Online advertising: what the DSA changes for Luxembourg advertisers

Since 17 February 2024, the EU Digital Services Act (DSA) has imposed new rules on online advertising, and Luxembourg's Autorité de la concurrence (competition authority) has been designated national coordinator to oversee their application. For an advertiser or media agency based in Luxembourg, this is no longer a tech news item to skim: three points call for concrete action.

Already in force, with national transposition following

The DSA (Regulation (EU) 2022/2065) has applied to all platforms since 17 February 2024, after early application to very large platforms from 25 August 2023, according to a Luxembourg government press release of 19 February 2024. At national level, bill 8309 transposing the DSA into Luxembourg law was adopted by the Chambre des députés on 2 April 2025, which means the framework is now consolidated in national law and not only at European level.

Audit your targeting: Articles 26 and 28 are not negotiable

Two DSA provisions directly affect programmatic campaigns. Article 26 requires platforms to clearly identify the advertiser and the payer of an ad, to disclose the main targeting parameters used, and prohibits advertising based on profiling that relies on special categories of data within the meaning of the GDPR, in other words so-called sensitive data (health, sexual orientation, political or religious opinions, among others). Article 28 prohibits targeted advertising based on the profiling of minors on platforms accessible to them, as Paperjam points out in its explainer “DSA, ce qui change pour les utilisateurs” (“DSA: what changes for users”). Both obligations have been in force since 17 February 2024.

In practice, for a media agency or a company buying advertising space on the major platforms, this means reviewing the targeting parameters of its current campaigns: no segment should rely on sensitive data, and no campaign should target minors using behavioural profiling criteria. This ties in with obligations already familiar to companies doing prospecting, as discussed in our article on email prospecting and the GDPR in B2B in Luxembourg.

In a dispute with a platform, a single national point of contact

Since 17 February 2024, Luxembourg's Autorité de la concurrence has been the Digital Services Coordinator for Luxembourg, responsible for monitoring platform providers' compliance and handling complaints, according to its own communications. An advertiser or agency in a dispute with Meta, Google or any other platform over the moderation of an ad, the suspension of an ad account or a suspected breach of Articles 26 or 28 can file a complaint using the form available on guichet.lu, addressed to the Autorité de la concurrence.

Responsibilities nonetheless remain shared. On 11 March 2025, the Autorité de la concurrence signed a cooperation agreement with seven other national authorities, including the CNPD, ALIA, ILNAS and the Police grand-ducale, to clarify how DSA responsibilities are divided in Luxembourg, as the Autorité de la concurrence and the CNPD state jointly. A single case may therefore involve several authorities depending on whether it concerns data protection, audiovisual content or technical security.

Transparency reports, a new media audit tool

Article 26 requires platforms to publish the main parameters used to target a given ad, and very large platforms must produce transparency reports on their advertising practices. For a Luxembourg media buyer, these reports become an audit source to build into campaign monitoring: they make it possible to check, after the fact, that the parameters actually applied by the platform match what was requested, and to document compliance in the event of an inspection. An agency that never consults these reports misses a simple way to check what the platform actually does with its campaigns.

The DSA adds to the GDPR, it does not replace it

The DSA in no way exempts companies from the GDPR obligations already overseen by the CNPD in Luxembourg: it supplements them in the specific area of online platforms and targeted advertising. A GDPR-compliant company is not automatically DSA-compliant, and vice versa. On internal governance of personal data, our article on appointing a DPO remains a useful starting point. For any contentious situation, it is best to seek legal advice: this article provides information on the applicable framework and does not constitute legal advice. If you are unsure which body to contact depending on your company's stage, our guide to the House of Entrepreneurship can also help direct your steps.