Report on stakeholder event on processing of personal data to target or deliver political advertisements

Report on stakeholder event on processing of personal data to target or deliver political advertisements 27 March 2026 1. Background The EDPB organised an online stakeholder event on 27 March 2026 to collect stakeholders’ input on processing of personal data to target or deliver political advertisements. The objective was to engage with stakeholders at an early stage of drafting the EDPB Guidelines on the processing of personal data to target or deliver political advertisements (Chapter III of Regulation (EU) 2024/900) (TTPA) 1 . The target audience was the general public, with a focus on stakeholders who are already operating in this specific field. The event allowed participants to observe only or to actively speak following a prior expression of interest and allocation of speaking time. Participants were provided with a Discussion paper published prior to the event 2 . The discussion had three main elements: f irst, to identify targeting principles in the spectrum of political advertising; second, transparency and documentation obligations under A rticle 19(1); and thir d , to gather information regarding cooperation and information exchange in the supply chain under A rticle 19(2) and 19(3). Participants who expressed interest to speak and were allocated speaking time provided their input. Under each of the eight questions on the agenda, time was reserved for an open - session discussion. This report aims to summarise the main ideas and issues raised by participants, acknowledging that some topics were discussed in response to multiple questions. While the views expressed during the event and reflected in this report will inform the EDPB’s work, the Board remains free to determine if and how perspectives shared will be incorporated in its future guidelines. 1 Regulation (EU) 2024/900 of the European parliament and of the Council of 13 March 2024 on the transparency and targeting of political advertising 2 The Discussion paper and additional information are available here https://www.edpb.europa.eu/news/news/2026/stakeholder - event - political - advertising - express - your - interest_en 2 | Final 2. Amount and nature of contributions received Total number of participants : 23 2 Number of contributing entities by category: Civil society organisation /NGO/think thank EU/na tional secto r assoc iation Research/ Academia (European) political party/alliance/ group/elected politicians/ME P/candidate for elected office/political campaign organiser Copywrite r/design agency/a dvertising agency/p olitical consultan cy Broadcaster/news paper/online platform/website/b logger/influencer 27 21 30 6 2 24 Ad technology provider/targeting and media consultancy/data broker Public authority Journalist Individual Other 12 22 1 38 49 3. Main outcomes of the public consultation TARGETING PRINCIPLES Question 1: How have data processing practices for online political advertising evolved since the regulation's entry into force, and what actions did you implement to ensure compliance with Article 18? Which concepts or obligations related to Article 18 of the regulat ion would benefit from further guidance from the EDPB? The contributions received during the consultation indicate d overall support for the objective of strengthening safeguards around the use of sensitive personal data in political advertising, in particular maintaining strict limitations on the use of such data and preventing harmful micro - targeting practices. Some c ontributors also noted that the current regulatory framework may support the development of innovative, data - driven advertising solutions in the EU and 3 | Final contribute to strengthening the position of European companies and SMEs. However, these positive views were accompanied by some practical concerns raised. A central theme across the contributions was the significant lack of legal certainty regarding the scope of the TTPA . In particular, many contributors stressed that the definition of “political advertising” remains unclear and difficult to apply in practice. This uncertainty was seen as having direct consequences for compliance strategies, with some actors adopting rest rictive approaches, including the complete withdrawal from political advertising. Closely related concerns were raised regarding the concepts of „targeting” and „delivery”. Contributors highlighted the absence of clear guidance on what constitutes processing of personal data in this context, including whether technical elements such as IP addresses fall within the scope of targeting or require consent. The lack of clarity in this area was identified as a key operational challenge, particularly in relation to geographically limited political campaigns and local elections. Many stakeholders emphasised the practical and economic difficulties associated with the implementation of Articles 18 and 19. In particular, the costs and complexity of building consent - based systems for political advertising were described as prohibitive , especially for smaller publishers and market participants. Contributors also noted that there are currently no dedicated or widely available technical solutions for obtaining and managing consent specifically for political advertising, and that separatin g personal data used for political advertising from other data processing operations is often technically challenging or not feasible in practice. As a result of these challenges, a recurring observation was that a significant number of platforms, intermediaries and publishers have reduced or entirely ceased offering political advertising services since the TTPA became applicable. Several contributors pointed out that, in practice, the easiest way to ensure compliance is to avoid the application of Articles 18 and 19 altogether. This trend was reported to have tangible effects on the availability of political adve rtising, with some markets experiencin g very limited online political communication, including in the context of elections. In addition, stakeholders highlighted that the current framework does not sufficiently reflect technical and