EU Bans Profiling Ads to Minors and Ads Based on Sensitive Data

What Changed

On February 17, 2024, the EU's Digital Services Act (DSA) began applying to all online platforms with users in the EU, apart from businesses with fewer than 50 staff and turnover under €10 million. The largest platforms, with more than 45 million users a month in the EU, had been covered since August 2023.¹

Three of its rules change how advertising works on those platforms:¹

• No profiling ads to minors. Platforms can't target minors with ads based on profiling or on their personal data.
• No targeting on sensitive data. Ads can't be targeted at anyone using sensitive data, such as political or religious beliefs or sexual preferences.
• Ad transparency. Users must be told why they're seeing an ad and who paid for it.

The largest platforms must also publish a repository of their ads, showing each ad's content, who it targeted and who paid for it, searchable by the public.²

Enforcement

The Commission enforces the rules for the largest platforms itself, with fines of up to 6% of worldwide annual turnover. In preliminary findings in May 2025, it told TikTok that its ad repository didn't show ads' content, who they targeted or who paid for them.² In December 2025 TikTok made binding commitments to fix it, including showing advertisers' targeting criteria and aggregated data on who each ad reached, by age group, gender and country.³ In December 2025 it fined X €120 million, in its first non-compliance decision under the DSA, partly because X's ad repository left out the content and topic of ads and the legal entity paying for them.⁴

Why It Mattered

The DSA moved some targeting limits out of the consent banner and into platform rules. Under GDPR, people can decline tracking; under the DSA, some targeting is off the table even when they agree. For minors and sensitive categories, no consent setting brings it back.

It sits alongside the EU's other platform law, the Digital Markets Act, which made Meta offer less personalized ads. The DMA governs how the largest platforms combine people's data; the DSA governs which ads any platform may show, to whom, and how openly.