centrally evaluable, produce a complete traffic profile of European economic life. Logs are legitimate for traceability, but they must be data-minimal, exempt from cross-transaction analysis, and kept under transaction numbers that can only be linked internally.

2. Interoperability is not linkability. The EUID, carried through every presentation and every notification, would act as a universal correlation marker across the entire business traffic of a company. GISAD recommends a one-time, signed proof of authorisation deposited with a neutral instance, followed – wherever a mere attribute suffices – by WAN-anonymous verification: identity only where identity is needed.

3. Representation without permanent person profiles. Companies act through natural persons; the binding of an action to the entity must not create a permanent, gapless profile of the persons acting. Signed instance numbers per mandate, with limited duration and single-step scope, instead of standing powers of attorney with complete person correlation.

4. Measure sovereignty instead of declaring it. The ITRE requirement that wallet, delivery-service and cloud providers be established in the EU and process data exclusively on EU territory points in the right direction – but a seat in the EU is not sovereignty; the structure is. Shareholding constructions can circumvent formal seat criteria. GISAD recommends a measurable origin and operator criterion: no US hyperscalers in the critical infrastructure of the wallet ecosystem.

5. SME participation as the success criterion. The wallet must not become a gatekeeper instrument for small European providers. Onboarding simplicity, open standards (ETSI), and verification costs that micro-enterprises and sole traders can bear will decide adoption. Participation instead of new thresholds: the wallet serves the single market only if the smallest operators can use it without depending on a few large providers.

GISAD – Global Institute for Structure relevance, Anonymity and Decentralisation · Registered in the EU Transparency Register, No. 244298340978-40

Sources: European Commission – Have your say: European Business Wallet · Proposal COM(2025) 838 (EUR-Lex) · European Commission – European Business Wallets

What has been decided

Following a public consultation and call for evidence from 22 July to 29 September 2025 – accompanied by multi-stakeholder consultations between November 2024 and October 2025 in which more than 6,300 children took part via the EU Children’s Participation Platform – the Commission adopted the Action Plan against Cyberbullying on 10 February 2026, announced in President von der Leyen’s political guidelines 2024–2029. Around one in six adolescents reports having been a victim of cyberbullying, one in eight admits to having taken part; cyberbullying has been the leading reason for calls to the helplines of the Safer Internet Centres for five years. The plan does not introduce new EU criminal-law measures. It rests on three pillars:

• A coordinated EU approach: Member States are invited to develop national cyberbullying policies based on a common understanding; targeted enforcement of existing law, including the Digital Services Act and the AI Act against deepfake bullying.
• Prevention and awareness: review of the Commission’s guidelines for educators on digital literacy as part of the Union of Skills; expanded resources and training via the Safer Internet Centres.
• Reporting and support: an EU-wide blueprint for an online safety app – modelled on France’s „3018“ app – allowing young victims to report incidents to national helplines, store evidence securely and receive tailored assistance.

GISAD’s assessment

1. The plan treats the symptoms professionally – the causal structure remains untouched. Reporting apps, helplines and evidence preservation help yesterday’s victim. But the architecture that fuels cyberbullying remains: recommendation algorithms that turn escalation into reach and engagement into revenue. Categories instead of feeds – the Finder search logic – would remove the amplification machine from the equation. Without that step, the plan remains reactive.

2. The reporting app is right – but it must not become a honeypot. Reports from bullying victims are among the most sensitive data that exist. The app needs Truststation principles: a one-time signed proof of eligibility, then WAN-anonymous reporting; decentralised rather than central storage; evidence immutably signed but not linkable to the victim. Victim anonymity lowers the reporting threshold – precisely the gap that children identified in the consultations.

3. Age verification without profiling. The age verification blueprint and the debate on age limits must not become an instrument of data collection. Proof of age without disclosure of identity – WAN anonymity, Truststation key sets – protects minors without measuring them. An age check must not become a profile.

4. Anonymity is not the enemy – structure is. Cyberbullying is readily blamed on anonymity. But anonymity also protects the victims – from fear of retaliation when reporting. The answer is not surveillance identity, but structure: no cookies, no data trail, the personality protection concept of the Trusted WEB 4.0; accountability through signed instance numbers rather than total disclosure.

