TikTok EU Digital Services Act Ad Transparency & Compliance Guide 2026

EU Digital Services Act Overview & TikTok Obligations

The Digital Services Act (DSA) represents the most comprehensive overhaul of digital platform regulation in the European Union's history. Enacted in November 2022 and fully applicable to Very Large Online Platforms (VLOPs) since August 2023, the DSA establishes binding obligations around content moderation, algorithmic transparency, and — critically for advertisers — advertising transparency and accountability.

TikTok was formally designated as a VLOP by the European Commission in April 2023, based on its self-reported user base of over 130 million monthly active users in the EU. This designation triggers the most stringent tier of DSA obligations, including independent audits, systemic risk assessments, and enhanced advertising transparency requirements.

Key DSA Articles Affecting TikTok Advertising

Regulatory context: The European Commission opened formal proceedings against TikTok in February 2024 and issued preliminary findings in mid-2025 citing concerns about addictive design features, minor protection, and ad transparency shortcomings. Advertisers should treat DSA compliance on TikTok as a high-priority risk area.

For advertisers, the DSA fundamentally changes the operating model: transparency is no longer optional, verification is mandatory, and targeting practices face legal constraints that go well beyond previous industry self-regulation. Understanding these obligations is essential for any brand running campaigns to EU audiences on TikTok in 2026.

Ad Transparency Repository Requirements

Article 39 of the DSA requires TikTok to maintain a publicly accessible, searchable advertisement repository containing detailed information about every ad shown to EU users. This repository — TikTok's Commercial Content Library — is a cornerstone of the DSA's transparency framework.

Mandatory Repository Data Points

For each advertisement in the repository, TikTok must provide:

• Ad creative content: The full advertisement including all visual, audio, and text elements
• Advertiser identity: The natural or legal person on whose behalf the ad is presented
• Paying entity: The person or entity who funded the ad, if different from the advertiser
• Display period: The exact dates when the advertisement was active
• Targeting parameters: Whether the ad was targeted to specific groups and which parameters were used
• Reach data: Total number of recipients who saw the advertisement
• Audience groups: Meaningful information about the demographic groups targeted

The repository must retain this data for at least one year after the ad was last displayed, and it must remain accessible and searchable throughout this period.

Current State of TikTok's Commercial Content Library

TikTok launched its Commercial Content Library to meet DSA requirements, but the European Commission's 2025 audit identified several shortcomings:

• Limited search functionality compared to Meta's Ad Library
• Incomplete targeting parameter disclosure for algorithmically optimised campaigns
• API access restrictions that hinder researcher and civil society analysis
• Inconsistent data formatting across different ad types (in-feed, branded effects, spark ads)

Advertiser action item: Regularly audit your active and historical campaigns in TikTok's Commercial Content Library. Verify that your ad creatives, identity information, and targeting parameters are accurately represented. Discrepancies should be reported to TikTok support and documented for your compliance records.

Track changes to TikTok's ad repository requirements using our Policy Tracker for real-time regulatory updates.

Advertiser Identity Verification Under DSA

Articles 26 and 30 of the DSA establish a mandatory advertiser traceability framework. TikTok must collect, verify, and store identity information for every entity placing advertisements on its platform before those ads can reach EU users.

Verification Requirements by Advertiser Type

TikTok's Verification Process

TikTok has implemented a multi-step verification flow for EU advertisers:

• Step 1 — Document submission: Advertisers upload identity documents and business registration details through TikTok Ads Manager
• Step 2 — Automated screening: TikTok's systems cross-reference submitted data against public business registries and sanctions databases
• Step 3 — Manual review: Flagged submissions receive human review within 48-72 hours
• Step 4 — Confirmation: Approved advertisers receive verified status; rejected advertisers receive explanation and can resubmit
• Step 5 — Periodic re-verification: All advertisers must re-verify every 12 months or when legal details change

Critical deadline: TikTok required all existing EU advertisers to complete enhanced DSA-compliant verification by Q1 2026. Advertisers who have not completed this process risk immediate campaign pauses. If you operate through agencies, confirm that your agency has completed verification on your behalf and that your brand identity is correctly attributed.

If TikTok cannot verify an advertiser's identity, the platform is legally prohibited from displaying that advertiser's content to EU users. There is no grace period or provisional advertising status under the DSA.