operational realities of the digital advertising ecosystem. This includes challenges related to the use of automated systems and AI - driven delivery , the complexity of the advertising supply chain involving multiple actors, and the lack of clarity regarding roles and responsibilities. Finally, several participants warned that, without further clarification, the TTPA may have unintended consequences for democratic processes, in particular by limiting citizens’ access to information about elections and local political initiatives, rather than enhancing informed decision - making. Question 2: What, in your view, are the best practices to follow to support compliance with Article 18? For example, what actions should be recommended to mitigate risks for processing special categories of personal data in the context of targeting, and how is the dis tinction between permissible personalisation and prohibited profiling usually approached in the market? The contributions received in response to this question indicate that stakeholders see limited clearly established best practices at this stage, while expressing a strong need for further practical and operational guidance to support compliance with Articl e 18. 4 | Final Among the positive elements, several contributors referred to guidance issued by the Swedish supervisory authority as a useful point of reference, as regards approaches to non - exact location targeting and the handling of local political communication. This was seen as a constructive example of how certain forms of data use may be accommodated within the existing framework. At the same time, a central and recurring concern relates to the difficulty of distinguishing between permissible personalisation and prohibited profiling. Contributors consistently noted that the notion of what constitutes „permissible” processing remains insufficiently clear in practice, considering the interpretation of special categories of personal data. This uncertainty was seen as creating significant challenges for compliance and risk assessment. A few stakeholders emphasised that the current framework may entail substantial operational and economic burdens. Publishers and other actors may be required to adapt or redesign existing systems and services, including advertising delivery mechanisms, in order to ensure compliance. These challenges are further compounded by the limited availability of workable consent mechanis ms. Contributors highlighted that explicit consent is often difficult to implement in practice, due to technical complexity, cost co nsiderations, and limited compatibility with existing industry standards, including widely used frameworks such as the Transparency and Consent Framework (TCF). Significant attention was also given to the role of technical identifiers, in particular IP addresses. Contributors broadly supported maintaining a distinction between targeting and delivery, stressing that these concepts should not be conflated. While som e participants considered that IP addresses may be used for delivery purposes and, in certain cases, for limited or approximate geographical targeting, others warned that such practices could risk circumventing the safeguards of Article 18 if not appropria tely framed. Concerns were raised regarding the methods used to associate IP addresses with geographic or other attributes, including the potential involvement of additional data and the risk of indirectly revealing sensitive information. Several contributors highlighted the risks associated with the use of data such as interests, demographic characteristics, behavioural signals or proxy - based data. Even where special categories of personal data are not directly processed, such data may ena ble inferences about sensitive characteristics. This raises challenges for the practical application of Article 18 and for determining the boundary between permissible personalisation and prohibited profiling. Stakeholders also underlined the importance of ensuring that the application of Article 18 does not lead to disproportionate restrictions on political communication. Several contributors stressed that political advertising should remain possible in practice, especially in the context of regional and local elections or referenda, so that political actors can reach relevant audiences. At the same time, some participants noted t hat, given the current level of complexity and uncertainty, market actors may opt t o avoid the application of Articles 18 and 19 altogether as a means of ensuring compliance. Finally, contributors emphasised the need for clearer guidance on the scope of Article 18, including examples of processing activities that fall outside its application. This includes situations where political advertising is not based on personal data, as well as certain forms of contextual advertising, while views differed as to how such cases should be assessed in practice. Question 3: How is personal data for political targeting collected, and what mechanisms are used to obtain explicit consent and prevent the targeting of individuals within one 5 | Final year of voting age? What types of “equivalent alternatives” are generally offered and how is the withdrawal of consent to political advertising targeting implemented in practice? The contributions received in response to this question did not identify clear or widely accepted best practices. Instead, they highlighted several significant legal, technical and operational challenges related to the collection of personal data for political targeting, the implementation of explicit consent, and the application of additional safeguards under Article 18. A central concern raised by contributors relates to the requirement to prevent the targeting of individuals within one year of voting age. This obligation was widely described as particularly difficult to implement in practice, considering the limitations of existing age assurance mechanisms, the diversity of voting age thresholds across Member States, and the risk that such measures would require additional processing of personal data. Several contributors stressed that any approach in thi s area should rem ain proportionate, flexible