Check My Ads challenges regulators on DMA-GDPR enforcement for advertising

The advocacy organization submitted a 35-page response to the European Data Protection Board and European Commission addressing the Joint Guidelines on the Interplay Between the Digital Markets Act and the General Data Protection Regulation. The comments focus on five critical areas where stricter interpretations could prevent gatekeepers from exploiting ambiguity to maintain surveillance-based advertising dominance.

Check My Ads Institute emphasized that gatekeepers Google, Meta, and Amazon currently control 55 percent of global online advertising spend outside China. These companies have historically invoked "privacy" selectively to justify enclosing their ecosystems as walled gardens while disregarding data protection when expanding surveillance infrastructures, the organization stated in the submission.

The joint guidelines address how gatekeepers designated under the DMA must comply with GDPR requirements when processing personal data for online advertising services. Article 5(2) DMA prohibits gatekeepers from processing, combining, or cross-using personal data without end-user consent, creating tension with existing consent practices that Check My Ads characterizes as "exploitative."

Meta's current consent-or-pay model received particular scrutiny in the submission. The organization criticized Meta's November 2024 implementation that presents "Subscribe to use without ads" and "free of charge with ads" on the first level while relegating "less-personalised ads" to a third level with preselected options. Check My Ads argued this violates GDPR consent rules requiring equal treatment of all options.

The submission demanded that Meta provide triple-option choice at the first layer, eliminate all preselection, require the same number of steps for all options, remove ad breaks from the "less-personalised ads" alternative, and acknowledge that consent cannot serve as a valid legal ground for that option. Processing session data to personalize ads requires consent even within single sessions on social networking sites, the organization stated, warning that AI systems like Meta Advantage+ can exploit consumer vulnerabilities based on limited contextual signals.

Check My Ads challenged the guidelines' treatment of "essential functionality" language in Article 5(2)(c) DMA. The organization warned that gatekeepers might interpret processing for "online advertising services" narrowly to exclude profiling, audience targeting, bidding, optimization, measurement, frequency capping, and attribution from consent requirements. The submission emphasized that "providing online advertising services" encompasses any operation contributing to advertising delivery or optimization, including pseudonymisation or data transformations later used for advertising purposes.

The organization addressed concerns about special categories of personal data under Article 9 GDPR. Gatekeepers' AI-driven targeting systems—including Google Performance Max, Meta Advantage+, and Amazon Performance+—automate audience selection in ways that may circumvent profiling prohibitions simply because targeting parameters are selected algorithmically rather than manually, the submission stated. Check My Ads referenced its research showing Google Performance Max campaigns placed ads predominantly on AI-generated spam sites, low-quality domains, and YouTube content in languages inconsistent with advertiser targeting selections.

The submission called for explicit confirmation that online advertising intermediation services qualify as "online platforms" under the Digital Services Act. This designation would subject gatekeepers' business-to-business design choices to Article 25 DSA prohibitions on manipulative interface design. Check My Ads documented how Google's default campaign setup flow nudges advertisers toward Performance Max through pre-selected defaults that restrict transparency and granular control.

Dark patterns extend beyond end-user interfaces to business environments, the organization noted. Google Performance Max's design steers advertisers toward AI-driven tools that prevent determining which placements or audiences produce value. High-quality publishers lose income diverted to low-quality inventory while gatekeepers collect additional data and revenue without providing advertisers actionable insights.

Regarding Article 6(8) DMA requirements for independent verification, Check My Ads supported strict enforcement ensuring advertisers and publishers can provide authorized vendors with log-level data necessary for verification. The organization cautioned that any GDPR exemption for measurement should be adopted only after thorough deliberation with strict safeguards preventing purpose-drifting or data misuse by verification vendors.

The submission warned about the proposed Digital Omnibus Regulation's potential to create loopholes. If adopted in its current form, the regulation may allow gatekeepers to reclassify behavioral data as "non-personal," thereby escaping both GDPR and Article 5(2) DMA obligations. The organization urged authorities to prevent gatekeepers from invoking broad labels like "network security" or "service integrity" to justify discretionary data combination practices exceeding what is objectively necessary.

Check My Ads emphasized the advertising ecosystem's broader context. The IAB Europe OpenRTB protocol allows personal data of Europeans to be broadcast 71 trillion times annually to hundreds of adtech vendors under no legal obligation to vet websites they monetize. This makes the ecosystem not only invasive but likely among the largest public security risks in Europe, the submission stated. Advertising budgets flow without advertiser knowledge to harmful and illicit websites while users' personal data can be harvested by hundreds of intermediaries.

The organization connected enforcement to media sustainability. European newsroom turnover declined at 0.33 percent annually between 2014 and 2017, resulting in losses of approximately €73.3 million. UK research shows intermediaries capture at least 35 percent of advertising value bought from newspapers and content providers, with Google being the largest intermediary. Greater competition and transparency would put downward pressure on intermediaries' fees, helping publishers receive larger shares of value.

Dr. Lex Zard, Director of Policy at Check My Ads Institute, and Arielle Garcia, Chief Operating Officer, signed the submission emphasizing that coherent DMA and GDPR implementation represents a defining test for the EU's ability to disperse gatekeeper power and open digital markets to genuine innovation benefiting consumers, advertisers, and publishers.

Timeline

• April 2022: Irish privacy group warned European Commission about DMA Article 5(2) risks
• March 2024: Amazon and Google introduced transparency reports for EU advertisers
• April 2024: European Data Protection Board issued consent-or-pay opinion
• September 2024: European Data Protection Board published DSA-GDPR compliance guidelines
• November 2024: Meta introduced updated consent-or-pay model with less-personalised ads option
• November 2025: European Commission proposed GDPR amendments through Digital Omnibus package
• December 4, 2025: Check My Ads Institute submitted comments on Joint Guidelines on DMA-GDPR Interplay

Summary

Who: Check My Ads Institute, an independent 501(c)3 nonprofit digital advertising watchdog headquartered in the United States, submitted comments to the European Data Protection Board and European Commission.

What: The organization provided detailed feedback on Joint Guidelines addressing how Digital Markets Act obligations interact with General Data Protection Regulation requirements for gatekeepers processing personal data in online advertising contexts.

When: The submission was completed on December 4, 2025, responding to public consultation on draft guidelines addressing consent requirements, data combination prohibitions, and processing restrictions.

Where: The guidelines apply throughout the European Union and European Economic Area, affecting gatekeepers designated under the DMA including Google, Meta, and Amazon's online advertising services.

Why: Check My Ads argued that without strict interpretation preventing definitional distortions, gatekeepers will exploit ambiguity to perpetuate surveillance-based advertising models harming consumers, advertisers, publishers, and democratic institutions across Europe.