Targeting Parameter Disclosure Rules

One of the DSA's most consequential requirements for advertisers is the mandatory disclosure of targeting parameters to every user who sees an advertisement. This goes far beyond existing "Why am I seeing this ad?" features — it requires structured, meaningful disclosure of the targeting logic.

What Must Be Disclosed

For every ad displayed to an EU user, TikTok must communicate:

• Demographic parameters: Age range, gender, geographic location targeting
• Interest-based targeting: Interest categories derived from user behaviour on TikTok
• Behavioural signals: Engagement patterns, content interaction history used for targeting
• Custom audiences: Whether the ad targets a list uploaded by the advertiser (without revealing individual list members)
• Lookalike/similar audiences: Whether algorithmic expansion from a seed audience was used
• Contextual targeting: Content categories or hashtags associated with the ad placement
• Algorithmic optimisation: The optimisation goal (e.g., conversions, traffic, engagement) and how it influenced delivery

Real-Time Disclosure vs. Repository Disclosure

The DSA distinguishes between two disclosure layers:

Implications for TikTok's Algorithm-Driven Targeting

TikTok's advertising system relies heavily on its recommendation algorithm, which presents unique disclosure challenges. Unlike Meta's structured interest categories, TikTok's algorithm creates dynamic user clusters based on real-time content engagement. This makes targeting parameter disclosure more complex because:

• Interest signals are inferred rather than explicitly declared by users
• The algorithm continuously adjusts targeting based on engagement feedback loops
• Broad targeting campaigns still undergo algorithmic selection that constitutes "targeting" under the DSA

Advertisers should not assume that selecting "broad targeting" in TikTok Ads Manager exempts them from disclosure requirements. The algorithm's delivery optimisation itself constitutes a targeting parameter that must be disclosed.

Monitor targeting disclosure requirements across platforms with our Compliance Rules Engine.

Sensitive Category Advertising Restrictions

Article 26(3) of the DSA introduces an outright prohibition on ad targeting that uses profiling based on special categories of personal data as defined under the GDPR (Article 9). This is one of the most impactful provisions for advertisers, as it bans entire categories of targeting that were previously available.

Prohibited Profiling Categories

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Health data (including inferred health interests)
• Sexual orientation or sex life
• Genetic or biometric data

Critical nuance: The prohibition applies to profiling — the automated processing of personal data to evaluate personal aspects. This means even if an advertiser does not explicitly select a sensitive category, using third-party data segments or behavioural signals that infer sensitive attributes violates the DSA. For example, targeting users who engage with health-related content to promote pharmaceutical products could constitute prohibited profiling.

How TikTok Enforces Sensitive Category Restrictions

TikTok has implemented several technical measures:

• Removal of interest-based targeting segments that correlate with sensitive categories
• Automated scanning of custom audience uploads to detect potential sensitive category profiling
• Restriction of lookalike audience creation from seed audiences tied to sensitive topics
• Pre-publication review for ad categories flagged as sensitive (health, financial services, political content)

Advertiser Responsibilities

Even with platform-level safeguards, advertisers bear responsibility for their targeting practices:

• Audit all third-party data segments before use in TikTok campaigns
• Document the data sources and logic behind custom audience creation
• Avoid combining non-sensitive targeting parameters in ways that could infer sensitive attributes
• Maintain records of targeting decisions and their compliance rationale

The intersection of DSA targeting prohibitions and GDPR data processing rules creates a dual compliance requirement. Advertisers may face enforcement action under both regulations simultaneously for the same targeting practice.

Enforcement Actions & Penalty Framework

The DSA establishes a tiered enforcement system with the European Commission holding primary authority over VLOPs like TikTok, while national Digital Services Coordinators (DSCs) handle smaller platforms and certain cross-border cases.

