Key Takeaways
- Article 39 DSA imposes transparency obligations requiring VLOPs and VLOSEs that present advertisements to compile a publicly available repository with information about presented advertisements.
- X was fined €120 million in December 2025 for, among other violations, its sparse and unwieldy advertising repository that failed DSA transparency standards.
- Repositories must include what the advertisement is, who benefits from it, who paid for it, when it was shown, how it was targeted, and how many users were reached.
- Recent platform commitments include displaying full ads as they appear to users, publishing updates within 24 hours, and providing targeting data details.
- Implementation failures stem from incomplete metadata, poor searchability, and delayed updates—all directly addressable through systematic compliance design.
Introduction
The EU Digital Services Act has fundamentally reshaped how large platforms handle online advertising. For VLOPs and VLOSEs, one of the most critical—and increasingly scrutinized—obligations is maintaining a compliant advertising repository. The stakes are real: X faced a €120 million fine for its inadequate advertising repository, and this is only the beginning of DSA enforcement.
This guide walks you through exactly what Article 39 requires, what went wrong in recent enforcement cases, and how to build a repository that protects your platform from regulatory action. Whether you're designing your system from scratch or auditing an existing deployment, the practical strategies here are grounded in actual Commission expectations.
Understanding DSA Article 39 Repository Requirements
Core Scope and Applicability
Article 39 requires Very Large Online Platforms (VLOPs)—platforms with at least 45 million monthly users in the European Union—to publish information about the content of advertisements, the identities of advertisers, and a breakdown of users targeted and reached in each Member State.
The repository obligation is not optional. VLOPs and VLOSEs must maintain a public repository of paid advertising run across their services. This applies to all forms of paid commercial communications, and the repository must be accessible to the general public as well as researchers and regulatory authorities.
Mandatory Metadata Elements
Article 39(2) requires repositories contain: what the advertisement is and what it promotes; the nature of the product, service, or brand; who the advertisement benefits; who paid for it when different from the advertiser; the period during which the ad was shown with start and end dates; whether and how the ad was targeted and who it was/was not intended to reach; any commercial or sponsored content identified as advertising; and how many people were reached.
Each data field must be granular and precise. Vague descriptions like "general targeting" or missing payer information fails regulatory scrutiny. The Commission expects field-level accuracy that allows researchers and enforcement bodies to reconstruct exactly what users saw and why.
Technical Accessibility Standards
The repository must be accessible via a VLOP's online interface through a searchable and reliable tool that allows multicriteria queries and through application programming interfaces (APIs). This means three access pathways: direct web search, programmatic data feeds, and potentially export capabilities.
Searchability is non-negotiable. Users and researchers must be able to filter by advertiser name, date range, targeting parameters, and product category. If your search function returns irrelevant results or lacks filters, you are not compliant—and enforcement bodies will notice.
Common Compliance Failures from Enforcement Cases
The X Case: Sparse and Unwieldy Repository
X was fined €120 million for its sparse and unwieldy advertising repository that lacked transparency and accessibility. The specifics of X's failure reveal patterns across platform deployments:
- Incomplete metadata: X did not consistently publish all required fields for every advertisement. Missing payer information, vague targeting data, and incomplete reach metrics made it impossible to understand the full context of ads shown to users.
- Poor searchability: X's advertisement repository failed to meet the transparency and accessibility requirements of the DSA. Accessible and searchable ad repositories are critical for researchers and civil society to detect scams, hybrid threat campaigns, coordinated information operations and fake advertisements.
- Limited researcher access: While X technically published repository data, the search interface and API limitations prevented systematic research, contradicting the DSA's goal of enabling external oversight.
Update Timeline Issues
Recent Commission guidance and platform commitments emphasize the importance of rapid repository updates. Platforms must assess internal workflows to meet the DSA's expectation for rapid updates, within 24 hours.
When ad data sits in your system for days before publication, you effectively hide information from users and researchers during a critical window. This creates enforcement risk because it contradicts the real-time transparency principle underlying Article 39.
Targeting Transparency Gaps
Vague targeting descriptions are a recurring problem. Statements like "interests-based" or "demographic" provide no insight into actual targeting logic. Platforms must maintain clear records of targeting criteria and audience groups to ensure they can be disclosed when required. The Commission expects you to disclose specific parameters: age ranges, geographic regions, interests, and behaviors used to select which users see which ads.
Step-by-Step Implementation Strategy
1. Map Your Data Architecture
Begin by auditing every system that touches advertisements:
- Ad serving infrastructure (which ads are shown, to whom, when)
- Advertiser onboarding and payment systems (payer identification)
- Targeting engines (what parameters drive ad delivery)
- Billing and revenue systems (which payers funded which ads)
- Content moderation logs (which ads were rejected or removed)
You need unified data flow from these systems into your repository. If ad serving, billing, and advertiser identity are in separate silos, you cannot reliably populate the repository with both accuracy and speed.
