The Glass Box: How the EU's DSA Keeps the Receipt

A landmark law

The first law that made platforms keep the evidence.

The EU's Digital Services Act has been in force since 2022 and has applied to every platform since 17 February 2024. It did something no government had managed before: it took the old principle that what is illegal offline is illegal online and made it enforceable law across an entire continent. For the very largest platforms it goes further, forcing open an advertising system that had been a black box by design.

2024

Fully applicable to all platforms across the Union

~450M

People in the EU protected by the same transparency rules

Up to 6%

Of global annual turnover, the maximum DSA fine

Art. 39

The clause that puts every ad on the public record

What the glass box guarantees

Every ad, on the record, kept for a year.

Under the Digital Services Act, the largest platforms have to publish a searchable archive of every ad they carry and leave it standing long after the campaign ends. These are the duties it puts on them, one by one.

A public ad repository

Every Very Large Online Platform must run a searchable library of the ads it shows, commercial ads included, not just political ones. Journalists, regulators and ordinary citizens can query it directly.

DSA Art. 39

On the record

The obligation is written into Article 39 of the Digital Services Act, which requires each VLOP to keep a public, searchable repository of the advertisements it has presented. EUR-Lex · DSA Art. 39

Who paid, on every ad

The repository must name the advertiser and, where different, the person or entity who paid for the ad. No more anonymous money buying a million impressions.

Payer disclosed

Enforced

When the Commission fined X in Dec 2025, one confirmed breach was that its ad repository failed to let users search reliably for who ran and paid for ads. The "who paid" duty is actively enforced. European Commission

How it was targeted

Platforms must disclose the main targeting parameters behind each ad and the audience it was aimed at. The machinery of micro-targeting stops being invisible.

Targeting shown

Enforced

The Commission's binding commitments from TikTok (Dec 2025) require the repository to show full ad content including URLs, targeting criteria, and updates within 24 hours, with added search filters. European Commission

How far it reached

The repository must record how many people the ad reached, broken down by Member State where relevant. An ad's real scale becomes a matter of public record instead of a platform secret.

Reach recorded

On the record

Article 39 requires the repository to include, for each ad, the total number of recipients reached and, where applicable, aggregate numbers per Member State. EUR-Lex · DSA Art. 39

Kept for a full year

The ad doesn't vanish when the campaign ends. It stays in the repository for a year after it last ran, which is exactly the window a black-box system erases.

1-year retention

On the record

Article 39 sets the retention period at one year after the advertisement was presented for the last time on the platform. EUR-Lex · DSA Art. 39

Vetted-researcher access

Beyond the public library, the DSA gives vetted researchers a right to platform data, so fraud and influence operations can actually be investigated after the fact.

DSA Art. 40

Enforced

The €120M X decision confirmed a breach of Art. 40(12) researcher data access, and the Commission has pressed both Meta and TikTok over burdensome researcher-access tools. The access right is being actively enforced. European Commission

The law itself

Article 39, in full.

The public ad archive is not a courtesy platforms extend. It is a legal obligation, spelled out in Article 39 of the Digital Services Act. Here is what the article requires, clause by clause, in the law's own words and in plain English.

DSA · Article 39(1): the obligation

“Providers of very large online platforms … that present advertisements on their online interfaces shall compile and make publicly available … through a searchable and reliable tool that allows multicriteria queries and through application programming interfaces, a repository containing the information referred to in paragraph 2, for the entire period during which they present an advertisement and until one year after the advertisement was presented for the last time …”

Art. 39(1)

A public, searchable repository, kept for a year

“… a searchable and reliable tool that allows multicriteria queries and through application programming interfaces …”

Every Very Large Online Platform and search engine must run a public ad library. It has to be searchable by multiple criteria and accessible through an API, so researchers and journalists can query it at scale. Every ad must stay in it for a full year after it last ran.

Art. 39(2)(a)

The content of the ad

“the content of the advertisement, including the name of the product, service or brand and the subject matter of the advertisement;”

The actual creative goes on the record, not just a reference to it: what was shown, and which product, service or brand it was for.

