The EU DSA's Ad Transparency Rules and What They Mean for Influencer Marketing

Short answer: the DSA is three separate obligations, not one

The EU's Digital Services Act (DSA) doesn't put a new duty on the influencer or the brand directly — it puts three separate transparency duties on the platform, and the three routinely get collapsed into one in practice. Article 26(2) requires the platform to give users a way to declare that their own content is commercial — that's already covered briefly in influencer marketing disclosure rules in Denmark and the EU. This article covers the two that aren't: Article 26(1), which requires the platform to show who paid for an ad and why you're seeing it, and Article 39, which requires the largest platforms to place that ad in a public, searchable repository. Both apply specifically to influencer marketing the moment a post is whitelisted and run as a paid ad from the creator's own account.

The dividing line: when does a post become an "advertisement" under the DSA's own definition?

The DSA defines "advertisement" narrowly: it only meets the definition when the platform has been paid to present the content to the recipient. An ordinary sponsored post — an influencer posting organically to their own followers in exchange for money or a free product — is commercial content, but it is not an "advertisement" under the DSA's definition, because the platform wasn't paid to show that specific post to that specific recipient. That's exactly why Article 26(2)'s "declare commercial content" functionality exists as its own, broader requirement: it's built to catch organic sponsored content that the stricter ad-specific rules in Article 26(1) and Article 39 don't reach at all.

That changes the moment a brand whitelists the post and pays the platform to boost it to a targeted audience — as a Partnership Ad on Meta or a Spark Ad on TikTok, both covered in creator whitelisting, Spark Ads and Partnership Ads explained. From that point, the platform has been paid to show the post to selected recipients, which makes it an "advertisement" in the DSA's own sense — triggering both Article 26(1) and, on the largest platforms, Article 39.

Obligation 1: who paid, and why you're seeing it (Article 26(1))

For every ad an EU user sees, the platform must make it possible for that user to identify, in real time:

• That it's an advertisement — a clear marking
• Who the ad is presented on behalf of — the natural or legal person the ad benefits
• Who paid for the ad, if that's a different person
• The main parameters used to target this specific recipient, and — where applicable — how to change them

Meta has turned the first two points into two concrete fields advertisers fill in themselves: a Beneficiary field ("the full legal name of the person, company, business, charity or institution on whose behalf your ad is being presented") and a separate Payor field, used when the payer is someone else — an agency paying on a brand's behalf, for instance. The requirement specifically targets ads reaching recipients in the EU, and Meta requires the information to stay "complete, accurate and up-to-date" for the ad's entire runtime.

Obligation 2: the public ad repository (Article 39)

Article 39 is the strictest of the three — and it only applies to platforms the European Commission has designated Very Large Online Platforms (VLOPs), meaning more than 45 million monthly active EU users. Facebook, Instagram, TikTok, YouTube, Snapchat, Pinterest and LinkedIn all appeared on the Commission's first designation list on 25 April 2023, with compliance required from 25 August 2023.

For these platforms, the ad repository must:

• Be publicly accessible — searchable, with no requirement to hold an account on the platform
• Show the ad's content, who it was presented on behalf of, who paid, the period it ran, and whether — and which — targeting parameters were used
• Keep the ad visible for as long as it runs, and until one year after it was last shown
• Be reachable both via the platform's own interface and via an API

Meta and TikTok each implement this differently. Meta's Ad Library also covers branded content — posts where a creator has tagged a brand partner — searchable by platform, business, creator and date range. TikTok's Commercial Content Library describes itself as a searchable database that "offers information about paid ads on TikTok and ad metadata, including the advertising creative, dates the ad ran, and the main parameters used for targeting" — and TikTok itself distinguishes three categories of commercial content inside the library: "ad/sponsored" (ordinary paid ads), "paid partnership" (a paid collaboration between a person and a brand), and "promotional content" (organic content a person or business uses to promote its own brand).

What this means for your whitelisting strategy

In Make Influence's experience, this is the point most brands miss when setting up a Partnership Ads or Spark Ads campaign: whitelisting is not an anonymous or private way to test an ad. The moment a whitelisted post runs as a paid ad on one of the major platforms, it sits publicly searchable in that platform's ad repository — with your company name as the payer, which creator it's running from, and which targeting parameters you used. A competitor can, in practice, see exactly which creators you're whitelisting, how long a campaign runs, and how you're targeting it, just by searching your own company name in Meta's Ad Library or TikTok's Commercial Content Library.

