WhatsApp Channels DSA Compliance May 2026: The Mid-May VLOP Deadline, Article 39 Ad Repository & Advertiser Obligations

Why the Mid-May Deadline Matters

On January 26, 2026, the European Commission formally designated WhatsApp Channels as a Very Large Online Platform under Article 33 of the Digital Services Act. The designation followed Meta's own user-count submission, which reported that Channels had reached 51.7 million average monthly active recipients in the European Union during the first half of 2025 — well above the 45 million VLOP threshold. From the date of designation, Meta has four months to bring WhatsApp into compliance with the additional VLOP obligations the DSA layers on top of the baseline duties that already applied to the platform.

That four-month window expires in the second half of May 2026. Once it does, the Commission's enforcement powers activate in full: information requests, on-site inspections, interim measures, public commitments, and ultimately Article 74 fines of up to six percent of Meta's worldwide annual turnover. The deadline is not a soft target, and the Commission has been explicit that it intends to enforce.

For advertisers, the substantive impact is concentrated in three areas. WhatsApp Channels ads must now be discoverable through a public Article 39 repository. Targeting must align with the special-category and minors restrictions in Articles 26 and 28. And campaign records on the advertiser side must support a level of disclosure that most teams have not yet operationalised on the WhatsApp surface.

"The four-month clock for WhatsApp Channels VLOP compliance ends in mid-May 2026. From that point, every paid placement on the surface sits inside the same disclosure and targeting regime that already applies to Facebook and Instagram — and the Commission has signalled that it will enforce."
— AuditSocials regulatory brief, May 2026

Track the Commission's transition from preparation to enforcement and any platform-level documentation changes through the Policy Tracker, which monitors EU DSA announcements alongside Meta's policy pages.

Designation Timeline & Enforcement Trigger

The legal sequence runs from the user-count submission through designation to the cutover. Each stage has a specific procedural function, and the mid-May deadline only makes sense when read against the full timeline.

Key Dates

The relevant cutover for advertisers is the mid-May date. Before it, the Commission's leverage runs through dialogue and pre-enforcement engagement. After it, the formal proceedings under Articles 66 to 76 are available, including non-compliance decisions, periodic penalty payments, and the financial sanctions cap.

Article 39 Ad Repository Obligations

Article 39 requires every VLOP that displays advertising to maintain a public, machine-readable repository of the ads it has served. The repository must support search, filtering, and programmatic access, and must retain records for at least one year after the ad last appeared. Meta already operates Article 39 repositories for Facebook and Instagram, but WhatsApp Channels is a new surface and the Commission will scrutinise scope, completeness, and accuracy in the first audit cycle.

Required Disclosure Fields

• Advertiser identity: Verified legal name, registered office, payer-on-behalf-of and beneficiary parties
• Run period: Activation timestamp, pause timestamp, total active days
• Reach: Total impressions in the EU and per-Member-State breakdown
• Targeting parameters: Category-level targeting taxonomy used to determine the audience
• Commercial nature: Whether the ad was paid, boosted, or otherwise commercial
• Creative artefact: Full creative including any dynamic permutations

The targeting field is the highest-risk disclosure for most advertisers. Civil society researchers and supervisory authorities monitor public repositories for evidence of sensitive-category targeting, deceptive disclosure, or inconsistent advertiser identity records. Advertisers should pre-clear targeting taxonomies through compliance review before campaigns go live, and route any borderline placement through AI Compliance Audit for automated screening against EU rules.

Cross-Repository Comparison

Sensitive-Category Targeting Restrictions

Article 26(3) of the DSA prohibits the presentation of advertising based on profiling using GDPR Article 9 special categories — health, race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, biometric and genetic data. The prohibition is absolute and applies regardless of whether the advertiser purchased the targeting directly or whether the platform inferred it from observed behaviour.

WhatsApp-Specific Risk Patterns

• Channel-following signal: The Channels a user follows can themselves reveal special-category membership; targeting based on follow patterns triggers Article 26(3) review even when no explicit category is selected.
• Lookalike audience drift: Lookalike seeds derived from special-category-adjacent custom audiences can carry forward the prohibited inference, and advertisers should re-validate seed integrity before porting to WhatsApp Channels.
• Geographic micro-targeting: Combining narrow geography with health, religion, or political proxies can be reconstructed as profiling on a special category in regulatory review.

