What exactly happens at the WhatsApp DSA VLOP deadline in mid-May 2026?

The European Commission designated WhatsApp as a Very Large Online Platform under Article 33 of the Digital Services Act on January 26, 2026, after the platform's Channels feature passed the 45 million average monthly active recipient threshold in the European Union. The designation gave Meta four months to bring WhatsApp into compliance with the additional VLOP-specific obligations layered on top of the baseline DSA duties that already applied. Counted from January 26, that four-month window expires in the second half of May 2026, and once it does the Commission can begin formal enforcement action — including requests for information, on-site inspections, interim measures, and financial penalties up to six percent of Meta's global annual turnover. The deadline is not a soft target. It marks the legal transition from a preparation period to an enforcement period, and the Commission has been explicit that it intends to use the full enforcement toolkit against VLOPs that miss the cutover. The substantive obligations that come into force are familiar to advertisers who have followed Article 39 enforcement on other VLOPs: a public ads repository, expanded transparency reporting, recommender system disclosure, systemic risk assessments under Articles 34 and 35, independent annual audits under Article 37, the right of vetted researchers to access data under Article 40, and crisis response protocols under Article 36. Some of these obligations land directly on Meta as the platform operator. Others — most notably the ad repository — create downstream documentation requirements for advertisers running campaigns on the surface. Advertisers running paid placements on WhatsApp Channels in the European Union should treat mid-May as the point at which campaign-level metadata must be repository-ready, targeting must align with Article 26 sensitive-category restrictions, and recordkeeping must support the year-on-year retention that VLOP repositories require. Track the deadline transition and any subsequent Commission enforcement actions through the Policy Tracker , which monitors official European Commission DSA announcements alongside platform-level documentation changes. Failure to prepare for the deadline does not create an immediate fine, because the Commission's enforcement workflow runs through investigation phases before financial penalties land, but it does create exposure that compounds across audit cycles. The advertiser action item is to treat mid-May as a hard cutover even if the platform-level documentation is still in flux on the day.

What does the WhatsApp Channels ad repository require advertisers to disclose?

Article 39 of the Digital Services Act requires every Very Large Online Platform that displays advertising to maintain a public, searchable ad repository covering the content and targeting of every ad served. The repository must be available through a documented application programming interface, must allow filtering by advertiser, time period, content category, and targeting parameter, and must retain records for one year after the ad last appeared. The structure is consistent across VLOPs that have already operationalised the requirement — Meta's own Ad Library, TikTok's Commercial Content Library, and Google's Ads Transparency Center all build on the Article 39 baseline. The WhatsApp Channels repository will follow the same pattern, scoped to the new Channels surface rather than the existing Facebook and Instagram surfaces that Meta's Ad Library already covers. The required fields are extensive. For each ad, the repository must surface the advertiser's legal name and verified business identity, the period during which the ad ran, the total reach in the European Union and per-Member-State, the main targeting parameters used to determine the audience, whether the ad was paid or commercial in nature, the natural or legal persons on whose behalf the ad was presented, and the parameters used to determine the recipients of the ad. The targeting field is the one that most advertisers underestimate. The repository does not require disclosure of the exact custom audience or lookalike segment used, but it does require disclosure of the categories used — interest categories, behavioural categories, geographic targeting, age and gender bands, and any other parameter that materially shaped audience selection. Advertisers cannot opt out of this disclosure by running boosted Channels content rather than formal ad placements. The repository captures any commercial communication on the surface. The practical advertiser action is fourfold. First, audit campaign metadata before submission to confirm that advertiser identity, payer-on-behalf-of relationships, and beneficiary relationships are accurately recorded. Second, document targeting taxonomies in language that holds up to public scrutiny — vague or marketing-flavoured category names tend to attract attention from civil society researchers and journalists who monitor ad libraries. Third, retain creative and targeting records on the advertiser side for at least the same one-year minimum, in case the platform's repository entry conflicts with the advertiser's own records. Fourth, build the repository feed into routine compliance review, because civil society organisations and supervisory authorities use repositories as the starting point for investigations into deceptive practices, sensitive category targeting, and prohibited content. For deeper context on Article 39 expectations across Meta surfaces, see the Q1 2026 Article 39 audit findings , which surfaces the disclosure gaps that triggered the most enforcement attention in the first wave.

