What DSA codes of conduct for online advertising can achieve

Executive summary 

Advertising is an important enabler for services in the digital public sphere such as news websites. However, there are also long-standing issues with online advertising. Advertising not only enables in-depth reporting and useful apps but also funds made-for-advertising offers that often peddle sensationalist and discriminatory content or conspiracies. Privacy advocates have pointed to widespread breaches of existing data protection rules. Regulators in different parts of the world are scrutinizing anticompetitive behavior, with investigations against Google’s advertising business underway in the European Union (EU) and the United States (US). The industry is also characterized by a lack of transparency, both for consumers and the businesses involved, which has led to some self-regulatory efforts to address this opacity.

A rather new addition to this mix of regulation and voluntary measures is the EU’s key rulebook for the digital public sphere: the Digital Services Act (DSA). Fully applicable since February 2024, the DSA does not regulate online advertising extensively, having a stronger focus on rules for social media sites, video apps and search engines regarding user complaints, recommender systems or risk assessments. However, the DSA does include some innovative rules for platforms on advertising transparency and data use restrictions for online advertising. Moreover, the law calls for overarching, industry-spanning codes of conduct for online advertising, which companies, regulators and civil society representatives are supposed to develop by the summer of 2025.

The codes of conduct for online advertising are expected to spell out some of the DSA’s advertising transparency mandates in more detail. This concerns three topics:

1. Labels for individual ads, intended to allow people a better understanding of who is paying to reach them

2. The advertising repositories, that is, databases collecting online ads for consumers and researchers to study online advertising

3. How data is being monetized on online ad markets

According to the DSA, the development of the codes should include various experts and practitioners from the ad industry, the European Commission and civil society. The codes are voluntary and should cover the entire “value chain” of online advertising.

The major draw of this approach in the DSA is that the codes of conduct could be an expansion of existing rules: A code could include advertising technology companies that are not within the scope of the DSA. However, these companies – such as ad exchanges that play an intermediary role in serving online advertising – would not be bound by the DSA’s enforcement regime. This represents a major flaw of the DSA’s approach: The reliance on a voluntary self-/co-regulatory mechanism creates few incentives for compliance, as there are no direct sanction mechanisms. Moreover, the narrow focus on transparency has limitations. While enhanced transparency is usually helpful, it might not always and automatically support consumers, researchers and regulators. They might be overwhelmed by a deluge of information and have little opportunity and capacity to act on it in some way, for instance, by changing what data is being used for advertising.

Despite these limitations, DSA ad codes could bring about some improvements for consumers and businesses. This can only work, however, if the Commission, industry and civil society agree on wide-ranging commitments around “data monetization.” If this concept, which is not defined in the DSA, is interpreted broadly, there are several options to build on and improve existing mandatory rules as well as voluntary industry standards. For example, expanded supply chain transparency reporting and know-your-business-customer rules could be helpful not only for consumers but also for companies.

Other suggestions for developing DSA codes of conduct for online advertising include:

• Agree on and clearly communicate a limited set of goals on transparency in the online ad market, ideally acknowledging the need for future legislation, also beyond transparency issues.

• Have an external organization draft a code outline that industry, civil society, academia and regulators can comment on.

• Leave out ad repository transparency – instead, expand efforts from the regulation on political advertising transparency to build a strong overarching ad repository, utilizing existing civil society expertise.

• Use the DSA enforcement structure, industry associations and outside observers to encourage compliance with the ad code.

• Ensure a thorough regular evaluation of the code.

It is unclear whether the industry, Commission and civil society can agree on such commitments, particularly regarding data monetization. If they cannot and a code of conduct would thus be a rather minimal overview of existing commitments, it must be questioned whether this even has substantive benefits and should be pursued in the first place. The DSA contains specific minimum requirements and deadlines for the development of the codes. Nonetheless, despite these specifications, there should still be flexibility not to pursue codes that ultimately do not achieve any improvements.

In any case, policymakers should acknowledge that, fundamentally, voluntary self- or co-regulations can only be a small part of a more comprehensive approach to addressing issues and potential harms associated with online advertising markets. Stronger enforcement of data protection rules and continued investigations of potentially anticompetitive behavior are necessary, potentially along with new rules specifically addressing the online ad industry. With a Digital Fairness Act likely in the making, which might address profiling and influencer marketing, and several laws on platform regulation, competition and data protection already in place, lawmakers have ample opportunity to consider enforcement and legislative action beyond voluntary codes of conduct.

Introduction

As billions of internet users know, online advertising is everywhere all the time. Advertising is used as a business model for blogs, news sites, dating and weather apps, video-sharing services and social networks, so people encounter different types of ads in many everyday settings. Oftentimes, when people see an ad, it is based on their previous online behavior and other personal data.

In the European Union (EU), various self-regulatory efforts and laws provide some guardrails for this ubiquitous billion-euro industry, which nonetheless remains elusive for many consumers. The industry has come up with labels and explanations around online advertising, that aim to help people understand who is paying to reach them and how. Data protection rules give people the right to access and correct data about them. Still, the vast amounts of data being used and shared among many different publishers, advertisers and ad tech companies in between still make it difficult for people to understand and have a say in how their data is being used. Beyond transparency issues, the online advertising industry has seen its share of reports of negative effects and harms such as privacy breaches ¹ , profiling and discrimination ² , unintentional exposure of secret military information ³ , allegedly anticompetitive behavior ⁴ and fraud ⁵ .

So far, the current combination of self-regulation and laws regarding data protection, media regulation, consumer protection or competition still leaves gaps in dealing with potential harm for individuals, companies and society writ large. A rather new law – fully applicable since February 2024 – adding to the patchwork of rules for online advertising is the Digital Services Act (DSA). This rulebook for online platforms, search engines and marketplaces includes advertising transparency requirements, for instance, via labels for ads and ad repositories (that is, databases collecting ads displayed on platforms). There are also some restrictions on what data can be used for online advertising.

Moreover, the DSA intends to add to the existing list of voluntary industry commitments by calling for “codes of conduct for online advertising” to be developed in 2025. The codes are intended to spell out some of the DSA’s transparency rules in greater detail across the entire online ad industry. Ad industry representatives, with the European Commission and civil society groups, are supposed to develop these codes with a focus on transparency regarding ad labels, ad repositories and how data is being monetized on online ad markets. This rather narrow approach is meant to address shortcomings in online advertising transparency and not some of the more structural issues surrounding data protection or competition.

This paper discusses how improvements for consumers but also businesses can be achieved with the DSA ad codes, despite their limited purview. They could help standardize some advertising transparency practices geared towards consumers, researchers and regulators. However, I argue that major benefits will only materialize if the Commission, industry and civil society agree to adopt ambitious transparency measures on data monetization – a concept that is not defined in the DSA – and try to expand them to companies in the online advertising industry that are not covered by the DSA itself. Otherwise, the codes’ effects are likely to be minor.

Even if there are ambitious DSA ad codes, policymakers should acknowledge that, fundamentally, voluntary measures are unlikely to change corporate behavior and structures that contribute to some of the potential harms associated with the online advertising industry. These must be addressed through laws, not just voluntary measures. Enforcing and amending existing laws and creating new binding rules might be necessary, as studies for EU lawmakers have found. ⁶ For instance, the rather new data use restrictions from the DSA should be enforced immediately. It will also be interesting to see how the proposed Digital Fairness Act addresses online advertising markets, as it is supposed to deal with profiling and influencer marketing, among other things. ⁷

While the concluding chapter 6 will provide a brief outlook on such potential future legislative action, the main parts of the paper are focused on the DSA advertising codes: They address the background to online advertising and the DSA (chapters 3 and 4) and under what circumstances DSA ad codes of conduct could become useful, how they might be developed, what they could include and how they could be enforced (chapter 5).

Overview: Online advertising and how it is regulated

This chapter lays out some basic terminology regarding online advertising. Readers already familiar with this can jump right to the next chapters, which deal with the DSA online ad codes. For others, the following paragraphs will provide an overview of some aspects of online advertising and its regulation in the EU.

Online advertising and the ad tech industry

As billions of internet users know, online ads come in many different forms. An ad might be shown on a search engine results page, in a feed on social media, in video games, on websites and apps as well as before, during and after videos. Some ads are shown based on what people are looking at or searching for at a given moment. For instance, such contextual advertising is common for search engine results pages, where ads can be displayed based on search terms. Other ads are shown not based on the content around them but on the characteristics of the individual user or, rather, what computer systems guess to be those characteristics based on tracked online behavior (thus called behavioral advertising). This might include guesses about people’s ages or interests, gathered from visited websites or purchases, for example. Behavioral targeting is common for “display ads,” such as clickable banner ads. Whether contextual or behavioral, today, ads are mostly displayed automatically, with little direct human input. This ad delivery model is called programmatic advertising. ⁸

One key example that highlights automation, the amount of data being used and the high number of organizations involved in programmatic advertising is real-time bidding. This is a widely used form of programmatic advertising where online ad spaces available on websites or apps are auctioned off in fractions of a second. An ad exchange functions as a marketplace for such auctions. In addition to ad exchanges, there are also demand-side and supply-side platforms involved, which, very basically, act on behalf of others on ad exchanges: demand-side platforms for marketers and supply-side platforms for publishers, respectively. A demand-side platform is essentially software that allows marketers to buy ad impressions in real time. A supply-side platform, meanwhile, enables publishers to manage and fill the space they have available for ads, that is, their ad inventory. Google runs one of the biggest ad exchanges in the world as well as some of the biggest supply-side and demand-side platforms. ⁹ Social media and video apps such as Facebook, TikTok or YouTube essentially combine the functions of ad exchanges, supply-side and demand-side platforms within their “walled garden” (as opposed to the “open web” outside of such apps). ¹⁰

For the current real-time bidding system to work, a lot of data is being shared between a lot of different intermediaries to make the auction work. Programmatic advertising involves many intermediaries between advertiser and consumer and there can be hundreds of companies involved in the bidding and thousands of companies receiving data from the bid stream for any one auction. The data being shared might include information about the website that auctions off its ad space, about the users and what site they came from or how long they visit the site as well as guesses about the users based on tracking their online behavior.

