EU DSA Article 26 — Political Advertising Transparency: First-Year Implementation Data Across 27 Member States

Why Article 26 Is the 2026 Compliance Anchor

EU DSA Article 26 is the structural anchor for political advertising compliance across the European Union in 2026. The provision — part of Regulation (EU) 2022/2065 (the Digital Services Act) — imposes mandatory transparency obligations on Very Large Online Platforms (VLOPs) hosting political advertisements: a public political ad library, retention periods of at least one year, advertiser identification including ultimate funder, and targeting parameter disclosure in machine-readable format.

The framework has been operational since August 2023 for designated VLOPs and reached full first-year implementation across 27 EU and 3 EEA member states by mid-2025. The first 18 months of enforcement data, now available through Q1 2026, surface several structural patterns that advertisers planning EU-targeted political campaigns must understand. Implementation is uneven across member states. Ireland is the gravitational center of enforcement because most VLOPs maintain EU headquarters in Dublin and the Irish DPC serves as lead supervisory authority. Penalty cases appear to be scaling; some practitioner tallies put aggregate Q1 2026 exposure in the low hundreds of millions of euros, but no official consolidated total has been confirmed.

This guide walks the provision itself, the cross-member-state implementation variation, per-platform compliance rates, the structural Ireland enforcement bottleneck, the 2025-2026 penalty case pattern, and the practical compliance checklist for non-EU advertisers entering the framework.

The DSA requires very large online platforms that present advertisements to compile and make publicly available, in a specific section of their interface, a searchable repository of the advertisements they serve (paraphrased from Regulation (EU) 2022/2065, advertising-repository provisions).

Article 26 — The Provision Itself

Article 26 of the DSA imposes four core obligations on VLOPs hosting political advertisements. The obligations operate at the platform layer with downstream advertiser cooperation requirements, and apply uniformly across all 27 EU and 3 EEA member states.

Public political ad library

VLOPs must maintain a publicly accessible repository of all political advertisements served on the platform. The library must be searchable, machine-readable through API access, and free to access without authentication. Meta's Ad Library, Google's Political Advertising Transparency Center, and TikTok's Commercial Content Library are the platform implementations.

Retention periods

Each political ad record must be retained for at least one year from the date the ad last ran. The retention applies to the full record — actual creative, targeting parameters, reach figures, and advertiser identification all remain accessible for the full window. Records purged before the one-year minimum trigger Article 26 violation.

Advertiser identification

The natural or legal person who paid for the political advertisement must be identified in the public record. The obligation extends to identifying the actual funding source when the advertiser of record is a pass-through entity (agency, PAC, campaign committee). The transparency runs to the ultimate funder, not just the payment-method holder.

Targeting parameter disclosure

The audience targeting parameters used to deliver the political ad must be disclosed in the public record. This includes demographic targeting, interest-based targeting, behavioural targeting categories, and audience-list-based targeting if a custom audience was used. The disclosure is structured rather than narrative — machine-readable format is mandatory.

Article 26 also imposes timing requirements: records must appear in the library within 24 hours of the ad first running; updates to ad metadata must propagate within an additional 24-hour window. The result is a near-real-time transparency framework rather than periodic disclosure.

27 Member States — Implementation Variation

Article 26 imposes uniform obligations across the EU but member state implementation has varied significantly. The variation reflects different national regulator capacities, different national enforcement priorities, and the cross-border supervisory framework that channels VLOP-level cases through specific national authorities.

The variation matters for advertisers because cross-border campaigns face oversight from multiple national authorities in addition to the Irish DPC routing for VLOP-level violations. A campaign running in Germany, France, and Italy simultaneously faces three sets of national-level oversight plus Irish DPC coordination — four supervisory authorities for a single campaign. The complexity is the largest single source of compliance error for non-EU advertisers entering EU political ad markets.

Beyond the formal supervisory structure, member states have varied in their public guidance and outreach to advertisers. Germany's BNetzA has published detailed operational guidance with worked examples for political ad classification edge cases. France's ARCOM has run advertiser training sessions in coordination with industry associations. Italy's AGCom has issued sector-specific guidance for political advertising during election windows. The Northern European cohort (Sweden, Denmark, Finland, Netherlands) has produced coordinated guidance through Nordic Council channels. The Eastern European member states have been comparatively quieter on public guidance, focusing capacity on internal implementation rather than external advertiser outreach. The guidance variation produces an information asymmetry that experienced EU political advertisers can exploit and that newer entrants must invest to overcome through engagement with national-level industry associations and EU-level legal counsel.

Per-Platform Compliance Rate

VLOP compliance with Article 26's specific requirements has varied across the cohort. Audit-rate disclosure, ad library completeness, retention period compliance, and targeting parameter machine-readability have all been areas of platform-specific gap.

The platform-level variation produces uneven advertiser experience. Campaigns running on Meta and Google enter mature, well-structured library systems with clear disclosure flows. Campaigns running on TikTok face evolving library infrastructure with frequent platform-side updates that require advertiser-side adjustment. Campaigns running on X face the highest compliance risk because the platform's library coverage gaps create both platform-level enforcement exposure and downstream advertiser exposure.

Practitioner reporting suggests platform-specific compliance gaps cluster around X (retention), TikTok (targeting disclosure), and Meta (ultimate-funder disclosure), but specific per-platform case counts and aggregate totals are not confirmed by published official decisions.