2. Design Repository Data Model
Create a structured schema that maps each DSA data requirement to your internal systems:
| DSA Requirement | Data Source | Transformation Rules |
| Ad content (what it is) | Ad serving system | Export ad image, text, landing page URL |
| Advertiser identity | Advertiser onboarding db | Legal entity name, business registration ID |
| Payer (if different) | Billing system | Credit card holder or billing account owner |
| Display period | Ad serving logs | Campaign start/end timestamps (ISO format) |
| Targeting parameters | Targeting engine | Enumerated list: age, gender, location, interest category |
| Reach by Member State | Analytics/logging | Impressions, clicks, conversions by geo-location |
3. Implement Real-Time ETL Pipeline
Build an Extract-Transform-Load process that pulls data from source systems and deposits it into your repository within 24 hours of ad approval. This process should:
- Query ad serving logs every 4–6 hours for new or modified campaigns
- Match ad IDs against advertiser and payer records to resolve identities
- Extract targeting parameters from targeting engine configuration
- Aggregate reach metrics from analytics infrastructure
- Validate all required fields are populated before publication
Automated validation is critical. If your ETL fails silently, you may publish incomplete records without knowing it. Build alert systems that flag any ads missing required metadata before they appear in the public repository.
4. Build Searchable Interface and APIs
Your repository interface must support:
- Web search: Form-based search with filters for advertiser name, date range, Member State, targeting category, product category
- APIs: RESTful endpoints allowing programmatic queries with response pagination, CSV/JSON export, and rate limiting
- Filtering: Users must be able to combine multiple filter criteria (e.g., "ads from Advertiser X in Germany during March 2024 with age-targeted parameters")
- Download capability: Bulk export functionality allowing researchers to download large datasets for analysis
Test searchability against real-world queries. Can a user find all political ads from a specific party? Can a researcher export all ads using interest-based targeting? If not, your implementation is incomplete.
5. Establish Removal and Update Processes
Ads don't live forever. When an ad ends or is removed for policy violation, your repository must reflect that change:
- End dates: When a campaign concludes, mark the final display date in the repository
- Removal records: If you remove an ad for policy violation, document the removal reason and date in the repository (or archive separately with transparent documentation)
- Correction handling: If you discover errors in published data, update the record with a timestamped correction note
Never silently delete repository records. The DSA contemplates that ads shown in the past year remain visible, so historical accuracy is essential for regulatory oversight.
6. Implement Ongoing Audit and Compliance Monitoring
After launch, continuous monitoring is mandatory:
- Monthly spot-checks: Sample 100+ ads from your repository and verify each data field against source systems
- Latency tracking: Measure time from ad approval to repository publication; ensure 24-hour SLA compliance
- Completeness audits: Query your repository for ads missing targeting data, payer information, or reach metrics
- Search performance testing: Regularly run test queries to confirm search returns expected results
Document all audit findings and remediation actions. When regulators request compliance evidence, audit logs demonstrating proactive monitoring significantly strengthen your position.
Alignment with Broader DSA Compliance Framework
The advertising repository is one component of a broader transparency ecosystem. To understand how Article 39 fits within the DSA's full scope, consult what the DSA is and its core objectives. For platforms seeking to determine whether they fall within VLOP designation, guidance on DSA applicability and scope clarifies the 45-million-user threshold.
Related transparency obligations exist in Article 15 and Article 24, which address content moderation transparency and general reporting. While Article 39 focuses specifically on advertising, your broader transparency reporting framework should ensure consistency in how data is collected, validated, and disclosed across all reporting channels.
Accessible and searchable ad repositories are critical for enabling researchers to detect scams, hybrid threat campaigns, coordinated information operations and fake advertisements. This research access connects directly to Article 40 data access rights. If your repository design doesn't facilitate researcher queries, you're undermining the DSA's systemic risk detection goals.
Recent Platform Commitments and Best Practices
In December 2025, TikTok agreed to implement binding commitments to enhance its advertising repository, including displaying the full ad exactly as it appears on a user's feed, regularly updating its repository with information published within 24 hours, providing details of targeting options and user data, and introducing new search tools and filters.
These commitments represent current regulatory expectations. Platforms should view them as the minimum viable implementation:
- Full ad display: Show users and researchers the exact ad they see, not a text summary. Include featured URLs, images, and any calls-to-action.
- 24-hour publication SLA: Make real-time your target, but ensure no ad waits longer than 24 hours from approval to publication.
