What exactly is published in the X DSA ad repository, and what is not?

The X DSA ad repository, published under the Article 39 transparency obligations of the EU Digital Services Act, contains a structured record of paid advertisements that ran on X reaching EU users during the period the repository covers. The published fields and the absent fields together define the competitive intelligence value of the repository and the exposure that advertisers should understand. The published fields include the advertiser identity (the name registered with X for billing and identification purposes), the period the advertisement ran (start and end dates), the targeting parameters used for the campaign at a generalized level (categories such as geography, demographic age bands, interest categories without surfacing individual user-level targeting), the content of the advertisement (creative copy, visible images and video, the destination URL if displayed), the language or languages the ad ran in, and an estimate of the reach within the EU. The repository typically does not include individual user-level targeting (specific cookie IDs or interest match scores), the bid amounts or bid strategy used, the campaign optimization goals, the conversion data, the audience matching lists in source form, the creative iteration history within a campaign, the agency or media buyer identity if different from the advertiser, the internal campaign naming or attribution structure, the reach outside the EU (the repository scope is EU-facing reach), or any data covered by separate privacy protection that would identify individuals. The repository structure is therefore generous enough to expose campaign strategy at a recognizable level (which creative, which messaging, which audience segments, which geographies, which timing) while not exposing the bid-level or conversion-level data that would constitute trade secret in the strict sense. The exposure level is sufficient to support competitor intelligence at the strategic and creative level even if not at the operational bid level. The fielded structure produced by Article 39 is the same across all very large online platforms designated under the DSA, although the specific implementation choices on retention period, search interface design, language metadata, and API rate limits vary across platforms. The X repository covers a minimum one-year retention window after the advertisement last ran, with the practical effect that any campaign running in the current period will remain inspectable for at least twelve months after its end. Advertisers should treat that retention window as a floor rather than a ceiling — third-party researchers and competitive intelligence services routinely ingest the repository data into external storage that survives the platform's published retention, so any entry should be planned as if it will be effectively permanent from a competitive intelligence perspective. The repository also includes a defined set of metadata that supports cross-entry analysis: a stable advertiser identifier that links entries by the same advertiser across campaigns, language coverage data that identifies which European languages the creative was distributed in, and reach estimate banding that allows aggregate analysis of campaign scale without disclosing exact reach. The combination of these supporting fields with the primary creative and targeting data makes the repository structurally suitable for longitudinal analysis of an advertiser's strategy over time, not just for spot checks on a single campaign. Compliance practice visible in the repository — claim language, disclosure presence, sensitive-category handling — is also a function of what the repository surfaces, even though compliance is not formally a repository field. Where claim language in repository creative is unsubstantiated or sectoral disclosure is missing, the repository serves as published evidence of the practice. Advertisers should therefore audit their repository profile both for what the repository explicitly publishes and for what the repository implicitly evidences about the advertiser's compliance program. For ongoing DSA repository tracking and update monitoring see the Policy Change Tracker and the EU DSA Compliance Guide .

How are competitors actually using the X ad repository for intelligence?

Competitor intelligence use of the X ad repository has developed into a structured discipline over 2024-2026 across larger advertisers in regulated and competitive categories, and the patterns now operate as a meaningful workstream within competitive marketing teams. Understanding the patterns helps an advertiser audit its own exposure realistically rather than from theoretical examples. The most common competitor pattern is creative intelligence — collecting and analyzing the actual ad creative running across competitors to understand messaging direction, value proposition emphasis, visual approach, and creative iteration rate. The repository provides a substantially complete view of what creative is currently running and what has run recently, enabling competitive creative teams to track messaging shifts in near real time. Brands that previously relied on third-party ad intelligence services discover that the DSA repository provides higher fidelity, more complete coverage, and no licensing cost. The second pattern is audience targeting reverse engineering. The generalized targeting parameters published in the repository indicate which audience segments competitors prioritize, which geographies they emphasize, and how they layer targeting (broad versus narrow, single segment versus stack). Competitive teams use the pattern to infer audience strategy and to identify opportunity gaps (geographies or segments a competitor is not addressing). The targeting fields do not surface individual user matching, but the strategic targeting profile is recognizable. The third pattern is campaign cadence and budget signaling. While the repository does not publish budget amounts, the campaign duration, frequency, and breadth of running ads signals the relative scale of effort. Competitors who run consistently with broad creative variation are signaling sustained investment; competitors who pulse with concentrated effort during specific windows are signaling tactical campaign strategy. Competitive teams use the cadence signals to anticipate competitor moves and to time their own activity. The fourth pattern is regulatory and risk surveillance. Competitive intelligence teams monitor competitors for advertising claims, disclosure practices, and compliance posture visible in repository creative. Competitors with weaker compliance practices generate intelligence value as either market opportunity (where the competitor risk is high) or as a comparison baseline for the team's own compliance investment. The repository has become a primary input to competitive compliance intelligence. The fifth pattern, less mature but emerging, is creative variation analysis at the campaign level. Where the repository surfaces multiple creative within a campaign window, teams can infer the creative testing program structure, which provides direct insight into competitor creative strategy. The six-month longitudinal view of a competitor's creative iteration rate, the ratio of long-running validated creative to short-lived test variants, and the time between creative refresh cycles all signal the operational sophistication of the competitor's creative program. Competitive teams that have integrated this view typically find that it is more useful for strategic positioning than for tactical response, because by the time a competitor's testing program is visible the test has already happened — but the integrated signal supports planning the advertiser's own next-quarter creative program with grounded benchmarks. The sixth pattern, which has emerged in 2026 as larger advertisers have invested in repository analytics infrastructure, is cross-platform competitive synthesis. Teams that ingest the X repository alongside the Meta ad library, the TikTok ad library, and the Google ad transparency center build a unified view of competitor activity that reveals platform allocation choices, message consistency or divergence across platforms, and tactical sequencing where the competitor leads on one platform and follows on others. The cross-platform synthesis is more analytically expensive to maintain but produces strategic insight that single-platform monitoring cannot. Advertisers should expect that competitors of any scale have built or are building this synthesis capability, and should plan their own repository profile accordingly — coherent creative posture across platforms produces a defensible cross-platform repository profile, while inconsistent posture across platforms produces a fragmented repository profile that signals organizational gaps. The seventh pattern is competitive opportunity identification through repository negative space — analyzing which segments, geographies, languages, or creative themes competitors are not addressing in their repository entries. Negative-space analysis is particularly useful in mature categories where the dominant competitors have full repository coverage and the opportunity sits in adjacencies they have not entered. The technique requires careful methodology because absence in the repository can reflect either strategic non-pursuit or simple staging gaps, but applied with discipline it surfaces actionable opportunity. For competitive intelligence frameworks across platforms see the enforcement digest .