When they see an ad while visiting a website or watching a video, people often do not know exactly how that ad reached them, which data points about them are being relayed to whom, where that data came from and what targeting groups they are being placed into (for example, regarding their assumed medical diagnoses, political activity or financial status ¹¹ ). Publishers and advertisers also have limited insights into who advertises what and where their ads land, respectively. For example, despite advertisers generally not wanting to appear next to racist, sexist or antisemitic content, the automated systems do display ads – including from big global companies – alongside such content, often without advertisers’ knowledge. ¹² There are “brand safety” tools and approaches that aim to ensure that ads are only shown where advertisers want them (via inclusion lists) or exclude places where they do not want to advertise (via exclusion lists). Yet, researchers and activists have criticized brand safety approaches, for example, for failures in their automated classification of news websites. ¹³

Companies offering such brand safety tools are another part of the ad tech industry, along with ad exchanges and other intermediaries and auxiliary services. Big online platforms such as Facebook or TikTok are also part of this industry, as they offer ad spaces to advertisers and ad delivery technologies. Taken together, the ad tech industry is worth hundreds of billions of US dollars. ¹⁴

A note on the benefits and harms associated with online advertising

A big industry association claims that online advertising powers the free and open internet. ¹⁵ Certainly, online advertising has been the de facto standard business model for many websites, platforms and services. Many of them, such as news outlets, are crucial for people to get informed and form their opinions. Yet, there are also important downsides related to the online advertising business model. By now, both the benefits and harms of the online advertising industry are well-established, having been highlighted by industry practitioners and observers for years. ¹⁶ Therefore, this paper will not provide detailed analyses of benefits and harms, instead offering some sources on this in appendix 1.

In short, potential harms include violations of data protection rules, security risks, anticompetitive markets, fraud, discrimination and negative environmental impacts. Companies within the industry as well as industry associations have tried to address some of these issues. For example, there are self-regulatory efforts regarding the content of ads ¹⁷ , ad fraud and disinformation ¹⁸ , several initiatives on environmental concerns ¹⁹ , networks of advertisers, publishers and ad tech companies trying to tackle transparency in the industry as well as technical standards ²⁰ on data protection, ad labels or supply chain transparency. The results of such efforts are mixed. For instance, the trend towards technical standards that allow for a better review of the advertising supply chain has grown. This marks an improvement but still has not stopped fraudulent behavior in the supply chain.

EU laws on online advertising

In addition to self-regulatory industry measures, various EU laws have for years touched upon online advertising markets. For example, data protection and media regulation rules apply to companies in the online ad industry. Yet, there is no comprehensive dedicated legal framework for the industry. In the future, a planned law, the Digital Fairness Act, could have implications for online advertising as well, as it might include rules on profiling, influencer marketing and deceptive design. ²¹

Based on a survey of selected key EU laws touching on the online advertising industry (see table 1 below) ²² , three conclusions can be drawn:

(1) EU lawmakers have been aware of some of the harms associated with online advertising for years. This is reflected in the fact that some recitals, that is, the explanations of EU laws, specifically mention various concerns with online advertising. For instance, the opacity of data processing for programmatic advertising is acknowledged in data protection and competition rules.

(2) Despite this awareness, rules on online advertising only address parts of the online advertising industry. Although recitals across various laws pinpoint several risks of online advertising, there is no holistic view of the industry. Rather, some laws address data processing, others tackle labeling and still others deal with data sharing. This is not bad in and of itself, but this fragmentation may hinder establishing an approach that addresses the specific structure and issues of the online ad industry on its own and not only as part of other policy considerations. Moreover, many of the laws rely on consent, which problematically leaves much of the responsibility with consumers. ²³

(3) With this fragmented approach, the excesses and harms of the online advertising industry have not yet been curtailed. Some EU laws touching upon online advertising have been applicable for years, while others are rather new (such as the Digital Markets Act (DMA)) or not even fully in effect (such as the rules around transparency for political ads). This makes an overall evaluation impossible at this point. However, because a comprehensive approach to online advertising is lacking, regulatory gaps are likely to persist ²⁴ , thus also allowing harms to persist.

Table 1. Selected EU laws (and one co-regulatory approach) affecting ad tech

Law, area, start of full application	Approach related to online advertising	Explicit mentions of harms or risk related to online advertising
GDPR (General Data Protection Regulation) Data protection May 2018	Applies to all processing of personal data, which includes processing in the ad tech industry[1] Key aspect: Consent for processing of personal data [1] For the legal reasons why that is, see section C in Michael Veale and Frederik Zuiderveen Borgesius, Adtech and Real-Time Bidding under European Data Protection Law, German Law Journal 23, no. 2 (March 2022).	Data processing for online advertising is opaque (recital 58)
DMA (Digital Markets Act) Competition May 2023	Explicitly covers ad tech intermediaries, albeit only big ones called gatekeepers (initially, Amazon’s, Alphabet’s and Meta’s ad services) Key aspects: Prohibition of combining data without consent; transparency towards advertisers and publishers	Ad tech risks unfair business practices and creates barriers of entry through data accumulation (recitals 14, 36); programmatic advertising is complex, opaque, costly (recital 45)
DSA (Digital Services Act) Platform regulation February 2024	Mostly concerns online platforms and marketplaces Key aspects: Transparency rules; some data use restrictions for online advertising on platforms (the strictest ones for ads to children)	Advertising as basis for platforms; risks of ads for illegal content or incentivizing/financing platforms with illegal content; risk of discrimination (recital 68)
E-privacy directive Data protection April 2006	Data protection rules on location and traffic data (in addition to the GDPR) Key aspect: Consent to store cookies or other information on people’s devices	No harms explicitly mentioned
Transparency and targeting of political ads Political advertising October 2025	Only covers political advertising (both online and offline) Key aspect: Transparency rules; some data use restrictions for online political ads	Data processing for political advertising can lead to fragmentation, privacy breaches (recitals 6, 74); political advertising can be driver of disinformation (recital 4); political advertising industry is complex (recitals 1, 52)
EMFA (European Media Freedom Act) Media regulation August 2025	Mostly concerns media services Key aspect: Transparency rules for audience measurement	Platforms providing ad services take away money from journalism (recital 4); ad audience measurement is not transparent (recital 69)
AVMSD (Audiovisual Media Services Directive) Media regulation December 2018	Concerns audiovisual media services and video-sharing platforms Key aspect: Prohibition for video-sharing platforms to use minors’ personal data for commercial purposes	Ads can have negative effects on children (recitals 27-30)
Code of practice on disinformation Co-regulation: Voluntary commitments June 2022	Explicitly covers ad tech industry regarding disinformation, albeit in a voluntary manner Key aspects: Ad sellers and buyers to avoid placing ads next to disinformation	Online advertising can drive money to disinformation websites (II.b, II.d, II.f); the ad tech “ecosystem” is opaque (II.g); brand safety tools not widely used (II.h)

Notes:

1. The harms mentioned here are mainly taken from the recitals of the various laws, that is, their respective explanations. The evidence basis for these harms varies and it is rarely the case that ad tech on its own is responsible for specific individual or societal harms. For example, a link between disinformation and online advertising can be drawn, but the spread of disinformation also must be considered through political, psychological and other lenses. Similarly, discussions on the downturn in traditional journalistic competitiveness mentioned in the European Media Freedom Act must acknowledge general changes in digital news media consumption and the fact that, before the rise of platforms, there were potential harms from oligopolistic structures as well. ²⁵

2. In addition to such laws, regulators in various fields and countries have led in-depth inquiries into the online ad industry, for example, in Australia ²⁶ , Germany ²⁷ and the United Kingdom ²⁸ . Court cases also touch upon the industry, most prominently the lawsuits against Google in Canada ²⁹ and the US ³⁰ .

The DSA online ad codes now join the ranks of EU (co-)regulatory schemes addressing the ad tech industry. The following chapter provides an overview of how online advertising is handled in the DSA, emphasizing the role of the codes of conduct.

The DSA codes of conduct for online advertising: Key points and open questions

The DSA touches upon the ad tech industry, but this is not its main focus. The law is primarily a list of corporate due diligence rules aimed at platforms and apps distributing user-generated content, not the underlying online advertising industry. The DSA is a rulebook for online services such as hosting providers, video apps, search engines, marketplaces and social media sites. ³¹ Among other provisions, it requires services to have reporting mechanisms for users and explain their algorithmic recommender systems.

In relation to online advertising, the DSA requires platforms to clearly label online ads. They must refrain from using sensitive data for ads, for example, data revealing sexuality, race or political opinions. No personal data of any kind can be used to target minors with ads. Very large online platforms and search engines (VLOPs) – that is, those with over 45 million monthly active users in the EU – must additionally assess potential risks stemming from their ad systems and must offer public databases collecting all online ads. Regulators and researchers may under certain circumstances also request data to study VLOPs’ advertising systems.

These mandatory DSA rules cover VLOPs like Amazon, Facebook, Google, Instagram, TikTok and YouTube. However, again, the DSA treats these companies mostly as platforms for user-generated content, not emphasizing their roles as ad tech companies. Other “standalone” demand- or supply-side platforms or ad exchanges are not covered by the DSA at all because those companies are not considered platforms. ³² Still, the DSA transparency mandates indirectly affect ad tech companies, as online platforms will likely have to at least partly rely on their business partners in the ad tech industry to comply with the rules.