Art. 39(2)(b)

On whose behalf it ran

“the natural or legal person on whose behalf the advertisement is presented;”

The advertiser must be named. No more anonymous brands buying reach behind a blank profile.

Art. 39(2)(c)

Who actually paid

“the natural or legal person who paid for the advertisement, if that person is different from the person referred to in point (b);”

Where the payer differs from the advertiser, both are disclosed. That closes the loophole where the money behind a campaign hides behind an agency or a front.

Art. 39(2)(d)

When it ran

“the period during which the advertisement was presented;”

The exact window the ad was live, so a campaign's timing can be reconstructed after the fact.

Art. 39(2)(e)

How it was targeted

“whether the advertisement was intended to be presented … to one or more particular groups of recipients … and if so, the main parameters used for that purpose including where applicable the main parameters used to exclude one or more of such … groups;”

The targeting parameters become public: who the ad was aimed at and, just as importantly, who was deliberately excluded from seeing it.

Art. 39(2)(g)

How far it reached

“the total number of recipients … reached and, where applicable, aggregate numbers broken down by Member State for the group or groups of recipients that the advertisement specifically targeted.”

An ad's real scale, meaning how many people it reached in each country, is a matter of public record rather than a platform secret.

Art. 39(1) & (3)

Accurate, but never at the cost of your privacy

“They shall ensure that the repository does not contain any personal data of the recipients of the service to whom the advertisement was or could have been presented …”

The archive names the advertisers and the money, not the ordinary people who saw the ad. The transparency points up at power, never down at users.

Full text: Regulation (EU) 2022/2065 (Digital Services Act), Article 39 · EUR-Lex

The same campaign, logged

The same 24 hours —
this time, all of it on the record.

The same campaign that vanishes in a black-box market leaves a full paper trail in the EU. This is what the DSA makes happen, step by step.

Hour 0 · Ad goes live

It runs, and it is logged from the first impression.

An advertiser launches a campaign. The moment it starts serving, it must appear in the platform's public ad repository with the advertiser's identity attached, searchable by anyone, right away.

Hours 1-24 · Mass delivery

The reach is counted as it happens.

The algorithm delivers the ad to its targeted audience. Whether it reaches 50,000 people or 5 million, the repository records the totals, broken down per Member State where applicable.

📈 Reach: recorded & public

Hour 24 · Campaign ends

The campaign stops. The record does not.

The ad stops serving. In a black-box market this is where the evidence disappears. Under the DSA, this is where the retention clock starts.

Hour 25 → one year later · On the record

The receipt survives the campaign.

Content, advertiser, who paid, targeting parameters and reach stay in the repository for a full year after the last impression. A journalist can find it. A researcher can study it. A regulator can act. A defrauded citizen can trace the product back to the ad.

Content: kept Reach: kept Targeting: kept

1 yr

that the ad's content, payer, targeting and reach stay public after it stops running in the EU, which is exactly the window a black-box system leaves empty.

On the record

The fines are real.

Every case below is a documented action by the European Commission: a fine, a binding commitment, or a formal proceeding on the public record. This is the ad-transparency regime actually working, with dates and sources.

€120MFirst DSA fine

X fined, with the ad repository among the breaches

On 5 December 2025 the Commission issued its first-ever DSA non-compliance decision, fining X €120 million. Three breaches were confirmed: the deceptive "Blue check" design (Art. 25), the advertising repository (Art. 39), and researcher data access (Art. 40(12)). X was given 60/90 working days to remedy.

European Commission

€200MLargest DSA fine

Temu fined €200M over illegal, unsafe products

On 28 May 2026 the Commission fined Temu €200 million, the largest DSA fine to date, for an inadequate risk assessment on illegal products, with evidence including unsafe chargers and hazardous baby toys. Temu must submit an action plan by 28 Aug 2026. The regime reaches marketplaces, not just social feeds.

