Article 39 is where the DSA stops talking principles and starts naming fields: every very large platform must keep a public, searchable repository of every ad it shows in the EU (who paid, how it was targeted, whom it reached) for a year, with an API. That makes it the one ad-transparency obligation you can score, requirement by requirement. So we did, using the Commission's own proceedings and independent audits, nothing else.
The first fine ever issued under the DSA, €120M against X, was tied in part to its ad repository. Five of the eleven requirements are fully met by no platform at all. And half of the repositories have never been formally examined.
Article 39 specifies the ad repository down to the field: what it must contain, how it must be searchable, and how long ads must stay. Here is every requirement, scored against what each repository verifiably delivers, worst first.
The first-ever DSA non-compliance decision (5 Dec 2025) confirmed X’s ad repository breaches Art. 39: ad content and the paying entity are missing, and access barriers hinder scrutiny. X is appealing; the remedy deadline has passed with no public fix.
5 Dec 2025 — the first-ever DSA non-compliance decision: a €120M fine, with the Art. 39 ad-repository breach confirmed, not preliminary.
12 Jul 2024 — preliminary findings: no searchable and reliable repository; design features and access barriers make it unfit for supervision and research.
Apr 2024 — Mozilla & CheckFirst rated X’s repository worst-in-class: CSV file dumps with no working search.
16 Feb 2026 — X appealed to the EU General Court; the 90-working-day remedy deadline passed with no public outcome.
The Commission preliminarily found the library breached Art. 39 (May 2025: missing ad content, targeting and funding data, inadequate search). Remediation is now legally binding and part-delivered: targeting criteria, reach ranges and 24-hour updates are live in the library today, with the hardest items — in-feed ad content with URLs, full per-member-state reach and researcher search — due by Dec 2026 under monitoring.
15 May 2025 — preliminary finding: the repository lacked ad content, targeting data and who paid, and couldn’t be comprehensively searched.
5 Dec 2025 — commitments made binding: full in-feed ad content incl. URLs, ≤24-hour updates, targeting criteria, audience by age/gender/member state and new search filters — on a 2-to-12-month rolling schedule.
By mid-2026 — the early items are live: the library now shows targeting criteria and reach ranges and refreshes within 24 hours; the hardest items (in-feed URLs, per-member-state reach, researcher search/API) remain due by Dec 2026.
Breaking a binding commitment is itself a DSA breach — enforcement reopens without a new investigation.
Art. 39 has never been formally tested against the Ad Library — the most functional repository audits have measured, and the one whose own data keeps exposing approved scam and pornographic ads. Meta’s EU ads are instead under a systemic-risk investigation (Arts. 34/35) since April 2024.
Apr 2024 — rated the most mature of 12 repositories tested by Mozilla & CheckFirst, still with “big gaps in data and functionality”.
AI Forensics used the library’s own data to document 3,000+ approved pornographic ads and 46,000+ health-scam ads (292M+ EU impressions) — and that under 5% of undeclared political ads get caught.
30 Apr 2024 — formal proceedings over deceptive ads as a systemic risk (Arts. 34/35); 24 Oct 2025 — preliminary findings on notice-and-action (Art. 16) and researcher access (Art. 40). Art. 39 itself: untouched.
Since Oct 2025 Meta accepts no political, electoral or social-issue ads in the EU, calling the TTPA’s rules “unworkable” — the most scrutinised ad category simply left the library.
No DSA proceedings have ever been opened against Google or YouTube — on any ground. Yet the Ads Transparency Center cannot be searched by what an ad says, and bulk transparency data lags around 90 days.
The only major ad repository never formally examined — no DSA proceedings against Google or YouTube on any ground, only requests for information.
Search is by advertiser only: there is no way to find ads by what they say or show.
Bulk transparency data lags roughly 90 days — an eternity in an election cycle.
Since Sep 2025 Google serves no political ads in the EU (TTPA); YouTube stopped on 23 Sep 2025.
Every obligation Art. 39 imposes, against what each repository verifiably delivers.
Art. 39 requires
X Ads RepositoryX
TikTok Commercial Content LibraryTikTok
Meta Ad LibraryFacebook & Instagram
Google Ads Transparency CenterGoogle Search & YouTube
The ad itselfArt. 39(2)(a) — The content of each ad — the product, service or brand and its subject matter.