How do researchers and regulators access the repository, and what scrutiny does it create?

Researcher and regulator access to the X DSA ad repository operates through structured channels under DSA Articles 40 and 41, and the access pattern creates a scrutiny layer that advertisers should understand because it produces enforcement and reputational exposure independent of competitor intelligence use. The researcher access channel operates under DSA Article 40, which provides vetted researchers with access to platform data including the advertising repository under controlled conditions. Vetted researchers receive expanded access (beyond the public repository) to support specific research projects on platform-level patterns, advertising practices, and societal effects of advertising. Researchers operate under data protection obligations and produce published work that can identify specific advertisers, campaigns, or patterns. Advertisers should expect that their advertising practices may be subject to academic research scrutiny without the advertiser being notified, and that research findings may be published in formats that name the advertiser. The Commission and EU member-state regulator access channel operates under DSA Article 41 and the enforcement provisions of the regulation. Regulators access repository data for enforcement and supervisory purposes, including investigation of compliance with DSA transparency obligations, investigation of sectoral advertising compliance (medical advertising, financial advertising, alcohol advertising under national rules), and assessment of platform compliance with content-moderation and advertising-policy obligations. The regulator access produces enforcement risk directly when advertising practices visible in the repository do not comply with sectoral or platform obligations. The December 2025 EU Commission decision against X for €120 million addressed advertising transparency failures specifically, establishing that the repository is treated as primary evidence in DSA enforcement actions. Both the platform and the advertisers visible in the repository face the consequence that the repository serves as enforcement evidence. Advertisers should expect that compliance issues visible in repository data may be referenced in regulatory action even where the action's primary target is the platform. The civil society and journalist access channel operates through the public repository surface, which is open and indexed. Civil society organizations focused on advertising regulation, consumer protection, and platform accountability operate ongoing monitoring of repository data and produce public analysis. Journalists use the repository for investigative reporting on advertiser practices. Advertisers should expect that significant compliance issues visible in the repository may produce public coverage. The cumulative scrutiny layer means that the repository functions as an open compliance audit surface where any sustained pattern of non-compliance is visible to regulators, researchers, journalists, and competitors. The scrutiny supports compliance investment even where direct enforcement risk is moderate, because the reputational dimension compounds across audiences. A practical implication of the cumulative scrutiny model is that the cost of poor compliance practice in the repository is realized across several independent channels — regulator action under DSA or sectoral rules, civil society advocacy reports that name the advertiser, journalist coverage in trade and general press, academic research that cites the advertiser as a case study, and competitor reference in their own positioning work. The single underlying defect is recorded once in the repository but produces consequences in every channel that scrutinizes the repository. The compliance investment required to maintain a clean repository profile is therefore best understood as insurance against a multi-channel risk, not just against the headline enforcement risk. Advertisers operating in regulated sectors — health, financial services, alcohol, gambling, food, supplements — face the highest cumulative scrutiny because the sectoral regulators add a dedicated review channel that operates with subject-matter expertise specifically aimed at advertising practices. Repository monitoring by sectoral regulators is increasingly mature in 2026, and category-level reviews that compare advertisers within a sector are now a routine investigative entry point. The advertiser's posture should assume that sectoral regulators are reading the repository as a continuous compliance surface and that the audit cadence and remediation discipline need to support that assumption. For coordinated compliance posture see the EU DSA Compliance Guide and use the Legal Compliance Scan on paid creative.

What does a self-audit on the X ad repository look like, and what should it produce?

