What Are the EU’s Ad Compliance Requirements for Apps?

What Is the Core EU Ad Compliance Law for Apps?

The EU Digital Services Act (DSA) is the primary ad compliance framework apps need to account for. It sets rules for how online intermediary services handle illegal content, advertising, user protection, and transparency, and it applies to any app or service offered to people located in the EU, regardless of where the company itself is based. The DSA entered into force in November 2022 and became generally applicable on February 17, 2024, with the largest platforms (Very Large Online Platforms and Search Engines) held to earlier obligations starting August 25, 2023. What a company must actually do depends on the type of service it provides — the DSA layers different requirements onto intermediary and hosting services, online platforms and marketplaces, with additional duties for the largest designated platforms.

What Does the DSA Actually Require for Advertising?

Five things, spanning different articles of the regulation.

1. Act on illegal content, including scam ads. Article 16 requires hosting services to provide a mechanism for reporting content believed to be illegal. Once a service has “actual knowledge” of illegal content, which can include a scam ad, Article 6 requires it to act expeditiously to remove it in order to keep its liability exemption. This isn’t hypothetical: between December 2025 and March 2026, consumer groups reported 893 suspected scam ads to Google, Meta, and TikTok — only 27% were removed, and 52% were rejected or ignored, leading to European Commission complaints filed in May 2026.
2. Don’t use deceptive ad or interface design. Article 25 prohibits interface designs that deceive or manipulate users. The Commission’s first DSA fine made this concrete: X was fined €120 million in December 2025, partly because its paid blue-checkmark system was found to be a deceptive design that made it harder for users to judge account authenticity and exposed them to impersonation scams.
3. Don’t promote illegal products. Article 3(h) defines illegal content to include the sale of non-compliant or counterfeit products. Temu (€200 million, May 2026) and AliExpress (€550 million, July 2026) were both fined over illegal, unsafe, and counterfeit product listings, with the findings extending to how recommender systems and promotion amplified them.
4. Don’t target minors with profiling-based ads. Article 28(2) prohibits presenting ads based on profiling when a platform is aware, with reasonable certainty, that the recipient is a minor. The European Commission’s July 2025 guidelines, while non-binding, are a compliance benchmark that also call for commercial content shown to minors to be age-appropriate and free of pressure tactics like countdown timers or costs obscured through virtual currencies and loot boxes.
5. Provide ad transparency. Article 26 requires disclosing, in real time, who paid for an ad and why it was shown to a given user. The IAB Tech Lab’s OpenRTB DSA Transparency Extension is the standardized way this information travels through a programmatic transaction, and some buyers will reject bids that are missing the required disclosure data.

Does the DSA Apply to My App If I’m Not a “Very Large” Platform?

Not every DSA obligation applies to every company, but that doesn’t mean smaller apps are exempt from all of it. The DSA layers different duties by service type — the heaviest requirements, like the public ad repository, apply only to the largest designated platforms and search engines, but hosting-service obligations like acting on illegal content notices apply more broadly. Any app relying on ad partners or SDKs that are themselves regulated platforms can also be affected by how those partners configure their own disclosures and compliance data.

Do Gambling or Political Ads Carry Extra EU Requirements?

Yes, both are regulated on top of the DSA, and neither is a single EU-wide rule. Political advertising is governed by a separate regulation, the Transparency and Targeting of Political Advertising Regulation (TTPA, Regulation (EU) 2024/900), generally applicable since October 10, 2025. It applies broadly, covering not just candidate ads but issue-based advertising designed to influence an election, referendum, or legislative process, and it created enough compliance uncertainty that both Google (on YouTube) and Meta (on Facebook and Instagram) simply stopped serving political ads across the EU in the weeks before the deadline rather than build for it.

Gambling advertising, by contrast, has no single EU standard at all — it’s regulated country by country, ranging from near-total bans (Belgium’s 2023 Royal Decree, Italy’s Dignity Decree) to targeted-audience restrictions (the Netherlands requires targeted digital gambling ads to reach at least 95% of an audience aged 24 or older) to licensing-and-disclosure regimes (Hungary requires advertisers to give publishers proof of authorization before an ad runs, with liability that can extend jointly to the publisher itself). An app accepting gambling ad demand anywhere in the EU needs country-specific rules, not a single EU-wide checklist — and as AppHarbr’s own guide on this notes, an app can satisfy Apple’s or Google’s store requirements and still violate a specific country’s gambling advertising rules once an ad is actually served there.

The Bottom Line

Store compliance and market compliance are two different things. The DSA sets the baseline that applies broadly across the EU; gambling and political advertising add narrower, sector-specific rules that vary further by country. This isn’t legal advice — DSA enforcement is still active and evolving, and gambling and political ad rules in particular are being amended frequently, so compliance specifics should be confirmed with counsel for each market where an app actually serves ads.

FAQ