Can WhatsApp Channels ads use sensitive-category targeting after the deadline?

Article 26(3) of the Digital Services Act prohibits any platform — VLOP or otherwise — from presenting advertising to recipients of the service based on profiling that uses special categories of personal data as defined in Article 9(1) of the General Data Protection Regulation. The special categories include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, data concerning health, and data concerning a person's sex life or sexual orientation. The prohibition applies regardless of whether the advertiser purchased the targeting directly or whether the platform inferred it from observed behaviour. WhatsApp Channels presents a particularly sensitive surface because the Channels a user follows can themselves reveal special-category information. A user following Channels operated by health charities, political parties, religious institutions, or LGBTQ+ advocacy organisations leaks profiling signals that fall within Article 9 GDPR special categories. Meta has stated publicly that WhatsApp ads are targeted based on broad characteristics rather than profiling, but the Commission and national supervisory authorities will scrutinise the operational definition of broad in the months following the mid-May deadline. Advertisers who relied on health-category, political-affinity, or sexual-orientation-adjacent targeting on Facebook and Instagram cannot port those audience definitions to WhatsApp Channels and expect them to clear policy review. Practical compliance has several layers. The first is the Article 26(3) prohibition itself, which is absolute for special-category targeting and creates direct liability for the advertiser as well as the platform. The second is Article 28, which requires VLOPs to refrain from presenting ads based on profiling using personal data of recipients of the service when they are aware with reasonable certainty that the recipient is a minor. The third is the platform-level enforcement layer, which routes targeting choices through automated and human review and can suspend campaigns that probe sensitive categories even when the technical implementation is compliant. Advertisers in regulated industries — pharmaceutical, healthcare, political, religious, alcohol, gambling — should assume that WhatsApp Channels carries higher targeting friction than the other Meta surfaces and should pre-clear creative and audience definitions through compliance review before launch. For automated review of targeting and creative against EU sensitive-category rules, run AI Compliance Audit , which surfaces Article 9 and Article 26 risk patterns across regional frameworks, and reference EU DSA Compliance for the broader regulatory frame.

How does the WhatsApp DSA VLOP designation affect minors-directed advertising?

Article 28 of the Digital Services Act imposes specific obligations on platforms that are accessible to minors. The provisions require platforms to put in place appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors on the service, and they prohibit the presentation of advertising based on profiling using personal data of recipients of the service when the platform is aware with reasonable certainty that the recipient is a minor. The prohibition is broader than the special-category prohibition in Article 26(3) — it covers profiling-based advertising to minors regardless of whether sensitive categories are involved. WhatsApp is used by minors in significant numbers across the European Union, and the Channels surface is no exception. The mid-May 2026 deadline therefore brings WhatsApp into a layered minors-protection regime that combines DSA Article 28 with the General Data Protection Regulation's Article 8 standards on parental consent for processing children's data, the Audiovisual Media Services Directive's restrictions on advertising to children, and national-level rules in Member States that have implemented stricter age verification or parental-consent regimes. Advertisers running campaigns on WhatsApp Channels need to adjust audience definitions to align with the layered regime. The simplest defensive posture is to set a hard floor at age eighteen for all targeted advertising on the surface, but the floor does not relieve the obligation to verify that the floor is enforced. Platforms apply their own age inference, and advertisers should request transparency on the age signal accuracy that the platform commits to. Industries with cross-cutting minors exposure — gaming, fashion, food and beverage, education, entertainment — should also document compliance with the AVMSD restrictions that apply to commercial communications likely to reach minors regardless of explicit targeting. The Commission has signalled that minors protection is a priority for the second wave of DSA enforcement, with multiple active proceedings against other VLOPs already targeting failures to implement Article 28 effectively. Advertisers caught running profiling-based ads to minors face platform-level account restrictions in the first instance and Article 52 administrative fines in the second instance, and the reputational consequences extend to civil society pressure and journalistic scrutiny. For a deeper review of minors protection across platforms, see Meta's teen accounts rollout and Kids & Teens compliance .