A self-audit on the X ad repository should produce a current view of the advertiser's own exposure, a competitive benchmark against peer advertisers in the same category, and a remediation list for content or practice that the advertiser would prefer not to be visible in repository form. The audit workflow has four phases — inventory, content review, comparative assessment, and remediation planning. The inventory phase identifies every advertisement currently visible in the X repository under the advertiser's identity, including any subsidiary or product-line identities, any agency-of-record identities that the advertiser uses, and any historical identity changes that may have produced multiple repository entries. The inventory should be exhaustive — partial inventories miss exposure on satellite or legacy identities. The inventory should also identify the time window of available data and the completeness of the repository's coverage of the advertiser's actual EU advertising during that window. Gaps may indicate either missing repository entries (which is a separate compliance question for the platform) or actual advertising gaps (which is normal). The content review phase examines each repository entry for compliance against the advertiser's current compliance posture. Creative content review covers advertising claims and substantiation (are claims supported by evidence the advertiser can produce), required disclosures (are mandatory disclosures present and prominent), sensitive category handling (does the content respect sectoral rules for health, financial services, gambling, alcohol where applicable), and brand-voice consistency (does the content represent the brand as the advertiser would currently approve it). The comparative assessment phase benchmarks the advertiser's repository profile against peer advertisers in the same category and against direct competitors. The assessment covers volume and cadence (is the advertiser running consistent with the category norm), targeting breadth (is targeting recognizable as appropriate or potentially over-broad), creative variation rate (does the creative testing pattern signal a deliberate program), and compliance posture (does the visible compliance practice match or exceed the category baseline). The comparative assessment supports both competitive positioning judgment and risk calibration — being significantly below the category compliance baseline produces direct exposure. The remediation planning phase produces a prioritized action list. Critical remediation addresses content that creates direct regulatory exposure (claims without substantiation, missing disclosures, sensitive-category violations) and content that creates brand-safety issues (off-brand creative, outdated messaging). Important remediation addresses content that creates competitive intelligence value the advertiser would prefer to limit (creative iteration patterns that reveal testing program structure, targeting patterns that reveal audience strategy). Optional remediation addresses content that could be cleaned up but does not create material exposure. The audit should run quarterly and feed into the advertiser's broader DSA compliance program. Quarterly cadence is a minimum, not a target. Advertisers with high creative velocity, in regulated sectors, or under elevated competitive pressure should run the audit monthly and treat it as part of the standing compliance operations rhythm rather than as a standalone exercise. The audit ownership should sit with a single named function — typically the DSA compliance program owner where one exists, otherwise the regulatory or legal team — so that the audit produces a coherent advertiser-wide view rather than fragmented per-region or per-product views that miss the cross-cutting patterns competitors and regulators will see. The audit outputs should produce both a working remediation backlog and a documented evidentiary record. The remediation backlog drives the operational marketing decisions — which campaigns to refresh, which creative to retire, which identity structures to consolidate — and should be tracked with owner, deadline, and verification. The evidentiary record supports regulator inquiry response — when a Digital Services Coordinator or sectoral regulator asks the advertiser to demonstrate its repository compliance practice, the evidentiary record produces the answer in defensible form. The two outputs should be maintained in parallel rather than being collapsed into a single document, because they serve different audiences and the regulatory documentation should be available without exposing the internal operational tracker. A mature audit program also feeds the marketing decision loop with positive intelligence, not just compliance findings. The competitive benchmarking that the audit produces is itself valuable as input to creative strategy, budget allocation, and category positioning. The audit should be designed so that its outputs are useful for marketing as well as for compliance — both because the dual utility supports continued investment in the program and because the marketing usefulness keeps the cross-functional engagement that the audit needs to surface inconsistencies. For audit tooling on creative compliance use the AI Compliance Audit and the Keyword Risk Checker .

Can advertisers reduce repository exposure without reducing compliance, and how?

Advertisers cannot exempt their advertising from DSA repository inclusion if the advertising reaches EU users on X — the inclusion is a mandatory platform-level obligation that does not depend on advertiser preference. However, advertisers can shape what appears in the repository through campaign structure, creative approach, and identity management in ways that reduce competitive intelligence value while maintaining or even strengthening compliance. The shaping is legitimate within the DSA framework and is common practice among advertisers that have integrated the repository into their strategic thinking. The first shaping lever is identity consolidation. Advertisers with multiple identities (parent brand, product lines, regional variants, joint ventures) face repository visibility under each identity, and inconsistency between identities can reveal organizational structure that would otherwise be private. Consolidating to a smaller number of clearly identified entities reduces fragmentation and makes the repository profile cleaner. Identity consolidation does not change advertising substance, only the structural visibility. The second shaping lever is creative testing discipline. Advertisers that test extensively in production environments see all the test creative in the repository, which exposes the testing program structure. Moving high-volume creative testing into pre-launch environments, with only the validated creative going to production paid distribution, reduces the test-iteration visibility. The shift produces better creative on the production surface (where only validated creative runs) while keeping experimentation private. The third shaping lever is targeting clarity. Broad targeting that runs across many audience segments produces repository entries spanning the full segmentation, which makes the audience strategy visible. Concentrated targeting on clearly defined segments produces tighter repository entries that signal less strategy. Concentrated targeting also tends to produce better campaign performance, so the shaping aligns with general best practice. The fourth shaping lever is timing structure. Continuous-running campaigns produce uninterrupted repository visibility; pulse campaigns concentrated in tactical windows produce cleaner repository entries with clear start and end. Both approaches have legitimate strategic uses, but the timing structure choice does affect repository readability. The fifth shaping lever is disclosure and compliance quality. The most reputationally damaging repository exposure comes from compliance issues visible in creative — missing disclosures, unsubstantiated claims, sectoral violations. Strong compliance practice produces clean repository entries that demonstrate professional advertising operation, which is the inverse of exposure. The strongest defensive posture is therefore to make the repository entries display competence rather than to try to obscure them. Beyond the five primary shaping levers, a sixth lever has emerged in 2026 as a practical advanced technique — coordination between the Article 26 in-product disclosure and the Article 39 repository entry. Advertisers who treat both surfaces as a single coherent transparency program, where the targeting parameters disclosed to a user at the moment of impression match the targeting parameters reflected in the repository entry for the same creative, produce a defensible cross-surface profile that does not surface inconsistencies for either regulator inquiry or competitor inference. The coordination work is invisible to the public but produces a repository profile that withstands scrutiny in a way that uncoordinated programs cannot. A seventh lever, applicable to advertisers with international footprints, is the relationship between the EU-facing repository entry and the global advertising program. Repository visibility is limited to EU-facing reach, but global creative consistency means that creative running globally will frequently surface in the EU repository regardless of EU-specific decisions. Advertisers should treat the EU repository as a window into the global creative program and shape the global program with EU repository visibility in mind, rather than attempting to maintain separate EU-specific creative that may diverge from the global standard and produce its own consistency risks. The defensive posture cannot eliminate exposure, but it can shape exposure so that what the repository surfaces reflects a deliberate, professional, compliance-aligned advertising program. That outcome is achievable through standard marketing operations discipline applied with awareness of the repository surface, and the work involved is largely overlap with what a well-run advertising program would do anyway. The discipline pays off both in reduced regulatory risk and in stronger competitive positioning, because a repository profile that signals professional operation is itself a competitive asset. For compliance-first posture see the X Ads Policy guide and the Legal Compliance Scan .

