The arrival of the internet has revolutionized the advertising landscape, and since the appearance of the first banner ad in 1994, innovative technologies have been developed in the field of online advertising. Since then, new stakeholders, such as online platforms, have emerged and a whole spectrum of new digital (behavioural) advertising means are used that increasingly rely on the use of data for online advertising.

While online advertising brings lots of opportunities for companies wanting to promote their services and products, it may also have adverse effects for fair commercial competition, be perceived as a disturbing factor by users of online services and impinge on fundamental rights of users.

To safeguard these rights and fair competition, there is an established legal framework in place today in the EU consisting of a patchwork of rules focused on enhancing transparency vis-à-vis the recipients of the advertisements, on the one hand, and restricting or prohibiting certain practices, on the other hand. In addition, the content of online advertising is also subject to a range of general and sector-specific self-regulatory and legislative requirements that apply, in principle, indiscriminately to all types of advertising.

Although the use of personal data for online advertising is regulated in general under the General Data Protection Regulation, more targeted regulation has been adopted or proposed recently that will introduce additional rules for more sophisticated data use in the advertising sector.

In this article, we provide a schematic overview of these new legal instruments establishing specific rules for online advertising (stricto sensu). Essentially, they contain stricter transparency obligations for specific actors and additional restrictions on the use of certain types of data for online advertising. At the same time, the upcoming direct marketing rules will be more harmonised across the EU as they are included in EU-wide regulations whereas most of the current rules stem from EU directives and hence transposed in national legislation.

As you will see from the overview, the rules are in a certain way limited but nevertheless impactful on online advertising, especially when combined with the recent case-law from the Court of Justice and national supervisory authorities in this area (e.g. the decision by the Irish Data Protection Commissioner on contract as a legal basis for targeted ads (read more here); the CJEU decision in case C-102/20). The framework may of course still further evolve as the pending proposal texts go through the legislative process in Brussels.

  • Transparency requirements


  • Restrictions on data use



(*) The italicised legal instruments in the tables above are at the moment of publication of this article not yet finally adopted by the EU legislator.