The Digital Services Act changes digital marketing in three concrete ways: every advertisement on an online platform must be recognisable as such and must name the party on whose behalf it is shown, targeting on the basis of special categories of personal data and profiling-based advertising aimed at minors are prohibited, and an advertiser whose campaign or account is restricted is entitled to a reasoned decision and to an internal appeal. The regulation has applied to all providers since 17 February 2024, and in the Netherlands the Authority for Consumers and Markets has supervised it as digital services coordinator since 4 February 2025.
Where the advertiser sits in the DSA
Most of the duties in Regulation (EU) 2022/2065 rest on intermediaries: access providers, hosting services, online platforms and the very large platforms and search engines designated by the European Commission. An advertiser buying inventory is not itself an intermediary, and that is why the regulation is often filed away as somebody else problem. It is not. The obligations land on your campaigns through the platform, because the platform can only comply if you supply the information the law requires, and it enforces that through its terms of service. In practice, DSA compliance reaches the marketing department as a set of platform rules with regulatory force behind them.
There is also a real chance that your own digital estate falls within scope. A webshop that publishes customer reviews, a community forum, a comment section or a user-generated content campaign is a hosting service, and a marketplace that lets third parties sell to consumers is an online platform with the full set of duties that follows. The exemption for micro and small enterprises removes the heaviest of those obligations but not the baseline. Anyone running a campaign built on user submissions should establish which category the platform falls into before the campaign goes live rather than after the first complaint. The broader framework, including the position of intermediaries and the Digital Markets Act, is set out in our article on what the DSA and DMA mean for businesses in the Netherlands.
Advertising transparency: what every ad must disclose
Article 26 of the DSA requires online platforms to ensure that recipients can identify, for each individual advertisement and in real time, that it is an advertisement, on whose behalf it is presented, who paid for it where that is a different party, and meaningful information about the main parameters used to select the audience, together with a way to change those parameters. The duty sits on the platform, but two of those four elements can only come from the advertiser.
That has a practical consequence that catches media agencies out. Where a campaign is bought through an agency, a media buyer or a reseller, the platform still has to name the party on whose behalf the advertisement appears and the party that paid. Contracts and account structures that deliberately obscure the ultimate client are therefore in conflict with the regulation, and platforms respond by rejecting the creative or suspending the account. The same applies to affiliate arrangements in which the identity of the promoted brand is left vague.
For very large platforms there is a second layer. They must maintain a public repository of the advertisements presented on the service, with the content of the advertisement, the advertiser, the payer, the period, the targeting parameters and the number of recipients reached, and keep it available for a year after the last presentation. Competitors, journalists and regulators can therefore look at your creative, your targeting and your reach. Campaign material that relies on the audience never comparing two versions of the same message should be reviewed on that basis.
What you may no longer target on
Two prohibitions bite directly on media planning. First, an online platform may not present advertising based on profiling that uses the special categories of personal data of the GDPR: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, and genetic or biometric data used for identification. Interest segments that function as a proxy for those categories fall under the same prohibition, which is where most of the practical difficulty lies: a segment labelled by a medical condition or by a religious observance is caught even if the platform never asked the user directly.
Second, a platform may not present advertising based on profiling using personal data of a recipient when it is aware with reasonable certainty that the recipient is a minor. In the Netherlands the Dutch Data Protection Authority is the competent authority for both of these provisions, alongside the Authority for Consumers and Markets as the general supervisor, which means an advertising complaint can end up with a privacy regulator.
None of this replaces the GDPR. Behavioural advertising still needs a lawful basis, the placing and reading of cookies and similar identifiers still needs consent under the Dutch Telecommunications Act, and consent obtained through a banner that makes refusal harder than acceptance is not valid. Our overview of the General Data Protection Regulation sets out the requirements that apply in parallel.
Dark patterns and the design of the funnel
Article 25 of the DSA prohibits online platforms from designing, organising or operating their interfaces in a way that deceives or manipulates users or otherwise materially distorts their ability to make free and informed decisions. Countdown timers that reset, consent flows with a prominent accept button and a hidden refusal, subscription flows that are easy to enter and hard to leave, and repeated prompts that wear a user down are the standard examples.
For a Dutch advertiser the DSA is not the only, or even the first, source of that rule. The provisions on unfair commercial practices in Book 6 of the Civil Code already prohibit misleading and aggressive practices towards consumers, misleading advertising has its own basis in article 6:194 and comparative advertising is only permitted under the conditions of article 6:194a, and the Authority for Consumers and Markets enforces the consumer rules administratively. A campaign that would fail the Dutch unfair commercial practices test almost certainly fails the DSA interface test as well; the difference is who comes knocking and how fast.
When the platform rejects your ad or suspends your account
This is the part of the DSA that works in the advertiser favour, and it is the part that is least used. Where a platform restricts the visibility of content, suspends a service or terminates an account, it must give the affected party a clear and specific statement of reasons: what was restricted, on what ground, whether automated means were used, which clause of the terms of service or which rule of law was applied, and how to seek redress. Those statements of reasons for online platforms are also filed in a public European database, which makes it possible to see how a platform is applying a given rule across the market.
The platform must then offer a free internal complaint handling system that stays open for at least six months, in which the complaint is examined in a timely and non-discriminatory way and not solely by automated means. If that produces nothing, the advertiser can take the dispute to a certified out-of-court dispute settlement body without losing the right to go to court. Platforms must also suspend, after a warning, users who frequently submit manifestly unfounded notices or complaints, which matters for brands that are the target of coordinated reporting by competitors or activists.