What financial penalties can the Commission impose if Meta misses the WhatsApp deadline?

Article 74 of the Digital Services Act gives the European Commission the power to impose fines of up to six percent of the total worldwide annual turnover of the platform operator in the preceding financial year for non-compliance with the substantive obligations of the Regulation. The six percent cap is applied to the corporate group rather than to a single product line — Meta Platforms Inc. is the obligated entity for WhatsApp, Facebook, Instagram, and any other Meta-operated VLOP, and the turnover base is therefore the consolidated annual revenue of the corporate group. On the basis of Meta's most recent reported revenue, a six percent fine sits in the range of nine to ten billion euros. The Commission has not previously imposed a fine at the cap level on any VLOP, but it has confirmed that the cap is available and that financial penalties will scale with the severity, duration, and recidivist profile of the breach. The Commission can also impose periodic penalty payments under Article 76 of up to five percent of average daily worldwide turnover for each day of continuing non-compliance, applied from the date specified in a Commission decision. The periodic penalty mechanism is designed to compel compliance during enforcement proceedings rather than to punish a single past breach, and it can accumulate substantial sums quickly when a platform contests an enforcement decision while continuing the underlying conduct. Cross-platform precedent matters for the WhatsApp case. The Commission's enforcement record across the first eighteen months of DSA operation includes formal proceedings against X, TikTok, Meta, and AliExpress on a range of obligations, with several proceedings still open and facing potential financial sanctions in the second half of 2026. Civil society organisations and the European Parliament have publicly pushed for the Commission to use the full enforcement toolkit on the next major breach, and the WhatsApp deadline is a high-visibility test of the Commission's willingness to do so. Advertisers should therefore assume that platform-level compliance pressure on Meta will translate into stricter enforcement at the campaign level. Account suspensions, creative rejections, and audience-targeting friction will all increase as Meta tightens its own internal review to avoid Commission action. Advertisers running EU-targeted campaigns on WhatsApp Channels should pre-clear creative and audience definitions, document all targeting decisions in advertiser-side records that align with the public repository, and route any borderline placement through legal and compliance review before launch. For a multi-jurisdiction view of the financial exposure pattern, run Legal Compliance Scan against current campaigns.

What advertiser-side records should I maintain to align with the WhatsApp DSA repository?

The Article 39 ad repository provides public visibility into the content and targeting of advertisements, but the legal obligations sit on both the platform and the advertiser. Advertisers running campaigns on WhatsApp Channels in the European Union should maintain advertiser-side records that align with what the platform repository will publish, both to pre-empt mismatches that draw scrutiny and to support response to information requests from supervisory authorities. The records should cover seven categories. Category one is the legal-entity-level identity record. Document the legal name of the advertiser, the legal name of any payer-on-behalf-of party and any beneficiary party, the registered office address, and the business verification artefacts that Meta required during onboarding. Mismatches between the legal entity record and the repository entry are the most common trigger for civil society and journalistic scrutiny. Category two is the creative artefact record. Retain a copy of every creative variant that ran in the campaign, including dynamic creative permutations, with timestamped activation and pause records. Category three is the targeting taxonomy record. Document the audience definition in plain language that maps to the repository's targeting taxonomy fields, including any custom audience used, any lookalike audience used, any interest or behavioural category used, and any geographic or demographic parameter applied. Category four is the spend and reach record. Retain budget allocation, daily spend, and platform-reported reach by Member State for at least one year after the campaign ends, matching the repository's retention period. Category five is the policy-review artefact. For each campaign, document the pre-launch compliance review including any rejection-prediction tooling output, any legal sign-off, and any creative-modification history. Category six is the consent and lawful basis record. Document the lawful basis under GDPR for any processing that supported the campaign, including custom audience matching, conversion measurement, and engagement-based audience expansion. Category seven is the change record. Document any modification to the live campaign — creative swap, budget change, audience adjustment — with timestamps, because the public repository will reflect the campaign as it ran rather than as it was originally designed. The seven-category record is not a regulatory minimum but a practical defensive posture. Supervisory authorities and civil society organisations build investigations from the public repository and request advertiser-side records to corroborate or challenge what the repository shows. Advertisers who can produce the records on twenty-four-hour notice fare materially better in regulatory engagement than those who reconstruct from memory or platform-side exports. For ongoing campaign documentation tooling and review patterns, see AI Compliance Audit and Meta Ad Policies .

