EU DSA Second Wave Enforcement April 2026 — New VLOP Designations, Expanded Advertising Transparency Obligations & 6 Percent Turnover Fines
The EU activated its DSA second enforcement wave in April 2026, designating additional platforms as VLOPs and extending advertising transparency obligations. The €120M X fine set the penalty ceiling at 6 percent of global turnover — advertisers on newly designated platforms face new creative, targeting, and reporting constraints.
Inside This Compliance Report
- 1What Changed in the April 2026 Second Wave
- 2New VLOP Designations and Platform Scope
- 3Expanded Advertising Transparency Obligations
- 4The X €120 Million Precedent
- 5Advertiser Compliance Obligations on VLOPs
- 6DSA Penalty Framework and Calculation
- 7Advertiser Preparation Plan
- 8DSA Second Wave Compliance Checklist
- 9Frequently Asked Questions
What Changed in the April 2026 Second Wave
The European Commission activated the DSA second enforcement wave in April 2026, expanding Very Large Online Platform designations to cover additional networks, refining advertising transparency obligations based on first wave enforcement learnings, and maintaining an enforcement posture anchored in the December 2025 X decision that imposed a €120 million fine. The second wave is the operationalization of the framework the first wave established — enforcement is now the default posture rather than an aspirational threshold.
Three substantive changes define the second wave. First, additional platforms have been designated as VLOPs under a refined active recipient counting methodology that captures services previously just under the 45 million monthly active user threshold. Second, advertising transparency obligations have been expanded to address repository gaps, targeting disclosure granularity, funding source resolution, and researcher access infrastructure that the first wave highlighted as improvement areas. Third, the penalty framework is now active with material consequences, with the X decision establishing that penalties at 5 percent of global turnover are realistic rather than theoretical.
"The Digital Services Act is fully operational. The second wave of enforcement extends the compliance framework to additional platforms and sharpens the transparency obligations that protect EU users and support democratic oversight of digital services."
— European Commission digital strategy briefing, April 2026
New VLOP Designations and Platform Scope
The second wave designations apply a refined active recipient counting methodology that captures additional user engagement patterns and resolves ambiguity in the first wave approach. Platforms previously just under the 45 million monthly active user threshold now cross into designation under the refined count. The Commission has published the authoritative list on the designated VLOPs and VLOSEs page — advertisers should reference the official publication for definitive status.
Categories of Newly Designated Platforms
| Category | Typical Profile | Obligation Impact |
|---|---|---|
| Mid-tier social networks | Platforms with 30–50M EU MAU previously under threshold | Full VLOP obligations including repository and risk assessment |
| Specialized content platforms | Video-first, audio-first, vertical community platforms | Content-format-specific transparency obligations |
| Regional European platforms | Language or country-specific services | Jurisdictional obligation complexity |
| E-commerce with social features | Marketplaces with UGC and community functions | Commerce-specific transparency alongside ad repository |
| Public-messaging platforms | Messaging services with broadcast components | Broadcast-feature-specific obligations |
Newly designated platforms have approximately six months from designation announcement to reach full compliance. The Commission has signaled willingness to engage collaboratively during transition while maintaining the compliance endpoint. Platforms demonstrating good faith progress toward compliance face different enforcement posture from platforms that approach transition passively. Advertisers should expect service changes on newly designated platforms including new ad repository interfaces, revised targeting disclosure in campaign setup, and new transparency reporting requirements. For ongoing designation tracking use our Policy Change Tracker.
Expanded Advertising Transparency Obligations
The second wave expansion addresses specific gaps identified during first wave enforcement and codified in the December 2025 X decision. The expansion applies to both originally designated VLOPs and newly designated platforms, creating a unified advertising transparency standard across the designated cohort.
Advertising Repository Requirements
- Complete creative: All content variants served in the creative rotation must be included, not only representative samples.
- Granular targeting: Targeting dimensions used and audience definitions applied to each ad must be disclosed with sufficient granularity to support research.
- Funding chain: Legal entity funding the advertising and the commercial chain through which payment flows must be disclosed, with structures designed to obscure funding source treated as violations.
- Delivery metrics: Impression and reach data must be included supporting analysis of audience exposure.
- Policy status: Moderation actions taken on the ad including removal, restriction, or labeling must be reflected in the repository record.