and technically feasible. Significant concerns were also expressed regarding the practical application of consent requirements. Many stakeholders indicated that obtaining meaningful and valid explicit consent for political advertising is difficult. In practice, consent is often emb edded within broader advertising frameworks, which may not allow for sufficiently granular or purpose - specific consent. Some contributors further questioned whether, in certain cases, existing systems can support valid consent at all. At the same time, con tributors emphasised that consent in the context of political advertising should not be treated in the same way as standard consent under the GDPR, given the higher risks associated with such processing. While some participants supported the idea of applyi ng a higher threshold for consent in this context, others explicitly disagreed, considering that such an approach would go beyond the role of guidelines and the existing legal framework. Related to this, several participants considered that the requirements applicable to political advertising may, in practice, go beyond those established under the GDPR, creating disproportionate obligations and increased responsibility for publishers and o ther actors. More broadly, stakeholders emphasised the need to identify workable compliance solutions that would allow political advertising to continue in practice, rather than leading to a restriction of such activities. Stakeholders also highlighted practical shortcomings in the application of consent management mechanisms. It was noted that „equivalent alternatives” are not always clearly presented or effective in practice. Similarly, mechanisms for the withdrawal of consent were described as either unclear or insufficiently effective, raising concerns about whether users can exercise their rights effectively. At the same time, contributors emphasised that consent collection for political advertising should, in principle, be clearly separated from other purposes, to improve transparency and reduce consent overload on users. There was also support for the use of a single consent solution, if it ensures sufficient granularity, allows consent to be freely given or refused, and remains technically feasible within existing systems. Some contributors also pointed to the relevance of technical measures such as age gate or age assurance mechanisms, while stressing that their application remains challenging and should not lead to disproportionate additional data collection or the introdu ction of new technical requirements that are not workable in practice. 6 | Final In addition, several participants indicated that, in practice, some market actors seek to avoid the use of personal data for political advertising altogether, for example by relying on non - targeted delivery methods. This was linked to the high level of com plexity, cost and legal uncertainty associated with compliance. Contributors emphasised the importance of preserving the ability to conduct political advertising in practice, especially at local and regional level, so that political actors can effectively reach relevant audiences. In this context, there was support for further clarification on the scope of Article 18, including identifying situations where processing falls outside its application, such as non - targeted delivery. TRANSPARENCY AND DOCUMENTATION OBLIGATIONS (Art. 19(1)) Question 4: Which concepts or obligations related to Article 19 of the regulation would benefit from further guidance from the EDPB? Speakers agreed that further EDPB guidance is needed, particularly regarding the allocation of responsibilities in political advertising and the interplay between the TTPA and GDPR. Another question asked, was about the relationship between advertising defined targeting. There appeared critical voices towards the EDPB, that not much practical guidance has been published. However, one of the speakers pointed out three main areas on which guidelines should focus. Those are: • Automated delivery: use by platforms • Transparency should include category of personal data used by those systems • Controllers should maintain documentation to explain how this includes distribution of political advertising in practice. Another speaker mentioned that EDPB in its guidelines should provide concrete examples. Numerous speakers mentioned that they would be grateful for further clarifications of terms such as “ clear language ” , “ 7 - year retention period ” , “ record - keeping ” . Also, guidance on publishing format would be useful. Speakers emphasized that the guidelines must address the interplay between the TTPA and other key frameworks, including the GDPR, DSA, and the AI Act. Stakeholders emphasized the need for visual examples of targeting criteria, specifically to clarify whether TTPA transparency requirements must be applied to each individual criterion or to the campaign . Stakeholders also raised questions regarding the annual risk assessment, specifically seeking clarity on the required methodology and the appropriate level of detail for the assessment’s public - facing version. Further guidance from the EDPB should include targeting criteria and transparency notices, transparency and explainability in advertising. According to stakeholders it would be useful to receive more guidelines regarding Article 19 (1)(e) TTPA . It should be explained to what extent Article 19 relate s to obligations under GDPR, e.g. interaction with art. 13 GDPR. News publishers have noted that A rticle 19 is quite openly formulated. It is about striking a balance between technical provisions and the average user. Furthermore, this concept should be clarified as well. 7 | Final Question 5: What, in your view, are the best practices to follow to support compliance with the transparency obligations? How are AI systems used for in the targeting or ad delivery of the political advertising and what, in your view, are the best practices for commun icating this information to data subjects? In general stakeholders have found the need for transparency very important. But, each of them had their own opinions on what transparency actually is. More specified opinions