Alongside the DSA there is a second instrument that is often more useful for a commercial dispute. Regulation (EU) 2019/1150 on fairness and transparency for business users of online intermediation services requires a platform to give a statement of reasons before restricting or suspending a business user, to give thirty days notice before terminating the relationship, to publish the main parameters determining ranking, to operate an internal complaint system and to designate mediators. That regulation applies to marketplaces, app stores, price comparison services and social media used for commercial purposes, and it gives a business user a direct claim before the Dutch courts. In an urgent case, an injunction requiring reinstatement can be sought in preliminary relief proceedings.
The practical lesson is that documentation decides these cases. Keep the creative, the targeting settings, the statement of reasons, the timestamps of every appeal and the platform responses. A file assembled after the fact rarely convinces a judge that the removal was arbitrary.
Selling through a marketplace: traceability of traders
If you sell through a marketplace rather than only advertise on one, the traceability rules apply to you. An online platform that allows consumers to conclude distance contracts with traders may only admit a trader once it has obtained and made reasonable efforts to verify the identification data: name, address, telephone number and electronic mail address, the payment account, the trade register number and a self-certification that only lawful products will be offered. Incomplete or unverifiable data leads to suspension, and the platform must ask again periodically.
The platform must also design its interface so that traders can meet their own information duties towards consumers before the contract is concluded, which for a Dutch seller means the pre-contractual information of Book 6 of the Civil Code, the right of withdrawal and its exceptions, and the statutory conformity rules. In other words, listing hygiene is now a regulatory matter and not only a commercial one.
What the Digital Markets Act adds for advertisers
The DMA is aimed at a small number of designated gatekeepers, and no advertiser will be designated. It nonetheless contains rights that the buy side can invoke. A gatekeeper must give advertisers and publishers, on request and free of charge, daily information about the prices and fees paid and the remuneration received for each advertisement, and it must give them access to the performance measuring tools of the service and to the data needed to carry out an independent verification of the inventory bought. It may not combine personal data from different services for advertising purposes without consent, and it may not favour its own products in ranking.
Those provisions exist to make it possible to audit a media budget rather than to accept a dashboard on trust. Requesting the data in writing, keeping the response and comparing it against the invoice is the way the right is exercised. Non-compliance can lead the Commission to fine a gatekeeper up to ten per cent of its total worldwide turnover, rising to twenty per cent for a repeated infringement, but that is the Commission remedy, not yours; the advertiser remedy is contractual and evidential.
Political and issue advertising
Advertising with a political character has its own regime. Regulation (EU) 2024/900 on the transparency and targeting of political advertising has applied since 10 October 2025. It requires political advertising to be labelled as such, to carry a transparency notice identifying the sponsor, the campaign it belongs to and the amounts paid, and to be entered in a European repository. Targeting and ad delivery techniques may only be used on the basis of personal data collected directly from the person concerned with separate, explicit consent, data obtained from third parties may not be used, and targeting of minors is prohibited.
The definition is broader than party political campaigning. A message from an interest group, a trade association or a company that is liable to influence the outcome of an election or a referendum, or a legislative or regulatory process, can qualify. Several large platforms have responded by ceasing to sell political advertising in the European Union rather than building the compliance machinery, so the practical question for a campaign with a public affairs component is often not how to comply but whether the channel is still available at all.
Dutch supervision and the national layer
The Dutch implementing act for the DSA entered into force on 4 February 2025 and designates the Authority for Consumers and Markets as the digital services coordinator, with the Dutch Data Protection Authority as the competent authority for the two advertising provisions that concern profiling. The coordinator handles complaints about providers established in the Netherlands, certifies out-of-court dispute settlement bodies and awards trusted flagger status; the European Commission remains the supervisor for the designated very large platforms. Fines under the DSA can reach six per cent of annual worldwide turnover, with periodic penalty payments of up to five per cent of average daily worldwide turnover.
Above that European layer sits an older Dutch one that marketing teams meet more often. The Dutch Advertising Code is self-regulation, but a decision of the Advertising Code Committee is public and is followed by the media, and the code contains specific chapters for social media and influencer marketing, including the requirement to disclose a commercial relationship. Video channel providers above the threshold applied by the Dutch Media Authority must register with it and are subject to the rules on advertising and product placement. A campaign can therefore be lawful under the DSA and still be found misleading under the national code. The wider Dutch digital safety picture is set out in our article on how digitally safe the Netherlands is.
What to do now
Start by classifying your own services, because the answer determines whether you are a user of the rules or a subject of them: a plain corporate website with no user content is outside the platform tiers, while a marketplace, a review section or a user-generated campaign is not. Then review the account and contract structure of your media buying so that the party on whose behalf each advertisement is shown and the party that pays for it can be stated accurately in real time. Audit your audience segments against the prohibition on special category profiling and on profiling of minors, and record why each retained segment is acceptable.
Next, look at the interfaces you control. Consent flows, subscription cancellation paths and urgency messaging should be tested against both the DSA interface rule and the Dutch unfair commercial practices provisions, since the second is enforced closer to home. Set up an internal process for platform decisions: who receives the statement of reasons, who files the internal complaint within the six month window, and at what point the dispute moves to an out-of-court body, to the platform business user procedure or to court. Finally, exercise the DMA information rights on the platforms where you spend most, because the entitlement to daily pricing and independent measurement data is worthless if nobody ever asks for it.
Law & More advises advertisers, agencies, marketplaces and platform businesses in the Netherlands on the Digital Services Act, the Digital Markets Act, the platform to business regulation and the Dutch rules on advertising and unfair commercial practices. We assess where your services fall in the tiers, draft the contractual and disclosure arrangements that go with them, and act in disputes with platforms over removals, suspensions and ranking. To discuss a campaign or a platform dispute, contact Law & More.