Overview of the DSA ad codes

To spell out some of the DSA’s legal mandates regarding online advertising in greater detail, the law calls for voluntary codes of conduct on online advertising. While the DSA envisions codes of conduct on various topics related to illegal content and other systemic risks online (Article 45 ³³ ), the codes on online advertising (Article 46 ³⁴ ) stand out for several reasons:

• The codes are mentioned in their own separate article. Advertising is thus singled out as a key topic for codes of conduct (along with codes for accessibility in another article), yet without an explicit connection to treating systemic risks.

• The codes are intended to include many more stakeholders than are covered by the DSA. For instance, organizations “in the programmatic advertising value chain” as well as civil society organizations should be included in developing the codes. Crucially, this means that both advertising on platforms as well as on non-platform websites and apps could be covered (see section 3.1 for the distinction).

• Contrary to the general codes, there are clear deadlines for the codes on online advertising: February 18, 2025, for the codes to be developed and six months later for them to be applicable.

The Commission is supposed to “encourage and facilitate” codes on online advertising with the following goals and characteristics:

• The codes should improve transparency beyond the DSA rules on online ad labels (for all platforms) and ad repositories (for VLOPs). This is meant to support a “competitive, transparent and fair environment in online advertising”.

• In particular, the codes should “at least” spell out some more details on the labels for ads, the ad repositories and data monetization.

• The codes are voluntary. Signatories are merely “encouraged” to comply with them.

Opportunities and limits of the DSA ad codes

Despite the rough framework outlined in section 4.1, important ambiguities and open questions remain. For one, all DSA codes of conduct – not just those for advertising – are voluntary but they are also tied to platforms’ overall compliance duties. This gives them a peculiar position in the law, between voluntary self-regulation and mandatory regulation. ³⁵ This is especially the case for VLOPs. If VLOPs sign up to codes of conduct, their compliance with the codes will be audited by independent auditors, just like companies’ compliance with mandatory DSA rules. It remains unclear how these connections between “voluntary” commitments and legal obligations will play out in practice. The codes’ connection to any future voluntary industry standards, which the DSA also calls for ³⁶ and which are different from codes of conduct, is just as unclear. ³⁷

Another major ambiguity is the codes’ scope. On the one hand, the DSA article is narrowly worded, calling for the codes to “contribute to further transparency” with mentions of specific transparency obligations in the DSA. On the other hand, it references transparency around “data monetization”, which is not defined further and is not linked to any specific DSA articles. The language for ensuring a “competitive, transparent and fair environment in online advertising” also suggests a wide scope of the article, going beyond the transparency of individual ads and rather addressing transparency in the online ad market.

Furthermore, the role of the Commission and other stakeholders is not spelled out in detail. This leaves questions about the development of the code open: How far does the Commission’s “encouragement” go and what leeway do other stakeholders have in shaping the codes?

These ambiguities make it difficult to predict what the codes will look like and how well they can work in practice. Their effects should, in any case, not be overestimated. They do remain voluntary commitments – despite the connection to the DSA mandates, whatever form this will take. Especially for ad tech companies that sign on to the codes but are otherwise not covered by the DSA, there are no sanctions envisioned and thus few incentives for compliance. Experience with online advertising has shown that self-regulation can be helpful to a certain extent, but that fundamental business imperatives to collect data and profile people will not be addressed without legal mandates. ³⁸ Moreover, when relying on self-regulation, there is a risk of companies using codes as a pretext to delay or water down regulation by arguing to keep trying self-regulation first.

Even if accepting the premise that self-regulation in the ad industry is useful, the codes’ narrow focus on transparency further constrains their power because transparency measures have limitations in and of themselves. Transparency is helpful for consumers and an important prerequisite for some regulatory actions, but it is not enough on its own, as researchers have identified for key tech issues in general ³⁹ and with a view to the DSA in particular ⁴⁰ . There is a risk that the high number of well-meaning transparency measures such as content moderation reports, databases, audits and risk assessments are overwhelming for consumers, researchers and regulators. While these measures differ in approaches, goals and target audiences, an overarching concern is that the DSA might reduce information asymmetries between platforms and consumers/regulators but still not necessarily address power imbalances. There might be considerable transparency around various topics, but that does not necessarily mean that consumers and regulators can act on this information. More generally, the fundamental limitations of transparency measures clearly highlight that other interventions are necessary (see appendix 2 for examples).

Despite these weaknesses and limitations, the explicit mention of online advertising codes of conduct in the DSA presents several potential opportunities:

(1) Transparency: Most importantly in the short term, well-developed, progressive and strongly enforced codes could help address some current shortcomings of the online advertising industry, specifically considering the broad reference to “data monetization.”

(2) Bridge to more holistic approaches: Most importantly over the long term, the codes can serve as a test for any potential remedies to deal with the opacity and other structural ills plaguing the advertising industry. They can reveal gaps in DSA coverage that could be addressed in separate laws. As such, the codes offer the opportunity to be a bridge to a more comprehensive and specialist regulatory system.

(3) Overarching topics: The headline for the codes speaks of “online advertising” and not only, as at least one industry group had called for ⁴¹ , “online advertising transparency”. While the main focus is nonetheless on transparency, this wording – along with the rather broad and undefined term “data monetization” – would allow the Commission, industry and civil society to address other issues in the future.

(4) Speed: Even if the deadlines for the codes were missed by some months, it would be all but guaranteed that the codes would be in place before any reforms or dedicated new laws on profiling are close to being finished. Some improvements could thus be achieved in the short term.

(5) Multistakeholder approach: The codes require involvement by more actors than are covered by the DSA, such as advertising intermediaries. While the number and heterogeneity of actors could complicate their development, this could also be an asset. It is an important exercise in getting different people around the table to work on technical matters related to online advertising. It could establish or deepen networks that might not only be important for enforcing the codes but also for any future regulations.

(6) Dry run for legislation: If EU policymakers table specialized ad tech legislation in the future, the codes of conduct can be considered not only a test regarding the approaches they cover, but also regarding their development and enforcement. Who participated in what way? In particular, were civil society voices heard? What lobbying is expected during a lengthy legislative process? Which issues proved to be most difficult to find compromises on?

With these potential benefits and drawbacks in mind, the following chapter offers suggestions on how the Commission, industry and civil society might consider and develop DSA codes of conduct for online advertising.

The way forward: A DSA ad code and the need for action beyond that

The DSA includes some minimum requirements of what ad codes should cover and mentions deadlines (see section 4.1). The fact that the DSA sets such specific requirements makes it seem likely that the Commission will indeed make some attempt to arrive at codes of conduct – after all, the DSA contains a clear encouragement to do so. However, the overall limitations of the codes discussed in section 4.2 are serious enough to warrant a consideration of whether ad codes can be useful at all and if so, under what circumstances.

I argue that DSA ad codes can only achieve substantive benefits if the Commission, industry and civil society agree on adopting a wide interpretation of “data monetization.” Comparatively minor improvements regarding ad labels and ad repositories could also be made in settings outside of the DSA.

The following sections present some suggestions on how a DSA ad code could be developed with an emphasis on enhanced data monetization transparency. Interpreting data monetization broadly would allow for an expansion of the DSA’s transparency measures. This would shift the focus of transparency efforts from individual ads to the ad industry. It would also cover different services and practices not within the scope of the DSA. So far, the DSA is narrowly focused on certain online services, whereas the potential harms for consumers that the DSA tries to tackle might emanate just as much from other services not covered, for instance, platforms that are not “very large” according to the DSA. This was also pointed out by various respondents to a Commission consultation regarding EU consumer law, mostly from consumer protection organizations. ⁴² They called for a uniform application of consumer protection rules, that is, not just on (very large) online platforms.

If instead a rather minimal approach to codes of conduct for online advertising is taken, it must be questioned whether this is a worthwhile endeavor. It is simply not useful to develop a code for the sake of developing a code. In fact, it would be wasteful, considering the limited resources and staff of stakeholders. Therefore, the Commission, industry and civil society should reflect on the approach to and potential specific content of ad codes together, for instance, via a time-limited series of dedicated roundtables. With such a joint reflection on the necessity of a code, arguably, the requirement for “Commission encouragement,” as stipulated in the DSA, would be fulfilled. If very few or limited transparency benefits can be achieved, the deadline mentioned in the DSA for further work on a code should become obsolete.

Overall, considering the opportunities and limitations of the DSA against the backdrop of the state of the online advertising industry, the Commission, industry and civil society should discuss steps beyond voluntary codes of conduct. The working relationships built to reflect on and/or develop the DSA ad codes could be the cornerstone for an open dialogue to more clearly identify the gaps in enforcement and legislation to be addressed beyond any ad codes. Some suggestions for this are presented in appendix 2.

Scope: One code on transparency rules for the entire online advertising industry

Although the DSA refers to codes of conduct in the plural, the initial focus should be on only one code of conduct regarding the transparency matters mentioned in the DSA. Otherwise, there is a risk of overextending self-regulatory approaches (and the resources of the organizations involved). While focusing on a few specific topics, the code should address a multitude of actors in the ad tech industry, concerning walled garden platforms, the open web and search engines. In doing so, various types of companies and business models will be addressed at the same time, which could prove difficult. Yet, an encompassing approach is more promising than covering only platforms. The key benefit of a DSA code would be that it can go beyond the services legally bound by the DSA because many ad tech companies as well as smaller search engines are not considered platforms under the DSA.