WhatsApp DSA Compliance 2026: Mid-May VLOP Deadline Guide

WhatsApp Channels DSA Compliance May 2026: The Mid-May VLOP Deadline, Article 39 Ad Repository & Advertiser Obligations

Inside This Compliance Report

1Why the Mid-May Deadline Matters
2Designation Timeline & Enforcement Trigger
3Article 39 Ad Repository Obligations
4Sensitive-Category Targeting Restrictions
5Minors Protection Under Article 28
6Systemic Risk & Crisis Response
7Penalty Exposure: 6% Global Turnover
8Advertiser Compliance Checklist
9Frequently Asked Questions

Why the Mid-May Deadline Matters

On January 26, 2026, the European Commission formally designated WhatsApp Channels as a Very Large Online Platform under Article 33 of the Digital Services Act. The designation followed Meta's own user-count submission, which reported that Channels had reached 51.7 million average monthly active recipients in the European Union during the first half of 2025 — well above the 45 million VLOP threshold. From the date of designation, Meta has four months to bring WhatsApp into compliance with the additional VLOP obligations the DSA layers on top of the baseline duties that already applied to the platform.

That four-month window expires in the second half of May 2026. Once it does, the Commission's enforcement powers activate in full: information requests, on-site inspections, interim measures, public commitments, and ultimately Article 74 fines of up to six percent of Meta's worldwide annual turnover. The deadline is not a soft target, and the Commission has been explicit that it intends to enforce.

For advertisers, the substantive impact is concentrated in three areas. WhatsApp Channels ads must now be discoverable through a public Article 39 repository. Targeting must align with the special-category and minors restrictions in Articles 26 and 28. And campaign records on the advertiser side must support a level of disclosure that most teams have not yet operationalised on the WhatsApp surface.

"The four-month clock for WhatsApp Channels VLOP compliance ends in mid-May 2026. From that point, every paid placement on the surface sits inside the same disclosure and targeting regime that already applies to Facebook and Instagram — and the Commission has signalled that it will enforce."
— AuditSocials regulatory brief, May 2026

Track the Commission's transition from preparation to enforcement and any platform-level documentation changes through the Policy Tracker, which monitors EU DSA announcements alongside Meta's policy pages.

Designation Timeline & Enforcement Trigger

The legal sequence runs from the user-count submission through designation to the cutover. Each stage has a specific procedural function, and the mid-May deadline only makes sense when read against the full timeline.

Key Dates

Date	Event	Legal Effect
August 17, 2025	Meta submits Article 24(2) user-count report	Channels reported at 51.7M average monthly EU recipients (H1 2025)
January 26, 2026	Commission designates WhatsApp as VLOP	Article 33(4) designation triggers four-month compliance clock
February 2026	Meta files initial systemic risk assessment plan	Articles 34 and 35 risk assessment scope confirmed
April 2026	Ads repository technical scoping complete	Article 39 endpoint and field mapping in scope for review
Mid-May 2026	Four-month compliance window expires	Commission enforcement powers activate in full
Q3 2026	First independent annual audit cycle begins	Article 37 audit firms scope WhatsApp-specific assurance work

The relevant cutover for advertisers is the mid-May date. Before it, the Commission's leverage runs through dialogue and pre-enforcement engagement. After it, the formal proceedings under Articles 66 to 76 are available, including non-compliance decisions, periodic penalty payments, and the financial sanctions cap.

Article 39 Ad Repository Obligations

Article 39 requires every VLOP that displays advertising to maintain a public, machine-readable repository of the ads it has served. The repository must support search, filtering, and programmatic access, and must retain records for at least one year after the ad last appeared. Meta already operates Article 39 repositories for Facebook and Instagram, but WhatsApp Channels is a new surface and the Commission will scrutinise scope, completeness, and accuracy in the first audit cycle.