How does the X repository compare with Meta, TikTok, and Google ad repositories, and what is the cross-platform exposure picture?

The DSA ad transparency obligations apply uniformly to the very large online platforms designated under the regulation, but the implementation of the repository varies across platforms in ways that affect competitive intelligence value and advertiser exposure. Understanding the comparison supports a coordinated cross-platform repository strategy rather than treating each platform in isolation. The Meta ad library is the most mature of the major platform repositories, predating the DSA requirement and operating since 2018 across political and social issue advertising and since 2023-2024 across all advertising for EU users. The library publishes a broad set of fields and has substantial historical depth, making it the most analytically useful repository for longitudinal competitive analysis. Meta's coverage includes Facebook and Instagram and provides cross-product visibility. The TikTok ad library, mandated under DSA, publishes a comparable set of fields to Meta and X but the data structure and search interface are less mature, which raises the friction for competitive intelligence use. TikTok's coverage emphasizes the EU-facing inventory and has narrower historical depth than Meta. The Google ad transparency center covers Search, YouTube, Display, and other Google surfaces with substantial coverage but a fragmented structure across product types that makes cross-product analysis more complex than Meta's unified library. Google's coverage extends globally for political advertising and EU-focused for general advertising under DSA. The X repository, the focus of this audit guide, has fields and coverage comparable to peer VLOP repositories but with operational and quality issues that have been the subject of DSA enforcement (the December 2025 decision). Advertisers should expect ongoing repository improvements at X under the compliance program responding to enforcement action. The cross-platform exposure picture is therefore that every major paid advertising channel for EU users generates repository visibility, and the visibility is broadly comparable across platforms even where specific field implementations vary. Advertisers running campaigns across Meta, TikTok, Google, and X cannot escape repository visibility by shifting platforms — the visibility is structural across the major paid environment. The implication for competitive intelligence is that advertisers should treat repository monitoring as a cross-platform discipline, not a per-platform task. Competitive teams that monitor only one repository miss material activity by their competitors. The implication for advertiser defensive posture is that the shaping levers (identity consolidation, creative testing discipline, targeting clarity, timing structure, compliance quality) apply across platforms and should be implemented coherently rather than per platform. A coordinated cross-platform program also produces operational efficiencies that single-platform programs miss — the same creative approval workflow, the same disclosure templates, the same identity structure, and the same audit cadence can serve all four major repositories with marginal incremental cost beyond the work for any single one. The advertiser that treats DSA repository visibility as a single transparency program covering the EU-facing footprint, rather than as four separate platform-specific obligations, will spend less on the compliance program in aggregate and produce a more defensible profile across all four platforms. A specific operational point worth flagging is that the four major repositories surface creative at different granularities of variant — Meta surfaces every creative variant down to image-level changes, Google distinguishes across product types, TikTok publishes per-distinct-creative entries, and X publishes at a level comparable to Meta. Advertisers should normalize across the granularity differences when conducting comparative analysis, because raw entry counts are not comparable across platforms and can produce misleading inferences if treated as direct counts. The normalization is straightforward — compare unique creative concepts rather than raw entries — but it must be done deliberately. A final point on cross-platform exposure concerns the interaction with non-DSA repositories. Platforms operating outside the DSA designation (smaller social platforms, retail media networks, programmatic display surfaces) may not have repository obligations of comparable scope, but advertisers running on those platforms still face the structural fact that any creative reaching EU users will eventually appear in the DSA-regulated environment as well — through the same creative running on a DSA-designated platform, through screenshots and re-publication, or through future expansion of the DSA designation list. The defensive posture should be designed for the DSA repository surface even when current activity is on platforms outside the designation, because the compliance and creative discipline produces a repository-ready posture that does not require retroactive cleanup when the activity reaches a DSA surface. For coordinated cross-platform compliance posture see the EU DSA Compliance Guide and review the parallel Meta Ad Policies and Google Ads Policy guides.

