What the EU’s Digital Services Act means for user tracking
User tracking has become one of the defining features of the modern internet. Platforms record clicks, searches, viewing habits, device details, approximate location, and social connections to predict what people might do next. This information supports advertising systems, content ranking, fraud detection, and business models built around attention.
The European Union’s Digital Services Act (DSA) does not create a general ban on tracking. It also does not replace the General Data Protection Regulation (GDPR), the ePrivacy rules, or national consumer protection law. Instead, it adds obligations for online intermediaries and especially large platforms whose design choices can affect millions of people.
That distinction matters. The DSA approaches tracking through transparency, advertising controls, recommender-system safeguards, user rights, and systemic-risk oversight. Its practical effect is to make some surveillance practices more visible and more difficult to justify, while leaving many questions dependent on GDPR enforcement and future regulation.
Why tracking is part of the DSA conversation
The law is primarily concerned with how online services affect society, rather than with cookies in isolation. Tracking becomes relevant when it determines which advertisements people see, how content is ranked, how users are categorized, or how platforms influence behavior. A profile built from browsing and engagement data can shape a person’s information environment without that person understanding why.
This gives the DSA a broader reach than a conventional privacy notice. A platform may technically disclose that it uses personal data for personalization, yet still provide little meaningful explanation of the systems making decisions. The DSA pushes covered services toward clearer information about advertising, content recommendation, moderation, and the risks created by their business models.
The rules apply differently across the digital ecosystem. Hosting providers, online marketplaces, search engines, social networks, and other intermediary services have general duties. Very large online platforms and very large online search engines, generally those reaching at least 45 million monthly users in the EU, face additional requirements. The European Commission directly supervises these largest services.
What platforms must disclose
A central change is greater advertising transparency. Platforms must identify advertisements clearly and explain who paid for them and, in many cases, why a particular user received them. The explanation should identify the main parameters used for targeting, such as inferred interests, location, or recent activity, rather than hiding behind vague references to “relevance.”
This does not mean users receive the complete source code of an advertising system. It does mean that the connection between personal data and an advertisement should be easier to understand. A person should be able to distinguish an ordinary promoted message from editorial content and see which organization is responsible for the commercial communication.
The DSA also restricts certain forms of targeted advertising. Platforms cannot show advertisements based on profiling children when they know with reasonable certainty that the recipient is a minor. They are also prohibited from using special categories of personal data, such as health information, political opinions, religious beliefs, or sexual orientation, for targeted advertising under the DSA framework.
The law further prohibits dark patterns that manipulate users into making choices they would not otherwise make. A consent interface that makes “accept all” prominent while obscuring rejection may attract attention under several legal regimes, including consumer law and the GDPR. The DSA strengthens the broader regulatory expectation that interfaces should not deliberately undermine informed choice.
Where targeted advertising faces limits
The most important limitation is that the DSA does not make behavioral advertising illegal for adults. A platform can still use profiling if it has a lawful basis and complies with other applicable rules. The GDPR remains decisive for questions such as whether consent is valid, whether data processing is necessary, and whether a company has provided sufficient information.
This creates a layered system. The DSA asks how an advertising system operates within a platform and what risks it creates. The GDPR asks whether personal data is being processed lawfully in the first place. The ePrivacy framework addresses technologies such as cookies and similar device storage, although parts of that regime remain politically unsettled and unevenly enforced across the EU.
| Area of tracking | What the DSA changes | What remains governed elsewhere |
|---|---|---|
| Personalized advertising | Greater explanation of ad targeting and advertiser identity | Lawful basis, consent, and data minimization under the GDPR |
| Advertising to minors | Prohibits targeted advertising based on profiling children | Age assurance and child-data rules under wider EU law |
| Sensitive personal data | Prohibits targeted advertising using special categories of data | Definitions, processing conditions, and enforcement under the GDPR |
| Cookies and device identifiers | Indirect pressure for clearer, less manipulative interfaces | Consent requirements under ePrivacy rules |
| Content recommendations | Transparency and, for very large platforms, non-personalized options | Broader privacy and competition questions |
| Data brokers | More scrutiny when brokered profiles support platform advertising | Data-trading legality and access rights under the GDPR |
In practice, this means the DSA may expose a platform’s reliance on extensive profiling without automatically stopping it. If the service claims that tracking is necessary for personalization, regulators and researchers can examine whether the explanation is credible and whether less intrusive alternatives exist. The legal pressure is strongest when a platform’s design, advertising system, or recommender engine creates widespread social risks.
The DSA also requires platforms to maintain advertising repositories in certain circumstances. These databases can provide researchers, journalists, regulators, and civil society organizations with a clearer view of who is buying advertisements, what audiences are being targeted, and how campaigns change over time. Their usefulness depends on data quality, access conditions, and the ability to connect advertisements with broader platform practices.