Concretely, the scope of the ad code should cover the entire online advertising industry, that is, online platforms and search engines of all sizes, other publishers and supply-side platforms, ad networks and exchanges, demand-side platforms, agencies and advertisers. Providers of brand safety, verification and ad measurement tools as well as data brokers and data management platforms should also fall within the scope. It is crucial to have large industry representatives as signatories, for instance, big global agencies, advertiser and publisher associations and companies running ad exchanges. These entities shape the online advertising industry with their standards and/or market positions. At the same time, smaller companies and associations need to be represented as well, as their positions might differ from those of larger organizations.

Expectation management: The limits of a transparency-focused code

If there is a decision to develop a code of conduct, the Commission must walk a fine line. It needs to make clear that the ad tech industry is expected to help develop and adhere to a code that brings about improvements for consumers (and also businesses) and is not merely performative. However, the Commission must also acknowledge that the code can only do so much in the absence of binding legislation. Therefore, before starting work on the code, policymakers and industry representatives should agree on the parameters, goals and limits of the code.

Because of its limited focus in the face of larger structural issues in the ad tech industry (see appendix 1), the code should include an explicit acknowledgement of open issues that need to be addressed in legislation. This might be difficult for some industry participants to agree to, but it would clearly show their good-faith commitment to improvements beyond transparency topics.

Moreover, to at least partially address the limitations of transparency measures (see section 4.2), the code needs to be clear about who should benefit from the measures (consumers, researchers, regulators, other businesses?). It is also vital that various groups can actually do something with the information they receive, beyond merely learning about how advertising works (for instance, do consumers have a chance to opt out of certain types of advertising? Do regulators have enough expertise and resources to feed investigations into potential infringements?).

Development process: External mediator to coordinate Commission, industry and civil society

The development of the online ad code should be coordinated by the Commission, with the help of an external mediator, and should include industry practitioners as well as experts from civil society and academia. Arriving at this setup is based on the demands of the DSA for the code as well as lessons from previous EU-level codes with a relation to the DSA.

The practical matter of how to come to a final code is left open in the DSA. The Commission is tasked to “facilitate” the industry’s drafting of the code but it remains unclear what companies or industry organizations play what role, who writes the first draft and what the model is to find compromise. In practice, a coordination effort by the Commission will be necessary, as it is unlikely that the vast and heterogeneous online advertising industry will gather itself in time. Nevertheless, several industry networks and associations do exist that the Commission should tap into. Relatedly, the Commission should also gather feedback internally and from signatories of the code on countering illegal hate speech and the code of practice on disinformation to inform their work on the ad code. ⁴³

In particular, the rewriting of the code of practice on disinformation can offer valuable lessons. The development of this code was rather inclusive with a diverse set of stakeholders, including platforms, civil society groups and fact checkers. Yet, the revision process was long and drawn out. It became clear that all organizations involved were at pains to muster resources for this, which was a particular issue for civil society actors compared to corporate actors. Once an external mediator was installed, the pace of the process picked up. This experience should make developers of the ad code opt for an external mediator much sooner in the process. Additionally, in the face of a potentially large group of organizations involved, it could be useful to have smaller working groups or roundtables with industry and civil society representatives, allowing them to work on specific technical topics. Recommendations from these smaller dedicated discussions could then be presented and discussed as final drafts in a bigger setting.

As foreseen in the DSA, the development process should make use of technical expertise and experience with self-regulation from industry representatives. These representatives should cover all aspects of online advertising, from publishers to ad tech providers to advertisers, and come not only from bigger companies and associations but also smaller ones. It is vital to complement business perspectives with voices from civil society and academic groups, many of which have studied online advertising for years. Contrary to early practices of industry self-regulation that did not include civil society expertise ⁴⁴ , a key benefit of a DSA ad code would be that its development is driven not only by business interests.

Moreover, the expertise from data protection and human rights authorities such as the European Data Protection Supervisor and Fundamental Rights Agency must be heard to ensure that the codes are in line with laws in these areas. This engagement is explicitly called for in the DSA (recital 107). Engagement with the European Board for Digital Services, which is made up of the Commission and national Digital Services Coordinators (DSCs), is not explicitly foreseen in the DSA for the ad code. This should nonetheless be considered to ensure that national and EU-level interpretations of ad transparency are in line. Moreover, the DSCs could bring in expertise on ad tech companies from their respective member states and could support an evaluation of the code.

Ad label transparency: Build on existing measures from industry and academia

Ad labeling is an important measure of consumer-facing transparency. It should help people distinguish ads from other content and to learn who is paying to reach them and how. Researchers and regulators can benefit from the practice, too. Researchers can use ad labels to study advertisers, targeting and messaging. Regulators could draw from labels whether any advertising or targeting practices violate the DSA or other laws. The different demands for consumers and researchers should be kept in mind when discussing ad labels: Generally speaking, researchers and regulators will require more detailed, machine-readable information, while consumers should be presented with easy-to-access and easy-to-understand overviews (and the option to learn more if they so choose).

Many online platforms and other publishers have long had voluntary measures for ad labels and there are some sector-specific rules as well ⁴⁵ . With the DSA, there are now EU-wide requirements for ad labels on online platforms. ⁴⁶ There is also another EU law requiring ad labels: the regulation on transparency and targeting of political advertising. This law covers both online and offline political advertising, so the ad labels discussed there can be different (for instance, they could also entail a notice on a poster presenting a political party on the street). Nonetheless, it makes sense to coordinate ad labeling efforts between the DSA and the political ads transparency law, especially since the latter requires the Commission to develop formats and templates for political ad labels and calls for a code of conduct on political ad labels. ⁴⁷ There should be neither duplication nor conflict between the two laws. Ideally, there would be one overarching approach to ad labels.

A code of conduct focused on ad labels could build on and improve existing approaches to such labeling. While existing approaches have weaknesses, it is still more helpful to tackle these weaknesses rather than disregarding them altogether. This would show some acknowledgement of companies’ and associations’ previous efforts and place less strain on the resources of the code authors. Specifically, the code could address three weaknesses in the current system: one related to ads on platforms, one related to ads on the open web and one general issue. The labeling of influencer advertising should be addressed outside of the code.

More details for ad labels on platforms

It would be desirable if the information provided to users about ads were standardized across platforms. A DSA ad code could promote this effort. Acknowledging that platforms and their audiences, business models and content/ad formats differ widely, it still seems feasible to approximate the information of ad labels and how it is being presented even more. A code would also enable outside voices from civil society and the Commission to provide more structured input into the development of platforms’ ad labels, rather than allowing companies or industry groups to determine how they go about ad labeling by themselves.

On “walled garden” online platforms, ad labels have been around for some time, especially on bigger ones such as Facebook, TikTok or YouTube. For example, some search engines and platforms have implemented various forms of a “Why am I seeing this ad?” feature (as it is called on Facebook). Often, it also allows users some degree of choice regarding what types of ads based on what data they see. However, platforms’ transparency labels often lack detailed information on targeting criteria and sponsors. For example, on YouTube, an ad for a fitness studio might run and people might only be able to see the ad tech intermediary behind the ad but not the ultimate sponsor (that is, the fitness studio). In this example, this is typically not a big challenge and easy to figure out who the sponsor is. However, for cases of greenwashing, pinkwashing or political ads, such information is crucial.

As another example, on Meta and other platforms, consumers are usually not told if advertisers used custom or lookalike audiences (which means that advertisers used their own existing database to target people or that they allowed the platform to use this database to automatically find people supposedly similar to those on the list, respectively). This makes it difficult for consumers to trace who has their data to target them in the first place. Perhaps more pragmatically (since it is unlikely that many consumers regularly check ad labels; see below), such features would also support research and regulators in uncovering potential data protection violations. If – for this and other reasons – platforms so far have not done this, the code could be one way to enhance existing labels.

Wider adoption of ad labels on the open web

On platforms, the respective platform providers have a final say about how ads on their services are being displayed and labeled. Contrary to that, there is no central company headquarters with final say over all the online ads on news sites, apps or blogs (although Google does play an outsized role in delivering online ads on the open web, see appendix 1). There are still attempts to streamline ad labeling. As one prominent example from Canada, Europe and the US, the industry’s AdChoices tool provides companies the option to display a small icon overlaid on ads. If people click on this icon, they receive some standardized information on the ad and who is behind it.

In Europe, AdChoices is organized by the European Interactive Digital Advertising Alliance. ⁴⁸ They recently expanded the tool to cover the specific information required in Article 26 of the DSA. Called the Advanced Advertising Transparency Programme (AATP), this offer is currently being rolled out to participating companies engaged in online advertising. ⁴⁹ The framework also allows people to select which companies can use their data. At the risk of entrenching an incumbent, it does seem useful to improve and expand upon the AATP for a DSA code instead of building something from scratch. The involvement of civil society and regulators in the code could add to and break open the industry-driven initiative a bit. The code could also drive a wider adoption by more organizations in online advertising and help standardization, again acknowledging the different types of websites, apps and formats of ads. Ideally, there could be some convergence regarding the information and style of ad labels on platforms and on other websites.

Improved research and evidence base for ad labels in general

For ad labels currently used on platforms as well as on websites and apps, the key underlying question is whether consumers even notice them, use them and find them helpful. To study this, the code should include a commitment to supporting independent research on ad labels. Important research in this field and on similar measures, such as nutrition labels, has been done for years. Still, understanding online ad labels even better is necessary to have an evidence base for (self-)regulatory interventions. Research would also promote an understanding of the limits of transparency (see section 4.2).