- Access design: No registration barriers, no access limitations that effectively block research, no design choices that functionally restrict use.
- Retention: Minimum one year retention after the ad last ran, with some categories requiring longer retention.
Researcher Access Infrastructure
- Vetting framework: Clarified vetting criteria that support legitimate academic research while protecting against misuse.
- Data access formats: Structured data access supporting programmatic analysis, not only human-readable interfaces.
- Response timelines: Defined response timelines for access requests with accountability for unreasonable delays.
- Appeals process: Escalation path for denied access requests including Commission-level review.
Advertisers cannot opt out of repository inclusion. Targeting, funding, and creative that would be problematic to disclose publicly should not be configured in campaigns — repository visibility should be treated as a design constraint in campaign planning. For campaign pre-flight review use the AI Compliance Audit configured for EU DSA compliance.
The X €120 Million Precedent
The December 2025 European Commission decision fining X €120 million for DSA non-compliance established the first substantive enforcement precedent under the framework. The decision addressed three distinct violations and set the penalty ceiling at approximately 5 percent of X's relevant global turnover — close to but below the 6 percent statutory maximum.
Violations Identified
- Deceptive blue checkmark design: Historical verification indicator redefined as paid subscription indicator without corresponding user-facing transparency about the semantic change.
- Advertising repository gaps: Repository lacked critical information including ad content detail and funding entity identity, with design features that undermined research and oversight purposes.
- Researcher access failures: Failure to provide meaningful researcher access to data supporting academic research on platform effects.
Precedent Effects
- Penalty magnitude expectation: Serious DSA violations attract penalties at or near the 6 percent turnover maximum.
- Priority enforcement areas: Advertising transparency, deceptive design, and researcher access identified as focus areas for subsequent investigations.
- Accelerated compliance investment: Visible cross-platform acceleration of DSA compliance infrastructure investment across the original VLOP cohort.
- Baseline for new VLOPs: Newly designated platforms face X precedent as baseline compliance expectation.
Pending cases against Meta and TikTok on related issues signal continued enforcement tempo through 2026. For X-specific policy review see the X Ads Policy guide.
Advertiser Compliance Obligations on VLOPs
DSA advertiser obligations operate primarily through the VLOP infrastructure but create substantial indirect obligations for advertisers whose ads reach EU users. Advertisers should audit practice across five obligation categories and build compliance infrastructure proportionate to EU advertising investment.
Creative Transparency
- Commercial nature clarity: Creative must not disguise commercial nature through content that appears editorial, user-generated, or otherwise non-commercial.
- Advertiser identification: Creative must accurately identify the advertiser, with exceptions limited to brand-building where identification through the branded content suffices.
- Content policy alignment: Creative must comply with VLOP content policies that reflect DSA obligation structure including prohibitions on deceptive content and targeting-specific content rules.
Targeting Transparency
- Repository alignment: Targeting configured in platform interfaces becomes visible in the repository — targeting that would be problematic to disclose should not be configured.
- Sensitive category restrictions: Political advertising, health targeting, and demographic-sensitive categories face stricter targeting disclosure requirements.
- Documentation: Advertisers should maintain documentation supporting targeting practice for potential enforcement inquiry response.
Funding Source Transparency
- Ultimate funder identification: Platform interfaces must identify the ultimate legal entity funding the advertising, not only intermediaries or agencies.
- Chain disclosure: Where advertising flows through intermediaries, the chain must be resolvable to the funding source.
- Political funding elevation: Political advertising funding source transparency faces particularly strict requirements.
For comprehensive advertiser DSA compliance review see the EU DSA Compliance Guide and use the Legal Compliance Scan.
DSA Penalty Framework and Calculation
The penalty framework under the DSA combines substantial financial penalties with operational remedies and periodic penalties for continuing non-compliance. Advertisers and platforms should understand the full penalty structure to calibrate compliance investment appropriately rather than focusing only on the headline turnover percentage.