Penalty Structure for VLOPs

Enforcement Timeline Against TikTok

• February 2024: European Commission opens formal proceedings against TikTok regarding minor protection and ad transparency
• April 2025: Preliminary findings issued citing insufficient ad transparency repository data and targeting disclosure gaps
• Q3 2025: TikTok submits remediation plan with implementation timeline
• Q1 2026: Commission review of remediation progress; enhanced verification deadline for existing advertisers
• 2026 ongoing: Continued monitoring with potential escalation to formal fines

Indirect Consequences for Advertisers

While the DSA primarily targets platforms, advertisers face significant indirect consequences:

• Campaign disruption: Platform enforcement actions may result in sudden ad system changes or campaign pauses
• Account restrictions: Advertisers failing verification face immediate loss of advertising privileges
• Reputational exposure: Ads cited in Commission proceedings become part of the public record
• GDPR overlap: Targeting violations can trigger separate data protection authority investigations with fines up to 4% of global turnover
• National enforcement: DSCs in individual Member States can order specific campaign removals

Risk assessment: Given the Commission's active proceedings against TikTok, advertisers should treat 2026 as a high-enforcement year. Budget for compliance resources, maintain detailed records of all advertising decisions, and establish escalation procedures for regulatory inquiries.

Advertiser Compliance Checklist

Use this checklist to ensure your TikTok advertising operations in the EU meet all DSA requirements in 2026. Each item maps to a specific DSA obligation.

Identity & Verification

• Complete TikTok's enhanced advertiser identity verification with current documents
• Confirm your legal entity name, registration number, and VAT details are accurate in TikTok Ads Manager
• Designate and document the authorised representative(s) for your advertising account
• Set a calendar reminder for annual re-verification (12-month cycle)
• If using agencies, confirm agency verification status and brand attribution accuracy

Ad Transparency & Labelling

• Verify all active ads carry proper "Sponsored" or "Ad" labels visible to EU users
• Confirm your brand/advertiser name appears correctly in ad transparency disclosures
• Check that your ads appear accurately in TikTok's Commercial Content Library
• Ensure the paying entity is correctly identified when using third-party funding arrangements

Targeting & Data Compliance

• Audit all targeting parameters for sensitive category profiling risks
• Review third-party data segments for GDPR and DSA compliance
• Document the data source and logic for all custom audience uploads
• Remove or replace any targeting that infers sensitive personal attributes
• Review lookalike audience configurations for sensitive category exposure

Record-Keeping & Documentation

• Maintain internal records of all ad campaigns, targeting decisions, and compliance reviews
• Archive ad creatives and targeting configurations for at least 12 months post-campaign
• Document your DSA compliance assessment methodology
• Establish an incident response plan for regulatory inquiries or campaign suspensions

Ongoing Monitoring

• Subscribe to TikTok's policy update notifications for EU advertisers
• Monitor European Commission enforcement actions and decisions
• Review DSA compliance status quarterly
• Train advertising team members on DSA obligations and prohibited practices

Automate your compliance monitoring with our Compliance Rules Engine, which tracks DSA requirements across all major platforms and alerts you to policy changes in real time.

Comparison With Meta & X DSA Compliance

All three major platforms — TikTok, Meta (Facebook/Instagram), and X (formerly Twitter) — are designated VLOPs under the DSA and face identical legal obligations. However, their compliance approaches and current standing differ significantly.

DSA Ad Compliance Comparison: TikTok vs. Meta vs. X

Key Takeaways for Multi-Platform Advertisers

• Build a unified DSA compliance workflow: Rather than managing compliance separately for each platform, create a centralised process for identity verification, targeting audits, and record-keeping
• Meta's Ad Library is the benchmark: Use Meta's more mature transparency tools as a reference point for what TikTok and X will eventually match
• TikTok carries the highest regulatory risk in 2026: Active Commission proceedings and algorithm-specific scrutiny make TikTok the platform where compliance failures are most likely to attract attention
• X's unpredictability adds operational risk: Inconsistent policy enforcement on X means advertisers should maintain conservative compliance standards regardless of what the platform technically allows
• Cross-platform targeting data requires unified auditing: Custom audience data used across multiple platforms must meet DSA and GDPR standards on each platform independently

Strategic recommendation: Advertisers with EU audiences should designate a DSA compliance lead responsible for monitoring regulatory developments, coordinating platform verification, and maintaining compliance documentation across all VLOPs. The cost of proactive compliance is far lower than the cost of campaign disruption or regulatory exposure.

Stay ahead of DSA enforcement developments across all platforms with our Policy Tracker and automate your compliance checks with the Compliance Rules Engine.