Studies and surveys have repeatedly shown that labels can be helpful sources of information for consumers and guide their choices. ⁵⁰ However, research has also shown major weaknesses in ad labels. In experimental settings, researchers have found that consumers often do not notice ad labels or misremember seeing them. ⁵¹ Surveys on the AdChoices label conducted by the industry alliance behind the label confirm these difficulties but also potential improvements over time. In 2020, after seven years of the AdChoices logo having been rolled out, on average, not even a third of survey respondents in ten European countries reported having seen the icon. Even fewer people correctly identified what the icon allowed them to do. This still represented a substantial increase from a previous survey ⁵² (and further improvements might have occurred since then ⁵³ ).

For a label like AdChoices to work, it must be much more recognizable. While issues around recognition are not uncommon for labels, it is noteworthy that it has taken quite some time for a logo design backed by major industry players and introduced in big markets to become widely known. The lack of comprehension of ad labels is also considered in scientific research. ⁵⁴ Moreover, there is no scientific consensus on the best placement, language and format of labels. ⁵⁵ It is clear these factors matter but results are mixed on exactly how they matter, for instance, depending on where a disclaimer is placed on a banner ad or when a disclaimer is played (that is, before or during a video ad). More research on this is necessary but it could be that results continue to be inconclusive, as the formats of advertising and people’s viewing habits change quite dynamically. This should not lead to inaction on behalf of the advertising industry, but rather spur constant reevaluations based on the latest evidence. To support research, there is a clear role for the Commission and member states, especially regarding research funding, because studies should ideally not be entirely dependent on the ad industry paying for them.

Different legislation to enhance labels for influencer marketing

While traditional online ads in search results, during videos and on websites and apps continue to be widespread, “sponsored content” and influencer marketing is another crucial part of online advertising. Bigger platforms typically have their individual guidelines for labeling such content, whereas the AdChoices initiative is not specifically designed for this. The developers of the ad code could discuss how labels for paid influencer content could be better incorporated into the AdChoices/AATP framework and streamlined across platforms. However, the code does not need to address ad labels for influencer marketing in depth. This is not because it is not important but because the Commission is planning a separate piece of legislation on this topic, the Digital Fairness Act. ⁵⁶ To avoid duplication and prevent overstretching the code (and the resources of its developers), it is more useful to focus on these forthcoming binding rules. This also considers that influencer marketing almost only happens on “walled garden” platforms, whereas the code is meant to cover all types of advertising.

While the code does not need to cover this in detail, the Commission should use the expert community being built for the ad code as well as existing experiences with rules for influencer marketing to inform its separate legislative efforts on this. For example, some regulatory ⁵⁷ and self-regulatory ⁵⁸ guidelines already exist around labeling influencers’ posts. The DSA ad code could ideally establish a forum of exchange between regulators, industry representatives and civil society that can help inform self-regulation and (future) regulation. This requires various Commission divisions to work together and exchange information. ⁵⁹

Overall, the code’s efforts on ad labels should be used to find common ground for evidence-based labeling and, crucially, to improve user controls for ad settings. It is beyond the code, however, to truly empower users by offering them alternatives to the prevailing behavioral advertising approach (see appendix 2).

Ad repository transparency: Disregard this topic for the code

The Commission and industry should use forums other than the code of conduct to improve ad repositories. Such improvements are clearly and urgently needed, as major weaknesses in existing ad libraries persist. ⁶⁰ The Commission itself has looked into several VLOPs’ compliance with the corresponding DSA rules in Article 39. ⁶¹ Ad repositories can help consumers better understand how online advertising works, if they are easily accessible for people and explained well. Moreover, regulators, watchdogs such as consumer protection or anti-discrimination organizations, researchers and journalists can support platforms’ own risk mitigation efforts and use ad repositories to inform any potential investigations and lawsuits. These needs and use cases should be important guides for building ad repositories. So far, platforms have not met these needs for easily accessible, well-structured databases with filter, sort and bulk download options as well as reliable application programming interfaces (APIs) that allow researchers better data access. These are just a few of the recommendations for improving ad repositories put forth by researchers who have tested and used ad repositories. ⁶² They should form the basis of the Commission’s work on improving and expanding ad repositories. ⁶³

However, these improvements should not be primarily sought via a DSA online ad code. Considering the limited resources and tight deadline for the code, there are better opportunities to achieve improvements. ⁶⁴ The DSA itself provides options: For instance, there could be guidelines on the structure, organization and functionalities of the ad libraries ⁶⁵ , which could cover matters related to the transmission of information. This could also be used to harmonize ad repositories across platforms. Industry standards for ad repositories are also mentioned in the DSA. However, most crucially for ad repositories, there is a link to another EU law that should be explored: The regulation on political advertising transparency includes a yet-to-be-built political ad repository, for which many of the same questions that are coming up for DSA ad databases will be important. ⁶⁶

This new political ad library offers a better opportunity to tackle detailed technical matters than the code does. To make the best use of this opportunity, it is vital that various Commission divisions work together and share information. ⁶⁷ An ambitious combination of the rules from the DSA with those from the regulation on the transparency of political ads would see the development of a single unified EU ad repository, covering all online ads with more detailed information required for political ads. However, even a less ambitious approach could be useful. The technical details designed for the political ads repository could inform VLOPs’ individual ad databases, without the need for an additional set of rules in a DSA code of conduct.

The DSA states that the online ad code should “at least” cover transparency on ad labels, ad repositories and data monetization. If ad repository transparency is dealt with in other ways, the DSA code could reference these other efforts, particularly regarding the political ads repository. It should contain language that signatories will shape and ideally adhere to future rules on ad repositories, especially from the political ads repository. The benefit of the online ad code would thus be that more companies than just online platforms and more ads than just political ads were covered. The alternative, that is, focusing on more detailed transparency in the online ad codes, risks duplication with guidelines and the regulation on political ad transparency.

Data monetization transparency: Expanded scope of (self-)regulatory measures

The rather vague call for “meaningful information” on “data monetization” ⁶⁸ offers the biggest opportunity for the Commission, industry and civil society to create improvements through a DSA code of conduct. Instead of focusing only on transparency for individual ads, they could consider measures aimed at transparency in the ad market. If the authors of the code wanted to pursue this goal, they should adopt a broad interpretation of “data monetization.” This reflects that in a common programmatic advertising campaign under current circumstances, all companies involved use data to make money. To provide some simplified examples, platforms, apps and websites collect and use various types of data by tracking people’s online behavior and other data points such as location data to guess their interests and group them into profiles. Advertisers have data about target groups and seek accurate measurement data on their campaigns. During ad auctions, the entire real-time bidding process is based on data provided by the supply and demand sides.

With a broad understanding of data monetization in online advertising, the code developers could at the very least strengthen existing industry self-regulation on transparency and ideally introduce further measures. By doing so, the code should help answer the question, “Where does the money for a data-based ad (campaign) come from and where does it go?” This would be a measure focused mostly on businesses as well as regulators and researchers, less so at consumers. While the DSA overall is meant primarily for consumers, the language on the online ad code does justify such an approach, as the codes should “contribute to further transparency for actors in the online advertising value chain.”

The call for transparency in the advertising “value chain” is nothing new. For years, advertisers, publishers, other ad tech companies and researchers and activists have known about and discussed the opacity of the online ad industry. ⁶⁹ In the absence of specific legislation on this (and despite the EU rules summarized in table 1), industry self-regulation has emerged as an attempted fix. Ad labels, which did not used to be mandated across platforms before the DSA, try to answer the first part of the question about who spends money on an ad (see section 5.4). The ad industry has attempted to answer both the first and second parts of the question itself, using various technical standards. ⁷⁰ Moreover, the DMA includes important transparency rules that could arguably be considered under the headline “data monetization” (see table 1).

Options for data monetization transparency

While this paper cannot offer an in-depth technical and legal analysis of industry standards and regulations, some examples highlight specific options for data monetization transparency in an ad code: ⁷¹

(1) The code could adapt and expand the requirements in Article 5(9) and 5(10) of the DMA ⁷² beyond gatekeepers. This means that advertisers and publishers would receive the right to request certain information daily, for example, on prices and how they are calculated, not just from gatekeepers designated under the DMA but other ad tech companies as well. Code authors would have to determine who has this right and towards whom, in addition to checking the practical feasibility of such an expansion. The code might also be used to clarify open questions about who is considered a publisher in the DMA. ⁷³

Code signatories could furthermore commit to providing advertisers with hourly log-level data (that is, every detail about an ad impression), so they have a better view of where their ads go. A large advertising association already made this recommendation to its members ⁷⁴ but activists have also been pushing for this ⁷⁵ . This update could not only reduce information asymmetries between buyers and sellers, but indirectly help identify ad fraud and excessive intermediaries.

(2) The code could allow for the requirements in Article 30 of the DSA ⁷⁶ to apply to ad tech companies. In this article, certain online marketplaces are required to only allow those traders on the marketplaces for which they have some basic information, such as name, payment accounts and trade register numbers. Such “know-your-customer” or “know-your-business-customer” requirements are common practices in other industries as well, mostly those related to financial services like banks or tax advisers. The code could establish this for the ad tech industry. This would enhance transparency around data monetization by allowing all parties involved to know which business entities with which they were dealing.

(3) The code could improve the uptake of industry standards around supply chain transparency. The advertising industry adopted two key standards intended to “identify all intermediaries that participate in the flow of money from the buying platform back to the publisher,” ⁷⁷ sellers.json and SupplyChain Object (schain). Sellers.json ⁷⁸ is a standard that allows a buyer of an advertising space to verify the entities who sell the space or are involved in the selling of it. Basically, this public file is a list of websites and apps to which a seller provides ads. For example, with sellers.json, anyone can check whether someone using Google’s ad exchange is an authentic seller – at least in theory. Contrary to many other ad exchanges, Google by default allows its clients to hide details from the sellers file. ⁷⁹ It is therefore difficult to identify Google’s publishing partners. In DSA “data monetization” terms, it is difficult to trace who makes money with particular ad spaces. This is a long-standing complaint among journalists and activists ⁸⁰ as well as a risk for companies concerned about potential fraudulent sellers. It could be remedied by the code, if there were agreement to make the sellers.json entries public by default.