Penalty Components
| Component | Ceiling | Application |
|---|---|---|
| Standard penalty | 6 percent of global annual turnover | Serious or sustained violations |
| Periodic penalty | 5 percent of average daily global turnover per day | Continuing non-compliance following Commission decision |
| Operational remedies | Proportionate to violation | Compliance infrastructure investment, third-party audits, public reporting |
| Service restriction | Judicial order in extreme cases | Persistent non-compliance where penalties and remedies fail |
Calculation Factors
- Nature and gravity: Systemic violations attract higher penalties than isolated issues.
- User impact scale: Violations affecting larger user populations attract higher penalties.
- Duration: Persistent violations attract higher penalties than promptly remediated issues.
- Cooperation: Cooperative platforms receive mitigation consideration during investigation.
- Compliance posture: Platforms with strong infrastructure receive mitigation compared with minimal-compliance platforms.
- Enforcement history: Platforms with prior violations face higher penalties for subsequent violations.
For penalty risk assessment use the Legal Compliance Scan.
Advertiser Preparation Plan
Advertisers with EU advertising investment should execute a structured preparation program during the second wave transition. The program scope should match EU investment scale — advertisers with material EU revenue exposure warrant substantive compliance infrastructure investment.
Immediate Actions (Month 1)
- Platform coverage audit: Identify all VLOP platforms (originally designated and newly designated) where advertising is active in EU markets.
- Creative audit: Review creative portfolio for commercial nature clarity, advertiser identification, and content policy alignment.
- Targeting audit: Review targeting practice against repository disclosure transparency standard.
- Funding structure audit: Confirm funding source identification across advertising intermediaries, agencies, and holding structures.
Medium-Term Build (Months 2–6)
- Compliance infrastructure: Internal processes for creative pre-flight review, targeting practice review, and funding disclosure validation.
- Documentation discipline: Documentation supporting targeting rationale, funding source identification, and compliance decisions for potential enforcement inquiry response.
- Repository monitoring: Process for monitoring the advertiser's own entries in VLOP repositories and identifying issues.
- Enforcement response capability: Internal capability to respond to VLOP enforcement inquiries and remediate issues rapidly.
For compliance infrastructure design use the AI Compliance Audit.
DSA Second Wave Compliance Checklist
- [ ] Identify all VLOP platforms (original and new) where EU advertising is active
- [ ] Audit creative portfolio for commercial nature clarity and advertiser identification
- [ ] Audit targeting practice against repository disclosure transparency standard
- [ ] Confirm funding source identification across intermediaries and agencies
- [ ] Review political advertising, health targeting, and demographic-sensitive campaigns specifically
- [ ] Build internal pre-flight compliance review process for EU campaigns
- [ ] Maintain documentation supporting targeting and funding decisions
- [ ] Monitor own repository entries across VLOP platforms
- [ ] Build enforcement response capability for rapid VLOP inquiry handling
- [ ] Monitor Commission enforcement actions and precedent development
- [ ] Model DSA penalty exposure for enforcement risk assessment
Don't miss the next policy change.
Subscribe to the Policy Change Tracker — get weekly digests or instant Pro alerts across all 8 platforms. Or try our free Keyword Risk Checker first.
Report Keywords — Run AI Compliance Audit
Related Posts
Cannabis & CBD Social Media Ad Compliance Guide 2026 — Platform-by-Platform Rules, State Laws & Safe Advertising Strategies
A comprehensive 2026 compliance guide to cannabis, CBD, and hemp advertising on every major social media platform. Covers what's allowed, what's banned, topical vs ingestible rules, US state-by-state legal impact, and actionable strategies to run compliant campaigns without getting flagged.
Cross-Border Influencer Marketing Compliance 2026 — US, EU, UK & Global Disclosure Laws
Influencer marketing doesn't stop at borders — but advertising laws do. From FTC endorsement rules in the US to the EU's Digital Services Act, UK ASA guidelines, and emerging frameworks in Brazil and Australia, creators and brands face a patchwork of disclosure obligations. This guide maps every major regulation, compares penalties, and provides a practical compliance checklist for cross-border campaigns in 2026.
The Ultimate Influencer Compliance Guide 2026 — FTC Rules, Platform Tools & Disclosure Best Practices
The definitive influencer compliance guide for 2026 covering FTC endorsement rules, EU DSA obligations, platform-by-platform disclosure tools, and the most common mistakes that lead to enforcement actions. Everything creators and brands need to stay compliant across Meta, TikTok, YouTube, and beyond.