5. Deepfake bullying: enforcement is necessary, but reactive. The structural answer to injected fakes is verification at the source – the Finder Fake Switch, combining AI screening with multi-language human assessment – before content goes viral, not only afterwards through AI Act labelling rules.

6. Child participation as participation, not tokenism. Hearing more than 6,300 children is exemplary. The step beyond the Union of Skills guidelines: digital literacy as access to the system – participation instead of admonition, in 2,500 written languages.

7. Platform design must be held responsible. The findings on online violence against girls show perpetrators following victims across platforms. Here too: make the design liable, not only the individual perpetrators.

What has been decided

Commission Implementing Regulation (EU) 2026/1735 of 15 July 2026 amends Implementing Regulation (EU) 2025/1569, which lays down the rules for qualified electronic attestations of attributes (QEAAs) and for attestations issued by or on behalf of public sector bodies responsible for authentic sources. The reason: the Architecture and Reference Framework for the European Digital Identity Wallet has evolved significantly, and the regulation is being aligned with the new standards and specifications. The draft was published on 5 February 2026 with a feedback period until 5 March 2026; the European Data Protection Supervisor delivered his opinion on 17 April 2026. The regulation was published in the Official Journal on 22 July 2026 and entered into force on 11 August 2026; Article 1(3) applies only from 1 January 2027.

• Article 3(2): attestations must comply with the schemes for the attestation of attributes, where applicable.
• Article 4: updated rules on the circumstances of revocation and on the use of privacy-preserving techniques.
• Article 9: specifications for verification mechanisms and requirements for the signing and sealing of verification results against authentic sources.
• Annexes I–IV: updated reference standards, including ETSI TS 119 471 and ETSI TS 119 478.

The regulation is one of three framework updates adopted on 15 July 2026 – alongside Implementing Regulation (EU) 2026/1730 on the registration of relying parties and Implementing Regulation (EU) 2026/1731 on the four core wallet regulations. Articles 6 to 9 of Regulation 2025/1569 have been applicable since 19 August 2026: the list of public sector bodies issuing attestations, the European catalogue of attributes and the catalogue of attestation schemes. The deadline for Member States to provide the wallets remains 24 December 2026.

GISAD’s assessment

1. Attestations are a step in the right direction. Proving „over 18“ or „diploma held“ without handing over an identity document corresponds to the border rule of the EU-D-S: identity only where identity is necessary. Selective disclosure and data minimisation are bindingly anchored here. GISAD expressly welcomes this.

2. Verification must not become a movement profile. Revocation checks and verification against authentic sources create central touchpoints: who queries which status, and when? Article 4 points the right way with privacy-preserving techniques – but this must be made measurable. Revocation status must be obtainable without identifying the holder (Truststation key sets), verification queries must remain WAN-anonymous, and no central movement profiles may be created. A verification confirms a characteristic – it must not survey the holder.

3. Signed verification results – an opportunity with a flip side. Signing and sealing verification results makes the check itself traceable – close to the GISAD principle that measurement must take place outside the manipulable area. But a signed verification result is also a linkable artefact. Transaction numbers that can only be assigned internally are needed, so that proof does not become a correlation feature between providers. Interoperability is not linkability.

4. Open European standards are positive – but the reference base keeps moving. ETSI openness stands for structure instead of vendor lock-in. However, with Article 1(3) applying only from 1 January 2027, parts of the reference standard move beyond the wallet launch date of 24 December 2026. Transitional rules must ensure that no backward-compatibility trap arises.

5. Three acts on one day, one ecosystem. The updates to the registers, wallet core regulations and attestations were amended in parallel. Consistency between them is not a formality: interoperability testing must also cover WAN-anonymous use cases.

6. The attribute catalogue must not become a gatekeeper. The catalogue of attributes and schemes maintained by the Commission is practical – but schemes must remain open and reviewable for independent providers, including small European verifiers. No allowlist thinking.