Meanwhile, SupplyChain Object is a list that allows buyers of ad spaces to see every entity that is part of an ad impression. The code could require commitments to further improve this standard and to use it and make it easily accessible, particularly for companies in the advertising supply chain, regulators and researchers.

(4) The code could improve transparency around VLOPs’ ad revenue sharing policies. Many VLOPs have developed ad revenue sharing programs. ⁸¹ With these programs, services like Instagram, TikTok or YouTube allow certain publishers or creators to receive a share of the revenue from the ads that appear around their content (also known as “content monetization”). The companies have created policies around who can be a publisher or what kind of content is eligible for such ad revenue programs. However, these policies can be difficult to find and compare across platforms, often also lacking detailed explanations. ⁸² The code could include a commitment, especially for VLOPs, to build transparency centers around ad revenue-sharing policies, their enforcement and their appeals processes and numbers, as they do for content moderation. This could be a first step towards checking enforcement and enhancing options for appeal.

(5) The code could promote the practice of lists and archives of publishers. Relevant code signatories could commit to publishing lists of all the publishers they work with. These are often called site lists, app lists or partner-publisher lists. ⁸³ Making this a more common industry practice for VLOPs and other companies involved in digital advertising via the code would enhance transparency around ad placements and the value chain in general. Additionally, an archive with this information would be beneficial, especially for regulators and researchers.

Overall, with measures like the ones mentioned here, the major improvement the code would provide compared to the current situation is extended coverage. The code would cover more companies than just the biggest gatekeepers, thus widening the scope beyond gatekeepers and VLOPs. Moreover, the code would go beyond transparency for individual ads and take a view of ad markets themselves. This might seem to be a rather ambitious approach. There could be some opposition to an expansion of (self-)regulatory measures, especially from the ad industry. Also considering resources at the Commission and within the industry as well as the workload with other DSA codes, it might not be feasible to agree to such an approach. Still, the suggestions made here could at least provide a point of departure for discussions to address opacity in the online advertising “value chain,” as the DSA demands.

Enforcing and evaluating a DSA code of conduct for online advertising

Because the DSA codes of conduct are voluntary and non-binding, there is no sanctions mechanism for potential violations. This is one of the major weaknesses of voluntary codes of conduct. If companies are willing to risk some reputational damage, they can disregard the commitments of a code or not sign on in the first place. In EU tech policy, there are precedents for both. Twitter effectively stopped complying with the code of practice on disinformation. The EU’s voluntary “Artificial Intelligence Pact” was signed by dozens of companies, yet some big players in the field such as Apple, Meta and Mistral did not immediately sign on. ⁸⁴

Despite the voluntary nature of a DSA ad code, there are some options to encourage compliance. The Commission as well as DSCs and other parties such as industry associations and consumer protection organizations should make use of these mechanisms:

(1) The Commission could use the DSA enforcement system for VLOPs. For VLOPs, the codes are part of the DSA’s audit system. ⁸⁵ Independent external auditors must check whether these platforms comply with the commitments set out in the online ad code. The companies and the Commission would become aware of potential shortcomings via the audit report at the latest. The platforms could then take steps to ensure compliance. If DSA violations are linked to risk mitigation regarding VLOPs’ advertising systems, such violations could, in the last instance, lead to fines. However, this system is largely untested, as the first audit reports only came out in November 2024 and the first DSA code of conduct is not expected until early 2025 ⁸⁶ . It is unclear if ad codes and risk mitigation required from VLOPs will be connected and, if they are, whether fines for breaches of technically voluntary commitments is a desired course of action for the Commission. ⁸⁷

The Commission should clarify the connection between codes of conduct and the DSA enforcement mechanisms for VLOPs, not only with a view to the audit process. This would also allow a better understanding of whether complaints about potential breaches of the ad code are possible. ⁸⁸ Similarly, consumers could seek representation from consumer groups or other organizations to exercise their rights under the DSA ⁸⁹ , which should ideally also cover the ad code.

To even be able to check and understand compliance efforts with the ad code, the Commission needs specific resources and expertise. Auditors also need to have the necessary background regarding ad labels and data monetization.

(2) Industry associations can play a role in encouraging compliance, especially for “non-VLOPs”. They should encourage their members to sign and comply with the code. To do so, they should highlight the code’s benefits not only for consumers but also for businesses, for instance, regarding transparency in the value chain. Associations should call out infringements. As a more drastic step, maybe for repeated violations of the code, they could exclude companies from their association. Industry groups could also adapt their complaint systems to allow consumers to report potential breaches of commitments.

Thus, the code should at least function as a reputational signal. Signatories that are platforms and/or gatekeepers could lift the code’s standing by only working with ad tech companies that signed on to the code.

(3) Outside observers, such as media or civil society groups as well as researchers, can help monitor compliance. Researchers and activists who have studied the online ad industry could provide important insights into signatories’ compliance efforts. For example, they could highlight good practices and call out lapses. However, this is an additional task for groups that are typically already short on resources. As with many DSA provisions, a balance will have to be found between utilizing civil society’s expertise and not overextending the sector. ⁹⁰ An institutionalized yet lean format allowing for a structured exchange between civil society representatives and regulators could help with this. For instance, there could be an outreach team at the European Board for Digital Services. ⁹¹ This Board brings together the Commission and national regulators and could be a good forum for exchange with outside experts.

(4) For any checks of compliance, it would be useful to have some indicators to determine whether signatories adhere to the code. This is another lesson from the code of practice on disinformation. The lack of such measurements was a key reason for revamping the original code of practice. There do not have to be many highly detailed indicators. A smaller set of yardsticks that nonetheless allow good tracking of compliance would be helpful. This should include both quantitative and qualitative indicators such as descriptions and evaluations of the data monetization efforts covered in section 5.6, preferably comparable across time and platforms.

(5) The indicators, as well as the code commitments themselves, should be reviewed regularly. This is required by the DSA: The Commission must evaluate the online ad code every five years. ⁹² Depending on when the code is written, a quicker first review could be helpful. An evaluation should ideally include assessments from both the code signatories and outside analysts and observers, for instance, researchers or journalists. An emphasis should be placed on the effectiveness and limits of transparency measures (see section 4.2) and on the connection to other laws such as the DMA, the regulation on the transparency of political advertising and potential future laws touching upon online advertising, for instance, the Digital Fairness Act.

Moreover, the evaluation should consider whether measures stronger than voluntary commitments are necessary. For topics such as ad labels, it might make sense to have a flexible, dynamic co-regulatory measure. For topics concerning data monetization and affecting more structural elements of the online advertising industry, specific legislation should also be considered. The following chapter recaps options for the DSA ad code, while appendix 2 offers measures beyond the code.

Conclusions and outlook: Moving beyond voluntary transparency-focused codes

Any DSA code of conduct for online advertising cannot solve all the issues plaguing the online ad industry. It is not meant to do that. To address privacy, competition and other matters, existing laws must be amended or enforced more effectively, and new regulation might be necessary, as several researchers have pointed out. ⁹³

Even for the narrow scope for which the ad code is intended – concerning transparency around ad labels, ad repositories and data monetization – there are serious limitations to consider, not least because of the voluntary nature of the code. Still, along with other laws on data protection, e-privacy, competition and the transparency of political ads, a code of conduct does offer an opportunity to build another plank in defining a consumer-friendly, rights-respecting online advertising industry.

To use this opportunity, the Commission, industry and civil society would have to focus strongly on delivering improvements via “data monetization transparency.” This would allow for expansion in multiple ways: It could expand self-regulatory commitments and mandatory rules beyond the scope of companies already engaged in this self-regulation or DSA compliance. It could also expand the view to ad markets as such, beyond considerations of transparency for individual ads. In contrast, the potential benefits of dealing with ad labels and ad repositories through a DSA code of conduct are lower. There are better options to address weaknesses in these areas outside of DSA codes.

Taken together, this is how a DSA code of conduct for online advertising could be developed and what it could entail:

• Agree on and clearly communicate a limited set of goals on transparency in the online ad market, ideally acknowledging the need for future legislation on other topics.

• Have an external organization draft a code outline on which industry, civil society, academia and regulators comment.

• Improve existing ad label practices, preferably in joint consideration with the upcoming rules from the political ads transparency regulation.

• Leave out ad repository transparency – instead, focus on other efforts from the DSA and expand on the political ads transparency regulation to build a strong overarching ad repository, utilizing existing civil society expertise.

• Widen the scope of the DSA and DMA to provide more transparency of online ad placement, also improving upon existing technical industry standards.

• Use the DSA enforcement structure, industry associations and outside observers to encourage compliance with the ad code.

• Ensure a thorough regular evaluation of the code.

• View the code as a forum for exchange and collaboration, also beyond transparency issues.

The final point on collaboration is a lesson from two previous voluntary codes the Commission initiated: the code of practice on disinformation and the “cookie pledge” ⁹⁴ . The code of practice was at least successful in bringing the Commission, industry representatives and other interested parties to the table, when they had few forums for structured and long-term dialogue on tackling disinformation before. The cookie pledge failed to build such a forum for exchange. It was narrowly focused on consent banners, a common grievance for everyone involved, yet it did not yield any results, either on substance or on procedure. ⁹⁵ The DSA ad code should strive to avoid this, potentially benefiting from its direct link with EU legislation. This is different than the cookie pledge, which was a stand-alone initiative based on but not directly connected to EU data protection law.