Ad content & subject matter missing· EC
Creative shown; full in-feed content + URLs due Dec 2026· EC
Creatives stored & shown
Creatives shown
Who advertisedArt. 39(2)(b) — The natural or legal person on whose behalf the ad is presented.
Raw CSV downloads only· audit
Advertiser shown in the library
Self-declared, weakly verified· audit
Verified advertiser identity
Who paidArt. 39(2)(c) — The person who paid for the ad, where different from the advertiser.
Paying entity missing· EC
Funding data rolling out; due Dec 2026· EC
“Paid for by” is self-declared· audit
—Payer vs advertiser not surfaced
When it ranArt. 39(2)(d) — The period during which the ad was presented.
Buried in raw CSV dumps· audit
Run dates shown
Run dates shown
Date ranges shown
How it was targetedArt. 39(2)(e) — Whether the ad was targeted, and the main parameters used — including any parameters used to exclude groups.
No workable disclosure· audit
Targeting criteria now shown; full breakdown due Dec 2026· EC
EU parameters shown, but coarse· audit
Broad parameters only· audit
Who it reachedArt. 39(2)(g) — Total recipients reached — broken down per EU member state for the targeted groups.
No usable reach data· audit
Reach ranges now shown; per-member-state due Dec 2026· EC
EU reach by member state, age & gender
Audit-rated incomplete· audit
Influencer / branded contentArt. 39(2)(f) — Commercial communications users have declared under Art. 26(2) (paid creator content).
—No public evidence
Commercial content covered by design
—No clear public evidence
—No public evidence
Searchable & reliableArt. 39(1) — A searchable and reliable tool allowing multicriteria queries.
No searchable, reliable tool· EC
Improving; researcher search + API due 2026· EC
Works, with audit-documented gaps· audit
Advertiser lookup only — no search of ad content· audit
API accessArt. 39(1) — Programmatic access to the repository through APIs.
Access barriers block scrutiny· EC
Commercial Content API live; wider access due 2026· EC
Rate-limited; Art. 40 finding on access· EC
No general API; ~90-day bulk-data lag· audit
One-year archiveArt. 39(1) — Every ad stays in the repository while it runs and for one year after it was last shown.
—Unverifiable behind access barriers
One-year archive stated
One year; seven for political ads
One year stated for EU ads
How current the data isArt. 39(1) — A reliable tool means ads appear and the data updates without long delay — the Commission set a 24-hour target for TikTok.
Batched CSV exports, not continuous· audit
Updated within 24h (binding commitment)· EC
Ads appear within ~24h· audit
Systematic DSA data lags ~90 days· audit
Delivered
Partial / contested
Failing
— No public evidence
EC Commission finding
Audit Independent audit
The violation score on each card is derived from the cells below: two points for every requirement a repository fails outright, one for every one it only partly meets. Requirements with no public evidence never count against it. Assessments combine European Commission formal proceedings, preliminary findings, binding commitments and decisions (see the DSA Enforcement Tracker for full case timelines) with the independent audits cited on each card. Preliminary findings are not a final decision; cells with no public evidence are left unscored rather than guessed. Last reviewed 13 July 2026.
Art. 39 · Enforcement
The enforcement gap
The scoreboard measures compliance: what each repository actually delivers. Whether the Commission has acted on a failure is a separate question, and the more revealing one. Line the two up and a pattern appears: the worst repository drew the first-ever DSA fine, while half the repositories have never had Art. 39 tested at all.
5 of 11Art. 39 requirements not one repository fully deliverswho paid, how it was targeted, searchable & reliable, API access, how current the data is
2 of 4repositories never examined under Art. 39 itselfMeta Ad Library (Facebook & Instagram) and Google Ads Transparency Center (Google Search & YouTube)
€120Mthe only fine ever tied to an Art. 39 breachX, Dec 2025 — under appeal
X Ads Repository
covers X
Enforced — breach confirmed
The specific issues
The ad itselfArt. 39(2)(a)Ad content & subject matter missing· EC
Who paidArt. 39(2)(c)Paying entity missing· EC
How it was targetedArt. 39(2)(e)No workable disclosure· audit
Who it reachedArt. 39(2)(g)No usable reach data· audit
+5 more requirements scored partial or unmet. See the scoreboard above.
