Brussels, Belgium, 31st October 2025 – IAB Europe, together with Alliance Digitale, BVDW, IAB Italia, IAB Polska, IAB Spain, and SPIR, has submitted a joint response to the European Data Protection Board’s (EDPB) public consultation on its draft Guidelines 3/2025 on the interplay between the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR).
We welcome the opportunity to provide feedback on this important guidance which aims to clarify how two cornerstone pieces of EU legislation - the DSA and the GDPR - interact in practice. However, we are concerned that the draft Guidelines were developed without the involvement of the Digital Services Coordinators (DSCs), the European Board for Digital Services (EBDS), or the European Commission.
We believe that effective and coherent implementation of the DSA and the GDPR requires close coordination between all competent regulators, as the EDPB itself emphasised in its Helsinki Statement. We therefore encourage the EDPB to revise the draft Guidelines to ensure appropriate consultation with relevant regulators, and to refrain from interpreting substantive provisions of the DSA that fall outside its competence.
Key Points of Our Response
1. Automated Decision-Making and Advertising
The draft Guidelines suggest that personalised advertising could, in some cases, fall within the scope of automated decision-making under Article 22(1) GDPR. We ask the EDPB to clarify that advertising – including personalised advertising – does not, in itself, constitute automated decision-making producing legal or similarly significant effects on users. Advertising is fundamentally distinct from decisions such as credit scoring or employment selection and should not be treated as such under the GDPR.
2. Legal Grounds and Security Obligations for Article 26 DSA
Article 26(1) of the DSA requires online platforms to provide meaningful information about advertisement targeting and funding, creating obligations that may involve processing personal data. While the DSA imposes direct obligations only on platforms, third-party companies that support ad placement may also process data to enable compliance. The draft Guidelines should clarify that such processing can rely on the legal obligation basis or, alternatively, on the legitimate interests basis, given the clear regulatory purpose and straightforward necessity and balancing tests. Although technical and organisational safeguards must be applied to such processing, the EDPB should recognise that access to personal data by third parties is not prohibited if it is limited to compliance purposes, respecting the GDPR principles of purpose limitation, data minimisation, and security.
3. Scope of Special Categories of Data
Although recent CJEU rulings have broadened the interpretation of “special categories data” under Article 9 GDPR, we caution against an overly expansive approach that could create unnecessary complexity for legitimate processing activities, such as brand safety. We recommend that the EDPB clarify that intent and actual inference must both be present for processing to fall within Article 9’s scope.
4. Proportionality in Age Verification
We call on the EDPB to adopt a risk-based and proportionate approach to age assurance, consistent with the GDPR and the Commission’s Article 28 DSA Guidelines. A flexible approach is essential to allow platforms to implement effective and context-appropriate measures for protecting minors online.
5. Cooperation Between Regulators
Finally, we emphasise the need for structured cooperation between Data Protection Authorities (DPAs), Digital Services Coordinators (DSCs), the European Board for Digital Services (EBDS), and the European Commission. The draft Guidelines should refrain from interpreting substantive DSA provisions beyond the EDPB’s remit and focus instead on clarifying GDPR obligations where personal data processing is concerned. Enhanced coordination is essential to avoid duplicative proceedings and ensure consistent enforcement.
The response to the public consultation can be found here. For more information, please contact Ninon Vagner - vagner [at] iabeurope.eu / Lauren Wakefield - wakefield [at] iabeurope.eu