What unites the code of practice on disinformation and the cookie pledge is the strong lobbying power of the many large businesses and industry groups involved. Big tech companies have grown into top lobby spenders in Brussels ⁹⁶ , the publishing industry is a historically strong lobbying power as well and advertisers include not only small and medium-sized companies but also some of the most profitable brands in the world. With at times opposing positions from these corporate lobbying groups, finding compromise might be difficult and there is a risk that consumer interests fall by the wayside.

Ideally, the development of DSA ad codes offers an interdisciplinary setting to critically reflect how codes of conduct, stronger enforcement of laws and new regulation might or might not help in tackling some of the issues related to online advertising. A code of conduct by itself cannot fix the ad tech landscape or gloss over the weaknesses of the DSA, but if understood as a valuable exchange forum, it could be a step towards improving both the ad tech system and platform regulation in the EU.

If the Commission, industry and civil society do not want to or cannot agree on transparency approaches to data monetization that help consumers and businesses, it might be better to not pursue DSA codes of conduct for online advertising. Instead, lawmakers could focus immediately on tackling enforcement and regulatory gaps regarding the online ad industry. Especially with the first evaluations of the DSA and DMA coming up and a view to a potential Digital Fairness Act or even a stand-alone online ads bill, there are obvious opportunities to consider enforcement and legislative action beyond transparency-focused codes of conduct. While this paper’s topic is the DSA codes of conduct and the paper cannot provide concrete, in-depth suggestions for legislative action, appendix 2 nevertheless collects some options that came up during the research and interviews to address issues in the online ad industry over the long term.

Acknowledgements

I am very grateful to the many people who shared their expertise and experiences from having worked in and/or studied online advertising and related topics. These include experts from companies and business associations dealing with various aspects of online advertising such as publishers, advertisers and ad tech companies as well as civil society organizations, research institutions and regulators; some of whom kindly agreed to be mentioned here (see below). The opinions expressed in the paper do not necessarily reflect those of the experts I talked to or of their organizations. Any remaining mistakes are mine. Beyond any potential mistakes, there are general weaknesses to be acknowledged. This short, qualitative policy-focused paper, drawing mostly on desk research and 33 expert interviews, merely provides an initial exploration of what DSA online ad codes can and should cover. For the development of any codes, more research and technical analyses are needed, for instance, regarding the specifications of ad labels or an evaluation of existing industry technical standards.

Many thanks also to the entire interface team for their support, especially to Josefine Bahro for her research, Alba Peschke Montiel for feedback and Luisa Seeling for editing.

Thank you very much for valuable input and feedback to:

• Claire Atkin (Check My Ads Institute)

• Aline Blankertz (Structural Integrity)

• Nick Botton (AWO)

• Sally Broughton Micova (University of East Anglia)

• Erik Bugge (Kobler)

• Cay Cornelius (Berliner Beauftragte für Datenschutz und Informationsfreiheit)

• Zach Edwards (Silent Push)

• Malte Engeler (Structural Integrity)

• Florian Glatzner (Verbraucherzentrale Bundesverband)

• Rachel Griffin (Sciences Po)

• Fernando Hortal Foronda

• Pooja Iyer (University of Colorado Boulder)

• Harriet Kingaby (Conscious Advertising Network)

• temi lasade-anderson

• Laureline Lemoine (AWO)

• Nathalie Maréchal (Center for Democracy and Technology)

• Max van Drunen (University of Amsterdam)

• Victoire Rio (WHAT TO FIX)

• Johnny Ryan (Irish Council for Civil Liberties)

• Emre Secgin (highfivve)

• Terry Taouss (Acceptable Ads Committee)

• Sarah Kay Wiley (Check My Ads Institute)

• Cornelius Witt (eyeo)

• Linda Worp (Opt Out Advertising)

• Bundesverband Digitale Wirtschaft (BVDW)

• Check First

• DOT Europe

• Federation of European Data and Marketing (FEDMA)

---

Appendix 1: Benefits and harms associated with online advertising

The upside: Media support and business considerations

A key argument in favor of online advertising is that it supports various offers such as email or search services that people do not have to pay for directly with money. Most prominently for the media system, advertising is a key business model for media outlets, such as news sites or blogs. Thus, it contributes to a free flow of information, supports the press and people’s fundamental right to form and express their opinions. This is vital for the functioning of democratic, rule-of-law governance systems. However, it must be noted that there are other ways to support news media apart from (behavioral) advertising.

On a more general level, regarding the merits of advertising, informing (potential) consumers of their purchasing options likely requires some paid communication, although there is a good argument to be made to scale back advertising. ⁹⁷ Companies engaged in online advertising often tout its effectiveness, especially regarding behavioral advertising, and how cheap it is compared to other forms of advertising. ⁹⁸ Still, over the years, several journalistic investigations and studies have cast doubts on this, for example, regarding difficulties in measurement or overblown metrics. ⁹⁹

Whether or not online ads are effective, people and businesses can make money in this industry (although just a few big companies make most of the profits). Advertisers in the EU spent almost 100 billion euros on digital advertising in 2023. ¹⁰⁰ In the US, the ad industry provided jobs to almost half a million people in 2022.

The downside: Privacy harms, sp and conspiraciesam, ad fraud, discrimination, cybersecurity risks, oligopolies and negative environmental effects

Advertising does not only fund deeply researched and meticulously reported journalism. Whether on websites or on social media and video apps, advertising also supports spam or made-for-advertising offers that exist mostly for the purpose of making money off ads, not to inform people. Such pages can push conspiratorial or hateful content, as this might generate attention and clicks. At least indirectly, online advertising thus contributes to incentive structures that promote the production of whatever content is useful to make money, even if it is false, antisemitic, racist or other discriminatory content. ¹⁰¹ There are several organizations trying to tackle this by reducing ad spend on such outlets ¹⁰² , but this is made more difficult by the lack of transparency around what ads are placed where (see section 3.1 and below).

Online advertising itself can be exclusionary. Often, this is arguably the point and legal. Advertisers want to reach particular (potential) customers and not others. Yet, how advertisers target certain groups of people and exclude others can also be discriminatory and illegal. In the US, for example, Meta agreed to a legal settlement over ad systems that allowed landlords, employers and credit agencies to discriminate against certain groups of people. ¹⁰³ This has been an issue offline for decades and can be exacerbated by the granular tracking and profiling of people’s online behavior. Yet, a bigger issue than targeting is the algorithmic delivery of ads. Because much of the advertising online is automated (see section 3.1), there is a risk of algorithmic biases and discriminatory effects over which even advertisers have little control. While advertisers can say who they do and do not want to address with their ads, who sees the ads is up to algorithmic delivery systems. This can also counteract potentially useful exclusionary targeting, for example, if advertisers try to purposefully exclude children or vulnerable groups from seeing certain ads. Two big players shape the advertising delivery systems globally: Google and Meta.

Google and Meta dominate the online advertising market. Google is still the key company in display advertising, controls almost half of the US search market and has seen its revenues from advertising grow in late 2024 ¹⁰⁴ . With its ad servers for publishers and advertisers, it controls a large share of both the buy- and the sell-side market. ¹⁰⁵ Meanwhile, Meta’s revenue from ads grew as well ¹⁰⁶ , with its big platforms Facebook and Instagram as main drivers. Despite other companies such as Amazon and TikTok gaining strength in the online ad industry, the dominant positions of Google and Meta have given rise to antitrust concerns, particularly on Google in the US and the EU. An investigation in the US alleges illegal monopolistic behavior on the part of Google. ¹⁰⁷ Similarly, an EU probe seeks to find out whether Google favored its own display services. ¹⁰⁸ This has led to discussions about splitting the online ad business from other parts of the company as a potential remedy.

This large scale of the online ad industry is one aspect of the industry’s opacity. In other global industries with big supply chains such as the food or textile industries ¹⁰⁹ , there are typically rules to create some transparency around this. The advertising industry lacks such binding rules. In addition, online advertising – particularly open display advertising – sticks out for its lack of transparency, not least for the notorious “unknown delta.” This is a percentage of an advertiser’s ad spend that cannot be attributed to anyone in the supply chain. In 2020, a study funded by the ad industry estimated it to be 17 percent (meaning, out of every dollar spent, it is unclear where 17 cents of that dollar go). Two years later, after efforts to improve supply chain transparency, the unknown delta was down to three percent. ¹¹⁰ Dealing with this was in the self-interest of some in the industry because at best, this opacity is wasteful and bad for business and at worst, fraudulent actors use the system to the disadvantage of reputable companies. Ad fraud has been a persistent problem, for instance, via servers that generate many clicks on ads but are not real people. ¹¹¹ There are also risks of the online ad market being used for money laundering. ¹¹² The industry’s financial opacity thus undermines the claim that online advertising (only) powers the free and open internet when, in fact, a lot of money does not reach those outlets and people supporting democratic opinion formation.