Recommender systems and behavioral profiles
Recommendation engines are another major route through which tracking affects users. Video platforms, social networks, marketplaces, and news services monitor interactions to predict what content will retain attention. The resulting profile can include explicit actions, such as following an account, and less visible signals, such as pausing briefly on a post or repeatedly returning to a topic.
The DSA requires platforms to describe the main parameters used by recommender systems and the options available to users for changing or influencing those parameters. Very large platforms and search engines must provide at least one option that is not based on profiling. This can mean a chronological feed, a subscription-based view, or another ranking method that relies less on inferred behavior.
That alternative is significant because it challenges the assumption that personalization must be the default. Users may still prefer recommendations, but they gain a clearer basis for deciding whether the convenience is worth the data collection. A non-personalized option also gives regulators and researchers a comparison point for measuring how much personalization changes exposure to content.
The DSA’s systemic-risk duties go further for the largest services. Platforms must assess and mitigate risks related to the spread of illegal content, threats to fundamental rights, manipulation of public debate, gender-based violence, and harms to minors. Tracking is relevant because profiling and recommendation can amplify these risks, especially when systems optimize for engagement rather than accuracy or user welfare.
How enforcement changes user power
The DSA gives users more formal ways to challenge platform decisions. Services must explain certain content moderation actions, provide internal complaint mechanisms, and offer access to out-of-court dispute settlement. These procedures do not transform every user into a regulator, but they make platform decisions less dependent on opaque internal processes.
Users can also benefit indirectly from independent scrutiny. Researchers with approved access may study how large platforms operate, including the effects of recommendation systems and advertising practices. Civil society organizations can use transparency information to identify patterns that an individual user could never see, such as ads repeatedly directed at vulnerable groups or content-ranking changes that affect public discussion.
The European Commission can impose fines of up to 6% of a provider’s global annual turnover for serious breaches of the DSA. National digital services coordinators supervise many other services, while the Commission oversees the largest platforms and search engines. This division creates a more structured enforcement system, though its success will depend on staffing, technical expertise, political independence, and the willingness to pursue difficult cases.
For individuals, privacy tools remain relevant because legal transparency does not eliminate data collection. Browser protections, tracker blocking, separate accounts, and careful permission settings can reduce the amount of information that reaches advertising networks. People seeking a stronger privacy layer can also read this guide on safer Tor browsing, which explains why Tor is useful beyond assumptions about illicit activity.
What people can do now
The DSA gives users more information and more rights, but those rights are easiest to use when people recognize the difference between personalization, advertising, and essential service functions. A platform may present them as one package even though each activity can have a different legal basis and privacy impact.
When reviewing a service, look for the advertising explanation, recommender-system controls, privacy settings, and complaint procedure. A meaningful choice should remain available after the initial setup screen, rather than disappearing into a long account menu. The following habits can reduce exposure while making the new rights more practical:
- Choose a non-personalized or chronological feed when the service provides one.
- Reject optional advertising cookies and revisit consent settings after major interface changes.
- Read the explanation attached to an advertisement to identify targeting categories and the responsible advertiser.
- Use separate browser profiles or accounts for unrelated activities to limit cross-context profiling.
- Report manipulative interfaces, misleading advertisements, and unexplained moderation decisions through the platform’s formal channels.
These steps cannot fully prevent tracking, especially when large platforms connect activity across devices and services. They can, however, reduce passive data collection and create records that regulators, consumer groups, and courts may use when evaluating systematic misconduct. Keeping copies of important notices and decisions can also help when a complaint is later escalated.
What the law still leaves unresolved
The DSA’s limits are as important as its new protections. It does not establish a universal right to use every platform without profiling. It does not prohibit all behavioral advertising, prevent companies from collecting data outside a particular platform, or settle the question of whether “consent” banners produce genuine consent. Data brokers can continue to operate where their activities comply with the GDPR and other relevant law.
There is also a risk that transparency becomes another form of compliance theater. A platform can publish an explanation that is technically accurate but too complex to guide ordinary decisions. Advertising repositories may omit important context, while recommender-system disclosures may describe inputs without revealing how ranking actually affects users.
The DSA’s impact will therefore depend on enforcement and interpretation. Regulators need to test platform claims, compare public statements with technical evidence, and treat user-interface design as part of the legal analysis. Researchers need access to reliable data, and users need remedies that are affordable and understandable.
The larger shift is cultural as well as legal: tracking is increasingly treated as a matter of public accountability rather than a private optimization strategy. Follow the continuing discussion of privacy and technology rights to examine how European digital regulation connects with everyday choices about surveillance, autonomy, and the design of the internet.