- Targeting transparency: Enumerate all parameters the advertiser selected: age range, gender, location, interests, behaviors, lookalike audiences, etc.
- User reach data: Break down impressions and conversions by Member State, age cohort, and gender where applicable.
- Enhanced search: Go beyond simple keyword search. Provide filters that allow users to explore ad patterns by advertiser, time period, targeting type, and product category.
Enforcement Landscape and Regulatory Trends
The Commission is actively enforcing Article 39. The Commission imposed a 45 million euro fine on the provider of X for its non-compliant advertising repository. (Note: The first enforcement fine was €120 million for combined violations, with advertising repository non-compliance as a major component.)
Enforcement patterns suggest the Commission is prioritizing:
- Searchability and accessibility: If researchers or enforcement bodies cannot easily query your repository, you will be cited for non-compliance.
- Metadata completeness: Every ad must have all required fields populated. Gaps or placeholders trigger violations.
- Real-time publication: The 24-hour standard is now baseline expectation. Delays are treated as transparency violations.
- Researcher access: Your API must be functional, documented, and not artificially throttled to prevent systematic research.
For a comprehensive view of enforcement trends and case studies, recent DSA enforcement actions documents specific violations and remediation requirements across multiple platforms.
Preparing for Independent Audits
Most VLOPs are required to undergo independent DSA audits annually. Your advertising repository will be a focal point. When auditors test your system, they will:
- Pull a random sample of published advertisements and verify each data field against your internal systems
- Run test queries against your search interface and API to confirm functionality and accuracy
- Review documentation of your ETL processes and error handling
- Assess your audit and compliance monitoring practices
For practical guidance on preparing your audit strategy, see the independent audit requirements for VLOPs in 2026. Ensure your repository design and documentation are audit-ready before enforcement bodies or auditors come knocking.
FAQ
Who qualifies as a VLOP subject to Article 39?
Article 39 applies to Very Large Online Platforms (VLOPs) with at least 45 million monthly active users in the European Union. The Commission maintains an official list of designated VLOPs. If your platform has not been formally designated by the Commission, Article 39 does not apply; however, Article 26 advertising transparency requirements still apply to all online platforms.
What happens if we miss the 24-hour update deadline?
Missed deadlines are treated as transparency violations. The Commission views delays as degrading users' and researchers' ability to understand advertising patterns in real-time. Repeated or systemic delays can trigger enforcement action. Implement monitoring and escalation processes to catch delays before they occur.
Can we limit researcher access to protect advertiser privacy or trade secrets?
Accessible and searchable ad repositories are critical for researchers and civil society to detect scams, hybrid threat campaigns, coordinated information operations and fake advertisements. The DSA contemplates broad research access. Artificial limitations on researcher API access, restrictive rate limits, or lack of bulk export capability will be seen as non-compliance. You must balance legitimate privacy concerns against the DSA's transparency mandate.
What if an advertiser provides false information during onboarding?
You are responsible for verifying advertiser identity before publishing their ads in the repository. If you publish false advertiser information, you violate Article 39, even if the advertiser provided incorrect data. Implement advertiser verification procedures and consider what documentation you need to confirm legal entity identity and payer status.
Do we need to publish ads that were rejected or never displayed?
No. Article 39 applies to advertisements that were actually presented on the platform. Rejected or unapproved ads do not need to appear in the repository. However, once an ad is live and visible to users, it must be published to the repository regardless of subsequent content moderation actions.
How do we handle ads in languages other than English?
Publish ads in their original language in the repository. You may consider providing translations for search functionality, but the ad content itself should appear as users saw it. Targeting parameter descriptions (e.g., interest categories) should be translated into all relevant EU languages for accessibility.
Conclusion
DSA advertising repository compliance is not a one-time implementation task—it's an ongoing operational responsibility. The regulatory framework, informed by real enforcement cases like X's €120 million fine, demands searchable, complete, timely, and accessible repositories. The Commission's expectations are clear, and platforms that cut corners on metadata completeness, update speed, or search functionality face significant enforcement risk.
Your repository is a window into your advertising practices. When designed and operated with transparency as the core principle, it builds trust with users, researchers, and regulators. Invest in robust data architecture, automated validation, and continuous monitoring. Document your compliance efforts. When auditors and enforcement bodies review your system, demonstrate that you take Article 39 seriously—not as a checkbox, but as a commitment to accountability in digital advertising.
The path to compliance is clear: map your data sources, design a unified repository architecture, implement real-time ETL, build searchable interfaces and APIs, handle ad lifecycle events correctly, and audit continuously. Follow this framework and learn from enforcement precedents, and your platform can meet—and exceed—DSA Article 39 requirements.