The asymmetry of platform compliance maturity has downstream consequences for advertisers planning multi-platform EU political campaigns. The natural temptation is to run the same campaign across all major platforms with a single creative and disclosure package; the reality is that each platform's library structure imposes specific formatting constraints that produce per-platform variation in the disclosure submission. The operational discipline that disciplined campaign teams adopt is to maintain platform-specific compliance templates and to verify library record completeness within 24 hours of each platform launch — a workflow that adds modest overhead but eliminates the most common Q1 2026 violation patterns. Campaigns that run with a unified single-template approach face elevated risk of platform-specific gaps surfacing as Article 26 violations.

Hidden Gem — The Ireland Effect

The Ireland concentration in DSA Article 26 enforcement is a structural feature of the EU regulatory framework that advertisers and analysts often miss. The Irish Data Protection Commission (DPC) serves as the lead supervisory authority for most VLOPs because Meta, Google, TikTok, X, LinkedIn, and other major platforms maintain EU headquarters in Ireland for corporate-tax purposes. The 'one-stop-shop' mechanism in EU regulation channels cross-border cases to the supervisory authority of the country where the platform has its main EU establishment.

The mechanism means that any DSA Article 26 violation by Ireland-headquartered VLOPs is handled by the Irish DPC regardless of which EU member state the affected users reside in. A German user filing a complaint about a Meta political ad targeting Germany has the complaint routed through the German national regulator initially, but the substantive enforcement decision is made by the Irish DPC in Dublin.

Approximately 60% of cross-border DSA cases in 2025-2026 have landed on the Irish DPC's desk. The concentration produces three operational consequences. First, capacity constraints — the Irish DPC's headcount has lagged the case volume, producing case backlogs of 12-18 months for complex cross-border matters. Second, enforcement philosophy — the Irish DPC has historically been more procedurally cautious than several continental regulators, producing lower per-case penalty amounts even on established violations. Third, reform pressure — the European Commission's mid-2025 DSA implementation review identified the Ireland concentration as a structural issue and signalled possible reforms including a dedicated EU-level DSA enforcement body. Reforms are unlikely to take effect before late 2027 even if approved.

For advertisers, the practical implication is that DSA Article 26 enforcement timing is dominated by Irish DPC processing capacity. Case-resolution timelines for substantive Article 26 violations should be planned with 12-18 month windows in mind, and compliance posture should be calibrated to prevent violations rather than rely on appeal of adverse decisions through a backlogged system. For coordinated EU compliance review see the EU DSA Compliance Guide.

Penalty Cases 2025-2026

DSA Article 26 enforcement through May 2026 has produced a tiered penalty pattern with several published cases establishing the operational range. The structural penalty framework under Article 74 of the DSA caps fines at 6% of the platform's annual worldwide turnover for serious or repeated infringements — multi-billion euro maximum exposure per consolidated enforcement action for the largest VLOPs.

• Broader DSA transparency enforcement is now live: the Commission's first DSA non-compliance fine — €120M against X in December 2025 — cited the platform's sparse and unwieldy advertising repository and researcher-access barriers among the conduct at issue. These are general DSA transparency/ad-repository actions rather than Article 26 political-ad decisions specifically, but they establish that the Commission is willing to impose nine-figure fines for ad-transparency failures.
• Article 26 political-ad-specific decisions: no settled, individually attributable Article 26 political-advertising fine has been publicly confirmed as of writing. Practitioner expectation is that retention, targeting-disclosure, and ultimate-funder gaps will be the most likely subjects of any future political-ad-specific decisions, but specific case counts, dates, and totals should not be treated as confirmed.
• Outlook: further investigations touching ad transparency are reported to be active, with case load expected to weight toward retention compliance and ultimate-funder disclosure; timing and outcomes remain uncertain.

Four persistent compliance gap categories explain most published cases. First, retention compliance — ad records being purged or becoming inaccessible before the one-year minimum. Second, advertiser identification gaps where pass-through entities (agencies, PACs) are listed without ultimate-funder disclosure. Third, targeting parameter disclosure that does not conform to the structured machine-readable format. Fourth, cross-border ads showing the highest compliance gap rate because of jurisdictional complexity.

The penalty trajectory through the remainder of 2026 is expected to escalate as Q3-Q4 enforcement priorities approach. The Irish DPC's published 2026 enforcement priorities placed DSA Article 26 in the top tier. For ongoing tracking see /enforcement.

Compliance Checklist

• [ ] Complete each target platform's political ad registration and verification 14-21 days before campaign launch
• [ ] Document complete advertiser identification including ultimate funder chain for any pass-through entities
• [ ] Review planned targeting parameters against both Article 26 disclosure requirements and PAR profiling restrictions
• [ ] Prepare creative-level disclosure labels conforming to platform-specific and PAR formatting requirements
• [ ] Designate an EU representative for non-EU advertisers as required under DSA Article 13
• [ ] Engage per-country compliance counsel for any cross-border campaign reaching multiple member states
• [ ] Verify within 24 hours of campaign launch that political ad library records populated correctly with all required fields
• [ ] Monitor library records throughout campaign for completeness and trigger platform support escalation for any gaps
• [ ] Document the full compliance package (registration, identification, targeting plan, disclosure language, library verification) for audit purposes
• [ ] Plan campaign timeline with the 12-18 month Irish DPC backlog factored into post-violation appeal expectations

For live regulatory tracking during EU campaign windows see the Policy Tracker. For coordinated cross-jurisdiction compliance see the Legal Compliance Scan. For the Q1 2026 broader enforcement context see the Synthetic Media Enforcement Index Q1 2026.