X DSA Ad Repository 2026: Competitor Intelligence Risk

Quick Answer

The X DSA ad repository, published under Article 39 transparency obligations, exposes advertiser identity, ad creative, targeting parameters, reach metrics, and spend ranges for EU campaigns. Competitors and researchers can audit your spend, creative testing, and audience strategy without authorisation — advertisers should audit their own exposure proactively.

X DSA Ad Repository Audit 2026: What Competitors Can See About Your Spend

What the DSA Ad Repository Actually Exposes

The X DSA ad repository, published under Article 39 of the EU Digital Services Act, is the most consequential change to advertising transparency on the platform since the 2023 shift to the post-Twitter operating model. The repository is open, indexed, and free, which makes it a near-perfect competitive intelligence database. Most advertisers underestimate what their own repository profile reveals about strategy, creative testing, audience segmentation, and compliance posture, and the underestimation produces both missed competitive intelligence opportunities and avoidable exposure of the advertiser's own program.

The repository is not optional. Any advertising that reaches EU users on X is included in the repository under the platform's compliance program responding to the December 2025 enforcement decision that imposed a €120 million sanction for transparency failures. Advertisers cannot opt out, hide entries, or selectively expose campaigns. What advertisers can do is shape what the repository displays through campaign structure, creative discipline, identity consolidation, and compliance quality, in ways that reduce the competitive intelligence value of repository entries while maintaining or strengthening regulatory compliance.

Under Article 39 of the DSA, very large online platforms must compile and make publicly available repositories of advertisements served on the platform, with specified data fields; the obligation applies regardless of advertiser preference and is enforced against the platform.
— Paraphrase of DSA Article 39; not a verbatim quotation

This guide covers what the X repository specifically publishes, how competitors actually use the data, what scrutiny researchers and regulators apply, how to run a self-audit on your own repository profile, what defensive shaping is legitimate within the DSA framework, and how the X picture relates to Meta, TikTok, and Google repositories. For ongoing DSA-related policy tracking, see the Policy Change Tracker, and for broader regulatory posture, the EU DSA Compliance Guide.

Article 39 in Plain Language

Article 39 of the DSA establishes a positive obligation on every very large online platform to maintain a repository of advertisements served on the service, accessible through a documented interface, retained for one year after the advertisement last ran, and structured so that researchers and the public can query the dataset for a specific set of fields. The article does not give the platform discretion over inclusion, retention period, or field scope. Platforms must publish what the regulation enumerates. The supervisory framework in DSA Articles 49 through 56 then gives the Commission and Digital Services Coordinators direct authority to investigate non-compliance, to request information, and to impose sanctions up to six percent of global annual turnover. The combination of mandatory publication and unrestricted regulator access converts the repository from a transparency artifact into operational evidence used in enforcement. Advertisers should read Article 39 as describing not the platform's transparency posture but the advertiser's permanent visibility surface.

Treat every paid placement that reaches EU users as an entry in a public database that will be reviewable for at least twelve months after the placement ends. The regulation does not contain a small-advertiser carve-out, a sectoral exemption for non-political advertising, or a delay window for sensitive launches. The repository captures what was served, when it was served, and to whom in aggregate terms.

Why X Repository Quality Has Been Under Scrutiny

The €120 million sanction announced in December 2025 specifically named repository defects — incomplete entries, search interface friction, missing creative variants, and gaps between served advertising and published records — as evidence supporting the finding that the platform had failed its Article 39 obligations. The decision establishes that the Commission treats repository quality as substantively reviewable, not as a procedural formality discharged by publishing something nominally repository-shaped. The platform's compliance program responding to the decision involves measurable improvements to coverage, field completeness, and search reliability, and advertisers should expect that the repository they audit in 2026 will continue to evolve as the platform implements remediation. The relevant point for the advertiser is not the platform's enforcement risk in isolation but the operational fact that the repository will become more comprehensive over time, not less, and any current gaps should be treated as transient rather than as durable hiding places. For context on the underlying decision and its advertiser implications, see the cross-linked piece on X enforcement escalation patterns and the policy entry on X Ads policy.

Fields Visible in the X Repository

The repository structure publishes a defined set of fields per ad and explicitly excludes certain operational data. Understanding the precise list of published and absent fields is the basis for any audit, intelligence work, or defensive posture decision.

Published Fields

Field	Granularity	Intelligence Value
Advertiser identity	Registered billing name	Identifies the advertiser; reveals organizational structure where multiple entities exist
Campaign period	Start and end dates	Indicates campaign cadence and duration; supports tactical timing analysis
Targeting parameters	Generalized (geography, age bands, interest categories)	Reveals strategic audience choice without exposing user-level matching
Creative content	Copy, image, video, destination URL	Full creative intelligence; messaging, value proposition, visual approach
Language coverage	Per-language run periods	Indicates regional and language strategy
Estimated EU reach	Reach range within EU	Indicates relative scale of the campaign; not absolute spend

Excluded Fields

Bid amounts and bid strategy: Operational pricing data is not published.
Optimization goals: Campaign objectives and optimization signals are not in the repository.
Conversion data: Performance metrics beyond reach estimate are absent.
Source audience lists: Match lists and lookalike sources are not published.
Internal campaign naming: Attribution and naming structure remain private.
Non-EU reach: The repository covers EU-facing reach; broader global reach data is absent.
Agency identity: Where billing identity differs from the executing agency, the agency relationship is not visible.