Required Disclosure Fields

Advertiser identity: Verified legal name, registered office, payer-on-behalf-of and beneficiary parties
Run period: Activation timestamp, pause timestamp, total active days
Reach: Total impressions in the EU and per-Member-State breakdown
Targeting parameters: Category-level targeting taxonomy used to determine the audience
Commercial nature: Whether the ad was paid, boosted, or otherwise commercial
Creative artefact: Full creative including any dynamic permutations

The targeting field is the highest-risk disclosure for most advertisers. Civil society researchers and supervisory authorities monitor public repositories for evidence of sensitive-category targeting, deceptive disclosure, or inconsistent advertiser identity records. Advertisers should pre-clear targeting taxonomies through compliance review before campaigns go live, and route any borderline placement through AI Compliance Audit for automated screening against EU rules.

Cross-Repository Comparison

Surface	Repository Endpoint	Retention	Targeting Field
Facebook & Instagram	Meta Ad Library	Year+ (politics: 7 years)	Category-level taxonomy
WhatsApp Channels	Scoped subset of Ad Library (planned)	1 year minimum	Category-level taxonomy
TikTok	Commercial Content Library	1 year minimum	Category-level taxonomy

Sensitive-Category Targeting Restrictions

Article 26(3) of the DSA prohibits the presentation of advertising based on profiling using GDPR Article 9 special categories — health, race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, biometric and genetic data. The prohibition is absolute and applies regardless of whether the advertiser purchased the targeting directly or whether the platform inferred it from observed behaviour.

WhatsApp-Specific Risk Patterns

Channel-following signal: The Channels a user follows can themselves reveal special-category membership; targeting based on follow patterns triggers Article 26(3) review even when no explicit category is selected.
Lookalike audience drift: Lookalike seeds derived from special-category-adjacent custom audiences can carry forward the prohibited inference, and advertisers should re-validate seed integrity before porting to WhatsApp Channels.
Geographic micro-targeting: Combining narrow geography with health, religion, or political proxies can be reconstructed as profiling on a special category in regulatory review.

For regulated industries — pharmaceutical, healthcare, gambling, alcohol, political — assume WhatsApp Channels carries higher targeting friction than the other Meta surfaces. See healthcare compliance and gambling regulation for vertical-specific guidance, and reference EU DSA Compliance for the consolidated regulatory frame.

Minors Protection Under Article 28

Article 28 prohibits VLOPs from presenting advertising based on profiling using the personal data of recipients when the platform is aware with reasonable certainty that the recipient is a minor. The prohibition is broader than the Article 26(3) special-category bar because it applies to profiling-based advertising in general, not only to special categories. WhatsApp Channels is used widely by minors across the EU, and the mid-May deadline brings the surface fully into the layered minors regime.

Layered Regime

DSA Article 28: No profiling-based ads to known or reasonably inferred minors
GDPR Article 8: Parental consent threshold for processing children's data (age 13 to 16 depending on Member State)
AVMSD: Restrictions on commercial communications likely to reach minors
Member State rules: National-level age verification and consent requirements

The defensive posture for advertisers is a hard age-eighteen floor on WhatsApp Channels campaigns combined with documentation of the platform's age-signal accuracy commitments. For category-specific minors compliance, see Meta teen accounts rollout and Kids & Teens compliance.

Systemic Risk & Crisis Response

Articles 34 and 35 require VLOPs to identify, analyse, and mitigate systemic risks stemming from the design, functioning, and use of their services. The catalogue of risks the DSA identifies includes the dissemination of illegal content, negative effects on the exercise of fundamental rights, negative effects on civic discourse and electoral processes, and negative effects on public health, minors, physical and mental wellbeing, or gender-based violence.

The systemic risk regime affects advertisers indirectly. Platforms tighten internal review and creative-policy enforcement to demonstrate mitigation effectiveness in the annual audit, and the friction lands on creative variants that probe sensitive content adjacencies, on targeting choices that touch contested categories, and on volume scaling that triggers behavioural-pattern review. Advertisers running EU-facing campaigns on WhatsApp Channels should expect first-pass rejection rates to be higher in the months immediately after the deadline, and should pre-clear creatives through Meta Rejection Predictor before submitting at scale.