The enforcement
The first-ever DSA non-compliance decision (5 Dec 2025) confirmed X’s ad repository breaches Art. 39: ad content and the paying entity are missing, and access barriers hinder scrutiny. X is appealing; the remedy deadline has passed with no public fix.
The ad itselfArt. 39(2)(a)Creative shown; full in-feed content + URLs due Dec 2026· EC
Who paidArt. 39(2)(c)Funding data rolling out; due Dec 2026· EC
How it was targetedArt. 39(2)(e)Targeting criteria now shown; full breakdown due Dec 2026· EC
Who it reachedArt. 39(2)(g)Reach ranges now shown; per-member-state due Dec 2026· EC
+3 more requirements scored partial or unmet. See the scoreboard above.
The enforcement
The Commission preliminarily found the library breached Art. 39 (May 2025: missing ad content, targeting and funding data, inadequate search). Remediation is now legally binding and part-delivered: targeting criteria, reach ranges and 24-hour updates are live in the library today, with the hardest items — in-feed ad content with URLs, full per-member-state reach and researcher search — due by Dec 2026 under monitoring.
Who advertisedArt. 39(2)(b)Self-declared, weakly verified· audit
Who paidArt. 39(2)(c)“Paid for by” is self-declared· audit
How it was targetedArt. 39(2)(e)EU parameters shown, but coarse· audit
Searchable & reliableArt. 39(1)Works, with audit-documented gaps· audit
+2 more requirements scored partial or unmet. See the scoreboard above.
The enforcement
Art. 39 has never been formally tested against the Ad Library — the most functional repository audits have measured, and the one whose own data keeps exposing approved scam and pornographic ads. Meta’s EU ads are instead under a systemic-risk investigation (Arts. 34/35) since April 2024.
The ads are under investigation, but Art. 39, the repository requirement itself, has not been tested.
Google Ads Transparency Center
covers Google Search & YouTube
No enforcement — never examined
The specific issues
Searchable & reliableArt. 39(1)Advertiser lookup only — no search of ad content· audit
How current the data isArt. 39(1)Systematic DSA data lags ~90 days· audit
How it was targetedArt. 39(2)(e)Broad parameters only· audit
Who it reachedArt. 39(2)(g)Audit-rated incomplete· audit
+1 more requirement scored partial or unmet. See the scoreboard above.
The enforcement
No DSA proceedings have ever been opened against Google or YouTube — on any ground. Yet the Ads Transparency Center cannot be searched by what an ad says, and bulk transparency data lags around 90 days.
Compliance is scored from the Commission's own proceedings and cited independent audits (see the scoreboard above). Enforcement links to the DSA Enforcement Tracker, where every case carries its full timeline and Commission sources. A repository can fail a requirement without any proceeding ever testing it. That absence is the gap.
What the reports actually say about ads
Across all 16 unique reports analysed, ads show up only as a content-moderation subcategory (“we action ads against our Advertising Standards, here are the counts”). No report references its public ad repository (Art. 39), and no report covers targeting limits (Art. 26(3) / Art. 28). Several even carve ad data out entirely.
How each platform buries its ads in the report
Google / YouTube
The report openly excludes ad-moderation done before an ad is surfaced ("content moderation actions on advertisements that are taken before the advertisement is surfaced on a VLOSE or VLOP are not included in this report"), so the bulk of rejections never appear. It does disclose that 0.17% of fully-automated ad enforcement decisions in the EU were overturned on human review.
Meta (Facebook + Instagram)
Ads fold into "Advertising + Commerce Content", and ad review "relies primarily on automated tools."
TikTok
Ads are an "Advertising Policies" sub-policy inside the removals table; advertisers appear only as a class of users who can appeal.
The biannual DSA transparency reports
The latest four biannual DSA transparency reports from each platform: the download the scoreboard is a corrective to. Ads surface here only as moderation counts; none of the Article 39 fields above appear in them.
Google / YouTube
Combined VLOSE/VLOP report — YouTube has no standalone report; its DSA data lives in Google’s combined report.
