DSA - Targeted advertising aimed at minors: a future ban?

In 2022, more than 60 countries - including all European Union ("EU") member states, the United States, the United Kingdom, Canada and Japan - signed the Declaration for the Future of the Internet and committed to promoting online safety to make the internet a safe and secure space for everyone, especially children.

This Declaration directly echoes the European Digital Services Act (DSA) - adopted on 19 October 2022 - which states in its recital 71 that "The protection of minors is an important policy objective of the Union" and prohibits online platforms from showing targeted advertisements to minors based on the use of their personal data.

The DSA ban is not new; several European data protection authorities have already issued their recommendations on the subject. Moreover, the implementation of the ban is anything but straightforward and raises many questions: how will it apply to different actors? How will it be possible to know with certainty that users are over 18 when serving them targeted advertising? Will they have to use age verification systems?

The DSA: The keystone of a future ban

Where the provider of the online platform knows that a minor is using its platform, it must not offer targeted advertisements or use the minor's personal data for these purposes.

Indeed, Article 28.2 states that "Providers of online platforms shall not present advertisements on their interface based on profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679 using personal data of the recipient of the service when they are aware with reasonable certainty that the recipient of the service is a minor."

Article 24 of the draft DSA, dated 20 January 2022, provides more firmly that "Targeting or amplification techniques that process, reveal or infer personal data of minors or personal data […] for the purpose of displaying advertisements are prohibited."

The final text thus gives online platform providers some freedom through the use of the words "with reasonable certainty". However, the degree of certainty required is unknown at this stage and we will probably have to wait until the DSA comes into force to find out.

Although the DSA’s entry into force seems far away (17 February 2024), this does not mean that offering targeted advertisements to minors is exempt from all rules and/or guarantees.

The existence of an unspoken ban

The introduction of the ban in the DSA caused quite a stir. Indeed, the negotiation of this particular point was very heated: some wanted an outright ban on all forms of targeted advertising, while others had a more measured approach that focused on banning certain forms of targeted advertising.

Much ado about nothing! The ban on using the personal data of minors for advertising purposes already exists in practice.

Several European data protection authorities have taken a position on this thorny issue, including the French ("CNIL"), Irish ("DPC") and British ("ICO") authorities.

The CNIL, in its recommendation n°8 to reinforce the protection of minors online, states that the profiling of minors and especially the reuse and transmission of their personal data to third parties for commercial or advertising purposes should be avoided. 

The DPC, on the other hand, establishes as a fundamental principle (as part of fundamentals for a child-oriented approach to data processing) that personal data of minors should not be used for marketing or advertising purposes because of their vulnerability and sensitivity to behavioural advertising, unless the providers of online platforms demonstrate how and why it is in the best interests of the child to carry out such processing.

Finally, the ICO in its Age Appropriate Design Code states that there should always be a specific privacy setting for behavioural advertising that is used to fund a service, but which is not part of the service the child wishes to access. The ICO points out that in most cases, behavioural advertising will be separate from the service offered to children and should therefore be disabled by default.

Ultimately, it is impossible to say that using minors' personal data to offer them targeted advertising can be done freely without any safeguards. The DSA has therefore only endorsed a ban that already exists in practice. Whether one agrees that the ban exists or is forthcoming, its implementation is no less complex.

Complex implementation: which actors are involved?

The prohibition introduced by the DSA should only apply to online platforms defined as "a hosting service that, at the request of a recipient of the service, stores and disseminates information to the public, unless that activity is a minor and purely ancillary feature of another service or a minor functionality of the principal service and, for objective and technical reasons, cannot be used without that other service, and the integration of the feature or functionality into the other service is not a means to circumvent the applicability of this Regulation”.

This definition encompasses marketplaces, social networks, content sharing platforms, e-commerce sites and application shops.

Article 19 of the DSA expressly excludes micro and small enterprises from the rules laid down in Articles 19 to 28, which includes the prohibition of advertising targeted at minors. According to the definition given by the European Commission Recommendation 2003/361/EC, a micro enterprise is defined as an enterprise employing fewer than 10 persons and whose turnover does not exceed EUR 2 million. A small enterprise is defined as an enterprise employing fewer than 50 persons with a turnover not exceeding EUR 10 million.

Thus, with the exception of micro and small enterprises, the ban applies to all actors meeting the above definition and using targeted advertising, regardless of their size or form (medium-sized enterprises, large enterprises, platforms, GAFAM, etc.).

The implementation of the ban between the different actors remains an open question. There is, at this stage, no clear-cut answer as to what degree of compliance will be required in practice. Furthermore, while the DSA expressly excludes micro and small enterprises, data protection authorities do not. It is therefore possible that data protection authorities will continue to apply their doctrine to all actors regardless of their size.

Complex implementation: what about age verification?

Not offering targeted advertising to minors necessarily implies having a way of verifying the age of users, or at least estimating it. However, it is anything but easy - especially for smaller companies - to know the age of all their users with the precision that would allow them to exclude them from any targeted advertising campaign.

Furthermore, there is no general obligation to verify the age of users on all websites and for all users, as verification is only required by law in certain scenarios (pornographic sites, online betting sites, etc.). Additionally, Article 28.3 of the DSA states that “Compliance with the obligations set out in this Article shall not oblige providers of online platforms to process additional personal data in order to assess whether the recipient of the service is a minor.”

Recital 71 of the DSA further states that the provider of the online platform should neither "maintain, acquire or process more personal data than it already has in order to assess if the recipient of the service is a minor" nor "collect the age of the recipient of the service prior to their use".

On the one hand, the DSA obliges online platforms to stop offering targeted ads to minors and, on the other hand, removes the possibility for them to collect additional information that could allow them to assess the age of their users. The platforms therefore have a sword of Damocles hanging over their heads with no real solution other than to stop offering targeted ads to all their users or to use a trusted third party.

Indeed, in the absence of a real age verification system, how will it be possible for companies to be certain that the people who visit their sites or mobile applications are over 18 and can therefore be offered targeted advertising?

Some argue that the big platforms already have access to this information and know the age of their users with disconcerting accuracy. While this may be true, the ban does not only concern these very large platforms, but any web player in the broadest sense: video game developer, clothing company, online marketplace, etc.

Violating this prohibition can result in fines of up to 6% of global turnover under the DSA and/or 4% under the GDPR. Indeed, the data protection authorities will be keen to implement their doctrine and sanction any actor who targets minors with advertising. As the ban already exists in practice, compliance seems to be essential!

What to do in this complex ecosystem?

For actors expressly excluded from the scope of the DSA, it is possible to adopt a risk-based approach and continue to use targeted advertising for all users of the website or application. Indeed, if there is a risk of sanction by the data protection authorities, this should be analysed in concreto. What is the activity of the company? Is this activity aimed at minors? What is the proportion of minors using the site? The answers to these questions will help to estimate the risk and establish the best strategy to adopt.

For actors who are subject to the DSA ban, a risk-based approach can be envisaged, but a detailed analysis of the company's activity, its impact and the estimated number of minors using the site will have to be carried out. For example, while it is clear that a site offering a video game aimed at minors will probably have to stop or at least limit targeted advertising to avoid the risk of being sanctioned, an e-commerce site will need to carry out a more detailed analysis to identify what additional measures could be taken.