Article 36 crisis response protocols come into play during designated crisis events — public health emergencies, electoral periods, armed conflicts. During a designated crisis, the Commission can require additional mitigation measures across VLOPs, and advertiser-side compliance posture should anticipate temporary tightening on creative latitude during these windows.

Penalty Exposure: 6% Global Turnover

Article 74 caps non-compliance fines at six percent of the platform operator's worldwide annual turnover in the preceding financial year. For Meta, the relevant turnover base is the consolidated group revenue, which places the maximum fine in the nine to ten billion euro range based on most recent reporting. Article 76 periodic penalty payments add a daily-accumulating sanction of up to five percent of average daily worldwide turnover for each day of continuing non-compliance.

Advertisers do not face Article 74 fines directly — those land on the platform — but the platform-level enforcement pressure translates into stricter campaign-level review, more aggressive account-level enforcement, and tighter creative latitude. Advertisers running EU campaigns on Meta surfaces should pre-clear creative and audience definitions, document targeting decisions in advertiser-side records, and route borderline placements through Legal Compliance Scan for multi-jurisdiction review before launch.

Advertiser Compliance Checklist

[ ] Confirm legal entity, payer-on-behalf-of, and beneficiary records align with Meta business verification artefacts
[ ] Pre-clear creative variants through rejection-prediction tooling before submission
[ ] Audit targeting taxonomies for special-category proxies — interest, behavioural, geographic micro-targeting
[ ] Document audience definitions in plain language that aligns with the public repository's targeting field
[ ] Set hard age-eighteen floor on EU-targeted WhatsApp Channels campaigns
[ ] Retain creative, targeting, spend, and reach records on the advertiser side for at least one year
[ ] Document lawful basis under GDPR for any processing that supports the campaign
[ ] Build the public repository feed into routine compliance review cadence
[ ] Pre-clear regulated-industry placements (health, gambling, alcohol, political) through legal review
[ ] Track Commission enforcement signals through the Policy Tracker

Don't miss the next policy change.

Subscribe to the Policy Tracker — get weekly digests or instant Pro alerts across all 8 platforms. Or try our free Keyword Risk Checker first.

Subscribe Free

Report Keywords — Run AI Compliance Audit

#WhatsApp Ads#Meta Ads#EU DSA#VLOP Compliance#DSA Article 39#Ad Repository#GDPR#Sensitive Category Targeting#2026 Policy#Advertisers#Compliance Guide 2026#European Markets

Share This Report

Tweet Share

WhatsApp Business API & Click-to-WhatsApp Ads Compliance Guide 2026 — Messaging Rules, Opt-In Requirements & Meta Policy

WhatsApp Business API and Click-to-WhatsApp ads are powerful tools for reaching customers directly — but Meta enforces strict messaging rules, opt-in requirements, and template approval processes that advertisers must follow. This guide breaks down the 2026 compliance landscape including the 24-hour messaging window, spam limits, GDPR obligations, and enforcement penalties.

Ofcom Online Safety Act Enforcement May 2026: 4chan £520K, AVS Group £1M & The Age Assurance Wave Hitting Advertisers

Ofcom's enforcement docket built up through Q1 2026 with the £1M AVS Group fine and the £520K 4chan penalty. The age-assurance wave is now reshaping advertiser-facing surfaces — here is what changes for ad buying through May 2026.

EU DSA Article 39 Ads Repository Q1 2026 Audit Findings — Advertiser Disclosure Gaps, Repository Quality Issues & Cross-Platform Compliance Implications

Independent research on the Q1 2026 DSA Article 39 ads repositories shows substantial disclosure gaps across the four largest VLOP advertising platforms. Missing targeting fields, late publication, and inconsistent advertiser identity verification expose campaigns to research, regulator, and competitor scrutiny.

WhatsApp Channels DSA Compliance May 2026: The Mid-May VLOP Deadline, Article 39 Ad Repository & Advertiser Obligations