European Commission

≤24hRepository refresh

TikTok's binding commitments fixed its ad library

On 5 December 2025 the Commission accepted binding Article 71 commitments from TikTok that close the advertising-transparency strand of its case: full ad content including URLs, repository updates within 24 hours, targeting criteria disclosed, and added search filters. A preliminary finding in May 2025 had held TikTok's repository non-compliant. The fix is now enforceable.

European Commission Preliminary finding

5.9Mads removed

One trusted flagger, 5.9 million ads pulled from Meta

In 2025 a single DSA "trusted flagger" filed reports that led to 5.9 million ads removed from Meta, a takedown rate of about 99.8%. The mechanism only works because the ads are visible and reportable in the first place.

Debunk.org

BindingAliExpress

AliExpress locked into ad & recommender transparency

On 18 June 2025 the Commission made binding AliExpress's commitments on advertising and recommender transparency, researcher data access, and trader traceability, overseen by an independent Monitoring Trustee, while pressing a separate open track on illegal products. Voluntary promises turned into enforceable obligations.

European Commission

The two systems, side by side

The same scam ad runs in both places. Only one of them keeps a record.

🇪🇺 European Union

The ad is archived for a full year under Article 39 of the DSA, with its content, who paid, how it was targeted, and how many people saw it in each country, searchable by anyone. That data trail is what let the Commission fine X €120M and force TikTok's ad repository into compliance.

🇺🇸 United States

The ad runs, reaches a few million people, and ends. It is removed from the ad library and nothing about it is kept: not the content, not the reach, not who paid. Anyone who tries to trace it later, whether a journalist, a regulator or a parent who got scammed, hits a dead end.

The gap, reversed

The EU wrote the rule the US never did.

The EU's Digital Services Act mandates transparency. The US has no federal ad-transparency law to match it.

🇪🇺

European Union

Digital Services Act (DSA) enforced

✓

All ads archived for 1 year after last shown (Art. 39)

✓

Reach data recorded, including per Member State

✓

Targeting criteria and audience disclosed

✓

Vetted researchers can investigate fraud & influence ops (Art. 40)

✓

All major platforms must comply, including TikTok

✓

Payer and beneficiary info required on every ad

🇺🇸

United States

No federal ad transparency law

No archive of commercial ads after they stop running

No reach or impression data, ever

No targeting criteria disclosed

No way to investigate fraud or influence ops retroactively

TikTok has no US ad library at all

No payer or beneficiary information

The US contrast is documented in The Black Box: a Reuters investigation found Meta internally projected roughly $16B (~10%) of 2024 revenue from scam, illegal-gambling and prohibited-goods ads, almost none of it archived where the public can see it. Reuters

Platform by platform

What each VLOP must now disclose in the EU.

TV advertising has always been public.

Every TV commercial airs in the open, where anyone can see it and anyone can challenge it. There is no good reason why online advertising, which can aim any message at millions of individually chosen people, should get to operate in the dark. In the EU, it no longer does.

The same ad that vanishes in a black-box market is, in the EU, logged, kept for a year, and searchable by anyone: its content, its payer, its targeting, its reach. The evidence outlives the campaign.

Explore the platform transparency data →

One continentkeeps the receipt.

The first law that made platforms keep the evidence.

Every ad, on the record, kept for a year.

Article 39, in full.

A public, searchable repository, kept for a year

The content of the ad

On whose behalf it ran

Who actually paid

When it ran

How it was targeted

How far it reached

Accurate, but never at the cost of your privacy

The same 24 hours —this time, all of it on the record.

The fines are real.

X fined, with the ad repository among the breaches

Temu fined €200M over illegal, unsafe products

TikTok's binding commitments fixed its ad library

One trusted flagger, 5.9 million ads pulled from Meta

AliExpress locked into ad & recommender transparency

The same scam ad runs in both places. Only one of them keeps a record.

The EU wrote the rule the US never did.

What each VLOP must now disclose in the EU.

TV advertising has always been public.

One continent
keeps the receipt.

The same 24 hours —
this time, all of it on the record.