That's not a reason to avoid whitelisting — it remains one of the most effective formats precisely because the post keeps the creator's organic credibility (see creator whitelisting, Spark Ads and Partnership Ads explained for why). But it does mean "let's quietly test this" isn't an option once the test goes live as a paid ad. Build that public visibility into your expectations from the start — especially if the campaign involves a pricing or launch strategy you'd rather a competitor not see in real time.

Adjacent, but separate: Article 30 on traders

The DSA contains a fourth, related obligation this article deliberately only mentions briefly, because it isn't about ads: Article 30 requires a platform where consumers can conclude contracts with traders — a marketplace — to collect name, address, contact details, payment details and any trade-register information before that trader can sell on the platform. That's relevant to a creator running their own storefront through a platform's built-in commerce feature (TikTok Shop, for example), because the creator then acts as a trader vis-à-vis the platform — but it's a separate marketplace obligation, not ad transparency, and neither TikTok nor Meta explicitly frames its own seller identity-verification process as an Article 30 measure in its public documentation. Treat the connection as a reasonable but unconfirmed inference, not an established fact.

What the DSA's ad transparency rules are not

Three things this article deliberately keeps separate:

• It's not your ad-disclosure duty. That duty still sits with the influencer and the brand under Markedsføringsloven and the UCPD — see influencer marketing disclosure rules in Denmark and the EU. The DSA obliges the platform to provide a tool; it doesn't remove your own duty to disclose the post correctly.
• It's not Meta's or TikTok's own creator branded-content tools. See Meta's Paid Partnership label vs TikTok's Branded Content toggle, explained for how the creator switches on that organic marking themselves — that's the functionality Article 26(2) requires to exist, even though the article describing it doesn't use DSA language.
• It's not GDPR. The ad repository is about transparency around the ad itself — who paid, which parameters were used. GDPR is about how personal data about the individual recipient is handled. See influencer marketing and GDPR: what brands need to know for that distinction, and Consent Mode and influencer tracking in the EU for how cookie consent — a third, separate thing — affects the tracking side of a campaign.
• It's not accessibility law. Whether a video needs captions for viewers with hearing loss is a separate question, governed by the EU Accessibility Act, not the DSA. See the EU Accessibility Act and caption requirements for influencer and brand video content for where that requirement is actually certain.

Decision framework

IF a post is only organic sponsored content, with the brand not paying the platform to show it to a wider audience → only Article 26(2)'s declaration functionality is relevant; see the disclosure-rules article for your own labelling duty.

IF you whitelist the post and run it as a Partnership Ad or Spark Ads boost → Article 26(1), and, if the platform is a designated VLOP, Article 39 both apply — your company name, targeting and campaign period become publicly searchable.

IF you're planning a campaign where competitive intelligence is a genuine concern → account for the fact that the ad repository shows the campaign while it's running, not only afterwards.

IF a creator sells their own products through a platform's built-in commerce feature → expect the platform to require identity information from the creator as a trader, separate from the ad rules above.

FAQ

Do the DSA's ad rules apply to an ordinary sponsored Instagram post that isn't boosted?

Only partly. An ordinary organic sponsored post triggers Article 26(2)'s requirement that the platform let the creator declare it as commercial content. It only becomes an "advertisement" under the DSA's own, narrower definition — and therefore falls under Article 26(1) and Article 39 — once the platform has been paid to show the post to a targeted audience, i.e. once it's whitelisted and boosted.

Can we ask for our whitelisted ad to be excluded from the ad repository?

No. Article 39's requirement is mandatory for platforms the EU has designated Very Large Online Platforms, with no opt-out for the advertiser.

How long does an ad stay in the repository after the campaign ends?

Up to one year after the ad was last shown, per the DSA text itself. That's the general rule for commercial ads; political ads can be kept substantially longer under Meta's own policy.

Is it the platform's or the brand's responsibility to fill in the Beneficiary and Payor fields correctly?

The advertiser — typically the brand or the agency setting up the campaign — enters and keeps the information current. The platform provides the field and displays the information to users; it doesn't fill it in itself.

Is this the same as the Digital Fairness Act that's coming?

No. The Digital Fairness Act is still only a proposal in the European Commission's 2026 work programme — not current law. The DSA, which this article covers, has been fully in force since 2024 for general platform obligations, and since August 2023 for the designated Very Large Online Platforms. See influencer marketing disclosure rules in Denmark and the EU for the Digital Fairness Act's status.

Does a small niche platform have to comply with Articles 26 and 30 too?

No. The DSA explicitly exempts micro and small enterprises from these specific obligations. That's irrelevant to your use of Meta, TikTok, YouTube or the other designated platforms, all of which are far above the threshold.