For regulated industries — pharmaceutical, healthcare, gambling, alcohol, political — assume WhatsApp Channels carries higher targeting friction than the other Meta surfaces. See healthcare compliance and gambling regulation for vertical-specific guidance, and reference EU DSA Compliance for the consolidated regulatory frame.

Minors Protection Under Article 28

Article 28 prohibits VLOPs from presenting advertising based on profiling using the personal data of recipients when the platform is aware with reasonable certainty that the recipient is a minor. The prohibition is broader than the Article 26(3) special-category bar because it applies to profiling-based advertising in general, not only to special categories. WhatsApp Channels is used widely by minors across the EU, and the mid-May deadline brings the surface fully into the layered minors regime.

Layered Regime

• DSA Article 28: No profiling-based ads to known or reasonably inferred minors
• GDPR Article 8: Parental consent threshold for processing children's data (age 13 to 16 depending on Member State)
• AVMSD: Restrictions on commercial communications likely to reach minors
• Member State rules: National-level age verification and consent requirements

The defensive posture for advertisers is a hard age-eighteen floor on WhatsApp Channels campaigns combined with documentation of the platform's age-signal accuracy commitments. For category-specific minors compliance, see Meta teen accounts rollout and Kids & Teens compliance.

Systemic Risk & Crisis Response

Articles 34 and 35 require VLOPs to identify, analyse, and mitigate systemic risks stemming from the design, functioning, and use of their services. The catalogue of risks the DSA identifies includes the dissemination of illegal content, negative effects on the exercise of fundamental rights, negative effects on civic discourse and electoral processes, and negative effects on public health, minors, physical and mental wellbeing, or gender-based violence.

The systemic risk regime affects advertisers indirectly. Platforms tighten internal review and creative-policy enforcement to demonstrate mitigation effectiveness in the annual audit, and the friction lands on creative variants that probe sensitive content adjacencies, on targeting choices that touch contested categories, and on volume scaling that triggers behavioural-pattern review. Advertisers running EU-facing campaigns on WhatsApp Channels should expect first-pass rejection rates to be higher in the months immediately after the deadline, and should pre-clear creatives through Meta Rejection Predictor before submitting at scale.

Article 36 crisis response protocols come into play during designated crisis events — public health emergencies, electoral periods, armed conflicts. During a designated crisis, the Commission can require additional mitigation measures across VLOPs, and advertiser-side compliance posture should anticipate temporary tightening on creative latitude during these windows.

Penalty Exposure: 6% Global Turnover

Article 74 caps non-compliance fines at six percent of the platform operator's worldwide annual turnover in the preceding financial year. For Meta, the relevant turnover base is the consolidated group revenue, which places the maximum fine in the nine to ten billion euro range based on most recent reporting. Article 76 periodic penalty payments add a daily-accumulating sanction of up to five percent of average daily worldwide turnover for each day of continuing non-compliance.

Advertisers do not face Article 74 fines directly — those land on the platform — but the platform-level enforcement pressure translates into stricter campaign-level review, more aggressive account-level enforcement, and tighter creative latitude. Advertisers running EU campaigns on Meta surfaces should pre-clear creative and audience definitions, document targeting decisions in advertiser-side records, and route borderline placements through Legal Compliance Scan for multi-jurisdiction review before launch.

Advertiser Compliance Checklist

• [ ] Confirm legal entity, payer-on-behalf-of, and beneficiary records align with Meta business verification artefacts
• [ ] Pre-clear creative variants through rejection-prediction tooling before submission
• [ ] Audit targeting taxonomies for special-category proxies — interest, behavioural, geographic micro-targeting
• [ ] Document audience definitions in plain language that aligns with the public repository's targeting field
• [ ] Set hard age-eighteen floor on EU-targeted WhatsApp Channels campaigns
• [ ] Retain creative, targeting, spend, and reach records on the advertiser side for at least one year
• [ ] Document lawful basis under GDPR for any processing that supports the campaign
• [ ] Build the public repository feed into routine compliance review cadence
• [ ] Pre-clear regulated-industry placements (health, gambling, alcohol, political) through legal review
• [ ] Track Commission enforcement signals through the Policy Tracker