Crucially, the industry’s opaque inner workings give rise to privacy harms for individuals. The foundation for real-time bidding and ad auctions is the collection, aggregation and use of data, including personal data. This can amount to mass surveillance for advertising purposes. ¹¹³ Considering the scale of online ad auctions, people have little opportunity to grasp who uses their data in what way to make money (see section 3.1). Compliance with basic EU data protection principles such as data minimization, purpose limitation and informed consent are routinely jeopardized. ¹¹⁴

The tracking and profiling of individuals online can be a privacy violation in and of itself but is also connected to cybersecurity risks. Criminal hacking can expose personal data and behaviors. Beyond hacking, there are risks that intelligence services will buy data collected for advertising purposes with little public or parliamentary scrutiny. ¹¹⁵ In turn, intelligence and national security services are at risk themselves, with operations or personnel exposed inadvertently by apps collecting data for advertising purposes. ¹¹⁶

If advertising, whether online or offline, does not cover products and services people need, it might contribute to overconsumption. This can have harmful effects for the environment (via overproduction, trash production and more emissions) and for the financial standing of individuals (via overspending). Online advertising, in particular, has an additional sustainability angle because the ad tech industry uses a lot of energy and causes emissions. ¹¹⁷ Considering that some of the ads support fraud and spam, this becomes even more egregious, as energy consumption is not put to good use. ¹¹⁸ Some industry participants themselves recognize the environmental impact of their industry and have worked towards better measuring or at least estimating emissions, with the goal of reducing them as the next step. While sustainability initiatives might carry the risk of greenwashing, there are movements towards tackling this issue. ¹¹⁹

Appendix 2: Options to address issues in the online advertising industry beyond DSA codes of conduct

Ensure strong enforcement of existing laws touching upon the ad tech industry, chiefly the rules on data protection, platform regulation, competition and political advertising transparency

This is a boilerplate recommendation but is still crucial because such laws already address some key potential harms in theory. For example, stronger data protection enforcement should be considered (including fines, if necessary), regarding privacy by design, data minimization and purpose limitation or to address data brokers. Stronger purpose limitations on the sale or monetization of data used for online advertising could be discussed. The DSA’s prohibition of using certain types of data for advertising is also important, arguably more so than the ad label requirements from the same article, Article 26 ¹²⁰ . This restriction addresses advertising on online platforms at a more fundamental level, that is, regarding the use of data for tracking purposes, rather than only making this data use transparent. The provision should be enforced strongly right away. It could be considered to expand these restrictions beyond online platforms in the future.

Enforce and expand corporate sustainability and due diligence reporting

EU rules on corporate sustainability reporting ¹²¹ and on due diligence ¹²² in the supply chain should be enforced with a view to the online advertising sector as well. To lump the two laws together in a broad summary, both legal frameworks only apply to big companies, but these can include advertisers, publishers and ad tech intermediaries. Among other things, companies must consider and report on the positive and negative impacts their businesses, including their supply chains, have on people and the environment. Within the online advertising industry, business associations could encourage companies of all sizes to follow these measures. ¹²³ Online advertising, like other industries, contributes to greenhouse gas emissions but there is also the risk of ads financing websites, pages or videos with unfounded claims about climate change that undermine joint climate action. This could also be acknowledged in the reporting.

Use the DSA’s risk mitigation rules to tackle potential harms associated with advertising on VLOPs

The DSA specifically mentions changes to advertising systems as one risk mitigation measure that VLOPs can take. VLOPs should make use of this and the Commission and the key national regulators for the DSA, the DSCs, should encourage a focus on ad systems in their work on risk assessments and mitigation. A starting point could be a cross-platform collection of good practices and known issues.

Improve laws and enforcement for deceptive design, particularly consent requests for data processing for advertising

The Digital Fairness Act could be a place to do this, in addition to enforcing the rules that are already on the books regarding data protection, platform regulation or consumer protection. It will be important to ensure that not only consent requests but also ad labels are well-designed.

Continue to pursue antitrust investigations and strengthen competitive markets

The Commission should work with but not wait for the US to pursue its own antitrust investigations on ad tech, specifically regarding the ongoing case against Google. ¹²⁴ A breakup of big ad tech companies should be considered ¹²⁵ , although it should not be presented as a panacea either. Relatedly, conflicts of interest that underline market dominance should be addressed. For instance, US lawmakers have proposed a bill that would, among other things, prevent big brokers from acting on both sides of the advertising market. ¹²⁶

Research and test middleware for advertising systems

Ideas around “middleware” for content moderation could be adapted to advertising systems. For content moderation, very basically, middleware can be thought of as a technical solution that would allow users to pick their favored provider of content moderation and put it “in the middle” between themselves and existing platforms. Thus, they could decide what type of content they would like to see and how strict their content moderation should be. While many platforms offer some controls for content moderation, they are generally not built to foster third-party services, so there are no organizations to offer such content moderation services. For advertising, platforms also sometimes allow some degree of choice over what data is being used for ads or what interest profiles they fall into. Building on initiatives like AdChoices or other consent management tools, ad middleware could enhance users’ choices beyond single platforms’ offerings. While this could enhance user autonomy over data use, it would also place a lot of the burden on individual people and would not offer disincentives to data-gathering practices.

Strengthen restrictions on data use for advertising

According to the DSA and the regulation on the transparency for political advertising, some data use for certain types of online advertising is prohibited. It could be discussed whether further data use restrictions should be in place. During the debates around the DSA, activists pushed this call for restrictions further and called for a ban on the use of behavioral advertising. ¹²⁷ Some scholars agree with this demand. ¹²⁸ Meanwhile, research funded by big (tech) companies points to the high financial cost of banning “personalized ads,” ¹²⁹ reflecting the vehement opposition to tracking restrictions in parts of the advertising industry. The debate about stronger restrictions for online behavioral advertising raises questions on potential alternatives. One that is often mentioned is contextual advertising.

Encourage and support larger tests on contextual advertising and other forms of online ads

There are already companies focused on contextual advertising, which is not based on guessing users’ characteristics or interests, but rather on the content an ad is supposed to appear around. ¹³⁰ They claim that the system is working well for publishers and advertisers but remain a minority, nonetheless. The dominant view among most advertisers and publishers is that the financial costs of not using behavioral targeted advertising are too high. In this view, also supported by companies reliant on the tracking-based ad model to make money, the effectiveness and relative cheapness of behavioral advertising does not render contextual advertising a viable alternative. ¹³¹

For a stronger empirical basis to judge what contribution contextual advertising can make, more and better research on the effects of various forms of advertising on privacy and business considerations would be useful. “Regulatory sandboxes,” that is, opportunities to experiment with new technologies, have gained some attention in EU tech policy, for instance, within the Artificial Intelligence Act. A “contextual ads research sandbox” could be envisioned. The EU could become a stronger leader in innovative advertising practices that do not rely on tracking people and that are not tied to existing dominant companies (such as Google’s efforts to change some tracking practices). ¹³² Many publishers should be more open to test and use other, privacy-preserving alternatives to behavioral targeting.

Provide legal options for companies to act on ad placement transparency

As the paper argues, the DSA ad code, via its focus on data monetization, could enhance ad placement transparency. Other EU laws such as the DMA and the European Media Freedom Act go in a similar direction. To allow ad tech companies to also act upon this transparency, they could be empowered to demand refunds, price reductions or other proportionate remedies if ad placements do not work out as agreed. This could be done in individual contracts between ad tech companies. However, if there are dominant market players, smaller companies might have few options to shape the contracts. This is why there could be a legal guarantee to make such demands, likely mostly benefiting advertisers and publishers. The Check My Ads Institute has likened this to “lemon laws” in the US ¹³³ , referring to consumer rights for faulty used cars known as lemons. In the EU, similar consumer protection rules already exist. ¹³⁴ For businesses, the platform-to-business regulation offers some transparency rules, but could be expanded to allow more redress mechanisms with a view to online advertising.

Consider an online ad tax

While much more detailed research and planning on a global scale would be necessary to think through and avoid potential negative unintended consequences, proposals for taxing digital advertising already exist to build upon. ¹³⁵ The idea is to discourage the amassing and use of large amounts of data for advertising purposes, thus recognizing the foundational role that tracking and data use plays. ¹³⁶ One of the open questions to be addressed is whether contextual advertising can be a viable widespread alternative (see above) and whether a strong emphasis on subscription-based news and information services, as Acemoglu and Johnson envision, is desirable for democratic opinion formation and discourse. In connection with the point on contextual advertising, it could be considered whether behavioral advertising can be taxed more than contextual advertising that uses fewer personal data.

Encourage and build alternatives to commercial digital spaces for communication and information

Debates about treating online platforms as public infrastructure have been going on for years. Similarly, there have been ideas to build and/or strengthen noncommercial public online communication spaces. ¹³⁷ Such ideas fundamentally question the role of for-profit platforms in the digital public sphere, even beyond advertising-based models. ¹³⁸

Appendix 3: Article 46 DSA – Codes of conduct for online advertising

1. The Commission shall encourage and facilitate the drawing up of voluntary codes of conduct at Union level by providers of online platforms and other relevant service providers, such as providers of online advertising intermediary services, other actors involved in the programmatic advertising value chain, or organisations representing recipients of the service and civil society organisations or relevant authorities to contribute to further transparency for actors in the online advertising value chain beyond the requirements of Articles 26 and 39. The Commission shall aim to ensure that the codes of conduct pursue an effective transmission of information that fully respects the rights and interests of all parties involved, as well as a competitive, transparent and fair environment in online advertising, in accordance with Union and national law, in particular on competition and the protection of privacy and personal data. The Commission shall aim to ensure that the codes of conduct at least address the following:

(a) the transmission of information held by providers of online advertising intermediaries to recipients of the service concerning the requirements set in Article 26(1), points (b), (c) and (d);

(b) the transmission of information held by providers of online advertising intermediaries to the repositories pursuant to Article 39;

(c) meaningful information on data monetisation.

3. The Commission shall encourage the development of the codes of conduct by 18 February 2025 and their application by 18 August 2025.

4. The Commission shall encourage all the actors in the online advertising value chain referred to in paragraph 1 to endorse the commitments stated in the codes of conduct, and to comply with them.