Source: EU DSA Transparency Database, Article 39 framework; published under CC BY 4.0.

API Access and Rate Limits

Article 39 obliges platforms to expose the repository through programmatic interfaces, not only a search UI. X publishes the repository through an API that supports query by advertiser name, time window, language, and content keywords, with pagination and bulk-export capabilities that align with researcher needs and competitive intelligence workflows. Documented rate limits sit in a range that supports sustained monitoring rather than only spot checks — competitive intelligence teams that build automated daily pulls have not been finding the limits binding in practice. The API surface returns the same fields enumerated above and applies the same one-year retention. Advertisers should assume that any technically competent third party can ingest the repository in bulk, normalize it across the major platforms, and build longitudinal databases that survive the platform's one-year retention through external storage. A repository entry should therefore be treated as effectively permanent from the advertiser's planning perspective even though the platform itself only retains for the regulated minimum.

Data Quality and Coverage Gaps

The repository is regulated for completeness but the platform's implementation has historically had measurable defects — entries missing creative variants, language metadata absent or incorrect, reach estimates with implausible distributions, and creative-asset links that resolved to deleted media. Civil society analyses through 2024-2026 documented gaps consistently enough that the December 2025 decision cited the pattern. The advertiser's exposure interacts with these defects in two opposite ways. First, a current gap does not protect future visibility — entries can be backfilled as platform compliance improves, and any campaign currently running with imperfect repository representation should be planned as if its eventual representation will be complete. Second, gaps that affect competitors equally do not reduce the advertiser's relative exposure — the comparative intelligence analysis still proceeds on whatever data is published, and competitive teams compensate for gaps with overlay data from third-party intelligence services. The strategic posture should therefore assume full visibility rather than rely on current implementation defects.

Competitor Intelligence Patterns

Competitor intelligence use of the X repository has matured over 2024-2026 into structured workflows across larger advertisers in regulated and competitive categories. The patterns now operate as a meaningful workstream within competitive marketing teams, and understanding them helps an advertiser audit its own exposure realistically.

Pattern Map

Creative intelligence: Collecting and analyzing actual ad creative for messaging direction, value proposition emphasis, visual approach, and iteration rate. The repository provides higher fidelity than third-party ad intelligence services at no licensing cost.
Audience targeting reverse engineering: Inferring strategic targeting from published targeting parameters; identifying segments and geographies competitors prioritize and gaps competitors are not addressing.
Cadence and budget signaling: Without explicit budget data, campaign duration, frequency, and breadth signal relative scale of effort and tactical timing.
Regulatory and risk surveillance: Monitoring competitors for claims, disclosures, and compliance practice visible in creative; identifying market opportunity where competitor risk is high.
Creative variation analysis: Where multiple creative appears within a campaign window, inferring the testing program structure and creative strategy.

Workflow Maturity

The competitive intelligence workflow in 2026 typically includes a defined monitoring cadence (weekly to monthly depending on category dynamics), competitor identity tracking that handles parent-and-subsidiary structures, automated change detection on competitor creative, and structured intelligence outputs that feed strategic and tactical marketing decisions. Advertisers without an active repository monitoring program are leaving competitive intelligence value on the table relative to peers that have built the workflow.

For competitive compliance benchmarking use the AI Compliance Audit alongside repository monitoring.

Cross-VLOP Repository Comparison

Competitive intelligence work in 2026 is rarely platform-specific because every major paid environment for EU users now generates a repository entry under the DSA designations. Treating the X repository as the only monitoring surface misses material activity by the same competitors on Meta, TikTok, Google, and other DSA-designated platforms. The Meta ad library remains the deepest source of historical creative data and the most mature search interface; TikTok publishes a comparable field set with a younger query surface; Google distributes the repository across Search, YouTube, and Display product types, which raises ingestion complexity but preserves coverage. The X repository sits inside this cross-platform set with field parity to peers, scrutinized quality after the December 2025 decision, and an API surface that supports bulk competitive monitoring. The practical implication is that an advertiser auditing its own X exposure should expect competitors to be running parallel monitoring across all four major repositories, and any compliance issue visible on X is also presumed visible to competitors who watch the full set.

Inferring Budget and Spend Despite Excluded Fields

The repository excludes explicit budget and bid data, but competitive intelligence teams have developed reliable inference methods that work around the exclusion. Volume of distinct creative entries, breadth of language and geographic coverage, duration of continuous-running placements, and density of creative variation within campaign windows all correlate with spend in ways that produce useful relative estimates. Repository monitoring overlaid with third-party panel data and platform-reported reach ranges can support spend models with practical accuracy at the order-of-magnitude level for competitive purposes. Advertisers should not assume that the absence of explicit budget data hides spend posture — the strategic spend pattern is recoverable from the published surface by anyone willing to model it.

Researcher and Regulator Access

The repository creates a scrutiny layer beyond competitor use, because researchers and regulators have structured access channels that produce enforcement and reputational exposure independent of competitive intelligence.

Access Channels

Channel	Authority	Output Type
Vetted researcher	DSA Article 40	Academic and policy research that may identify advertisers
EU Commission and member-state regulators	DSA enforcement and supervisory powers	Enforcement actions; sectoral compliance investigations
Civil society organizations	Public repository access	Public analysis, advocacy reports, consumer protection focus
Journalists	Public repository access	Investigative reporting on advertiser practices
Competitors	Public repository access	Competitive intelligence and benchmarking

Enforcement Precedent

The December 2025 EU Commission decision against X for €120 million addressed advertising transparency failures specifically, establishing the repository as primary evidence in DSA enforcement actions and confirming that advertiser compliance issues visible in repository data may be referenced in regulatory action even where the action's primary target is the platform.

Source: EU DSA Transparency Database; enforcement actions published under CC BY 4.0. For regulatory framework see the EU DSA Compliance Guide.

Regulator Inquiries Derived From Repository Data

The Commission and national Digital Services Coordinators have built investigative workflows that take the repository as an entry point. A typical pattern begins with a category-level review of creative across multiple advertisers in a regulated sector — medical advertising, gambling, financial services, food and dietary supplements — and identifies outlier patterns such as missing disclosures, ambiguous claim language, or targeting choices that engage sectoral rules. The outlier review then becomes the basis for a formal information request directed at the platform or, in coordination with national regulators, at named advertisers under sectoral law. Advertisers should expect that compliance defects visible in the repository can produce regulator contact even when the platform itself is not the subject of the underlying enforcement, because the repository is operating as a sectoral compliance surveillance surface in addition to a platform transparency tool. The defensive implication is direct — advertisers in regulated sectors should audit their repository profile against sectoral substantive requirements as well as against advertising policy.

Article 26 Transparency Interaction

Article 26 of the DSA imposes a separate transparency obligation that interacts with Article 39 in ways that compound advertiser visibility. Article 26 requires platforms to label individual advertisements clearly when displayed, to identify the natural or legal person on behalf of whom the ad is presented, and to disclose the meaningful parameters used to determine the recipient. The Article 26 disclosure occurs at the moment of impression and is visible to the user receiving the ad; the Article 39 disclosure occurs in the repository and is visible to anyone querying after the fact. The two surfaces should be consistent — an advertiser whose Article 39 entries show targeting parameters that differ from what the Article 26 in-product disclosure surfaced to users is exposed both for the substantive practice and for the cross-surface inconsistency. The audit posture should therefore reconcile Article 26 disclosures and Article 39 entries as a single transparency program rather than as two unrelated obligations.

Self-Audit Workflow

A self-audit on the X repository produces a current view of the advertiser's own exposure, a competitive benchmark, and a remediation list. The workflow has four phases that should run quarterly.

Phase Sequence

Inventory: Every advertisement currently visible under the advertiser's identity, subsidiary identities, agency-of-record identities, and historical identity changes. Exhaustive across the time window the repository covers.
Content review: Per-entry compliance review covering advertising claims and substantiation, required disclosures, sensitive-category handling, and brand-voice consistency.
Comparative assessment: Benchmark against peer advertisers in the category on volume, targeting breadth, creative variation, and compliance posture.
Remediation planning: Prioritized action list — critical (regulatory exposure), important (competitive intelligence reduction), optional (general cleanup).

Audit Outputs

Compliance remediation list: Specific content requiring update, replacement, or removal from current campaigns.
Defensive shaping plan: Structural changes to reduce competitive intelligence value without reducing compliance.
Competitive benchmark: Position relative to category peers; identification of best-practice peer examples.
Compliance baseline documentation: Evidence of audit process for regulatory inquiry response.

For automated audit input on creative compliance use the AI Compliance Audit and the Keyword Risk Checker.

Brand-Owned Repository Visibility Posture

Brands that have not run a self-audit consistently discover three classes of finding when they begin. The first is unrecognized identity fragmentation — repository entries appearing under names that the central marketing team did not realize were active, often because regional teams, joint ventures, or product-line organizations have run their own campaigns under their own billing identity. The second is creative that no longer represents the current brand position — old taglines, deprecated claims, or product packaging that has been retired but is still appearing in repository entries for campaigns that have not been formally archived. The third is disclosure quality that varies across creative within the same campaign, where some variants include required regulatory disclosure language and others do not, producing a repository pattern that signals inconsistent compliance practice. None of these classes is an artifact of the repository — they reflect the underlying state of the advertiser's program, and the repository simply makes the state visible to anyone who looks. The audit should be scoped to capture all three classes as standard outputs.

Audit Cadence and Ownership

Quarterly cadence is the minimum responsible interval. Categories with high creative velocity, regulated sectoral pressure, or material competitive activity warrant monthly cadence. Ownership should sit with a named function — compliance, legal, or a dedicated DSA program owner — rather than being distributed across regional marketing teams, because the repository is a single surface and the audit needs a single view across the whole advertiser footprint. The audit outputs should feed into both the marketing decision loop (creative refresh, campaign retirement) and the compliance documentation loop (evidence of process for regulatory inquiry response). Both feeds are required for the audit to produce its intended risk reduction.

Defensive Posture Without Reducing Compliance

Defensive posture toward the repository operates through legitimate shaping levers that reduce competitive intelligence value while maintaining or strengthening compliance. Each lever is within the DSA framework and aligned with general best practice.

Shaping Levers

Identity consolidation: Consolidate to a smaller number of clearly identified entities; reduce fragmentation across parent, subsidiary, and regional identities.
Creative testing discipline: Move high-volume creative testing to pre-launch environments; only validated creative goes to production paid distribution.
Targeting clarity: Concentrated targeting on clearly defined segments produces tighter repository entries than broad-segment campaigns.
Timing structure: Pulse campaigns concentrated in tactical windows produce cleaner repository entries than continuous-running campaigns.
Compliance quality: Strong compliance practice produces repository entries that demonstrate professional operation; the inverse of exposure.

What Does Not Work

Opt-out attempts: The repository inclusion is mandatory; no opt-out exists.
Entity obfuscation: Using ambiguous billing names to obscure identity creates regulatory exposure and does not effectively hide identity from competent intelligence work.
Targeting obfuscation: Excessively broad targeting to hide specific strategy degrades campaign performance and still reveals strategy through aggregate patterns.
Repository disclosure delay: Platform-side gaps in publishing timeliness are platform compliance issues, not advertiser-controllable defensive posture.

Source: EU DSA Transparency Database framework; CC BY 4.0. For audit and compliance tooling see the Legal Compliance Scan.

Aligning Article 26 and Article 39 Programs

The defensive program that produces the strongest repository profile is one that treats Article 26 in-product disclosure and Article 39 repository publication as a single coherent transparency surface rather than as two disconnected obligations. The advertiser should be able to demonstrate that the targeting parameters disclosed in-product to a user at the moment of impression are the same parameters reflected in the repository entry for the same creative. Internal documentation should map the campaign setup to both surfaces and reconcile any drift. Where third-party ad-server intermediation introduces complexity in the disclosure chain, the documentation should track which entity is responsible for each surface and how the chain produces a consistent advertiser-facing record. The reconciliation work is not visible to the public, but it produces a repository profile that does not contradict itself and that can be defended in regulator inquiry without procedural surprises.

Documenting the Defensive Posture

Each shaping lever should produce documentation that can be presented in regulator inquiry as evidence of a deliberate, compliance-aligned program. Identity consolidation produces an identity map with rationale. Creative testing discipline produces a pre-launch testing log that demonstrates validated-only production deployment. Targeting clarity produces a targeting methodology document. Timing structure produces campaign calendars with stated tactical rationale. Compliance quality produces sign-off records on creative. None of the documentation creates new obligations beyond what good marketing operations would already produce — the point is that the documentation makes the defensive posture inspectable, which is the posture's actual value to the advertiser facing scrutiny.

X Ad Repository Audit Checklist

[ ] Inventory every X repository entry under advertiser, subsidiary, and agency identities
[ ] Confirm registered advertiser identity matches verified brand handle
[ ] Review each entry for claim substantiation and required disclosures
[ ] Confirm sensitive-category creative complies with sectoral rules visible in repository
[ ] Benchmark against peer advertisers in category on volume, cadence, targeting breadth
[ ] Identify creative testing patterns visible in repository; move volume testing pre-launch
[ ] Consolidate fragmented identities where appropriate; document remaining structure
[ ] Document audit process and outputs for regulatory inquiry response
[ ] Schedule quarterly repository audit as part of DSA compliance program
[ ] Apply same audit framework to Meta, TikTok, Google repositories cross-platform
[ ] Confirm DSA disclosure on creative independent of repository visibility
[ ] Monitor competitor repository profile as ongoing competitive intelligence input

Source: EU DSA Transparency Database, CC BY 4.0.

Frequently Asked Questions

For ongoing tracking of DSA enforcement, ad repository policy, and competitor intelligence framework updates, see the Policy Change Tracker.

Source: EU DSA Transparency Database, CC BY 4.0.

Don't miss the next policy change.

Create a free account — track every policy change across 8 platforms, get instant alerts, and access every free compliance tool. Or try our Keyword Risk Checker first.

Create Free Account

Report Keywords — Run AI Compliance Audit

#X Ads#DSA#Ad Repository#Ad Transparency#EU Regulation#Competitive Intelligence#Ad Compliance#Brand Safety#Advertisers#Agencies#2026 Policy#Compliance Guide 2026

Share This Report

Tweet Share

EU Political Advertising Regulation (TTPA) in 2026: Transparency Notices, Targeting Limits and the Platform Exit

The EU's Political Advertising Regulation now governs every political and issue ad in the bloc — with strict transparency, a near-total bar on profiled targeting, and a third-country sponsor ban that pushed Meta and Google out.

Temu's €200M DSA Fine in 2026: What Europe's Largest Platform Penalty Signals for Advertisers and Marketplaces

The European Commission fined Temu €200 million under the Digital Services Act — its largest platform penalty to date. Here is what systemic-risk enforcement means for advertisers and brands.

UK Online Safety Act Age-Assurance Enforcement 2026: How Ofcom's Ad-Network Business Disruption Lever Reaches Advertisers

Ofcom's Online Safety Act enforcement can reach beyond platforms to the advertising networks that fund them. With a July 2026 age-assurance effectiveness report due, here is how the business-disruption lever changes brand-safety calculus.