can be found in the text below. It was stated by numerous stakeholders that Artificial Intelligence (AI) is already used to deliver personalised advertising. According to one of the speakers, meaningful information on the use of AI should be one of the best practices. Apart from that, good practices include: • e xplanation on what the functions of AI were in the process (rank users, predict engagement, manage frequency, exclude users) ; • d istinguishing what sponsor decided and what platform decided in the process ; • d isclosure of the controller’s categories of personal data used in a clear and accessible way (e.g. behavioural signals, user activity) ; • l ayered information (a first layer can be short and use plain language, the second layer should provide more details, such as mechanisms of delivery) . To prevent the manipulation of data subjects through targeted content, individuals must be transparently informed of their right to restrict data processing. Using visual icons can enhance clarity, ensuring that explanations also clearly detail how to with draw consent. A ccording to internal research, mentioned by a speaker, transparency does not change people’s point of view that much. Therefore, transparency is not enough, and it does not undo the effects of microtargeting. A good practice is to provide meaningful information in a simple way . However, if the information is oversimplified it can lead to a reverse effect as it might not be transparent enough. Another good practice mentioned by a stakeholder was the avoidance of using the terms „may” and wording that could be open - ended. A useful practice would be to create one page where all information is layered, and a glossary with technical terms used can be found. It is crucial to note that an information page is unique to each advertisement that is being showed. Also, the information on parameters could be useful in one case and useless in another. The EDPB is expected to give clear examples. Question 6: What categories of personal data are generally processed for the purpose of delivering political advertisements, and what types of risks are typically considered when preparing an internal annual risk assessment under Article 19(1)(d)? Multiple speakers noted that political targeting increasingly relies on personal values (e.g., openness, justification) and personality traits inferred from writing styles or consumption habits. One contributor emphasised that virtually all available infor mation is leveraged to profile data subjects, while another reminded the group that processing special categories of data remains prohibited in this context. 8 | Final Regarding the Article 19(1)(d) internal annual risk assessment, experts argued against a purely static data mapping approach. Instead, the assessment must evaluate the interplay between data sets and the resulting analysis. This includes considering all da ta categories used to create inferences — covering both source personal data and dynamic, inferred data. COOPERATION AND INFORMATION EXCHANGE IN THE SUPPLY CHAIN (ART. 19(2) AND ART. 19(3)) Question 7: What standards and procedures are generally applied to ensure timely and accurate information exchange between controllers, publishers, and providers of political advertising services? In your experience, which roles do these parties tend to play within th e data protection framework (e.g. controller/joint - controller/processor and what practical arrangements have you put in place to manage the flow of information between those actors? Participants highlighted significant challenges in precisely defining the roles of various actors - controller, joint controller, and processor - within the political advertising ecosystem. It was noted that a lack of clarity regarding these roles often leads to an "accountability gap", particularly concerning digital platforms. Many speakers referred to the IAB Europe case 3 ,noting that while it established the existence of joint controllership in certain contexts, it did not provide a sufficiently detailed explanation of the mechanism. Stakeholders suggested that the EDPB should use the upcoming Guidelines to clearly draw th e lines between different roles to ensure that responsibility is not blurred and remains enforceable in practice. A recurring point of discussion was that platforms frequently describe themselves as processors acting on behalf of advertisers, despite exercising significant control over the data systems and algorithms that determine ad delivery. Participants urged the EDPB to set clear expectations that platforms delivering political advertisements should act as controllers or joint controllers rather than mere processors. To enhance oversight, it was proposed that documentation requirements should be established to allow supervisory authorities to reconstruct the entire path of a campaign, from the initial data collection to the final delivery of the advertisement. Such sys tems should ideally rely on structured information - sharing arrangements between all actors in the chain. Special attention was given to the situation of smaller publishers, NGOs, and political organizations that lack the technological capacity of larger players. Stakeholders warned that overly complex legal and technical frameworks risk excluding these entiti es from the market. Consequently, there was a strong call for the Guidelines to include simple, actionable examples that are easy for smaller actors to understand and implement. Finally, it was suggested that joint controllership agreements should be limited in scope, focusing on specific processing stages to avoid an unjustified expansion of joint responsibility. Question 8: How should coordination between multiple publishers take place in practice, in particular, regarding their transparency obligations? The discussion regarding coordination between multiple publishers revealed that current collaboration for fulfilling transparency obligations is not sufficiently structured. While technical 3 Case C - 604/22 9 | Final possibilities for coordination exist, participants emphasized that the primary barrier is a lack of regulatory clarity. Speakers noted that the EDPB's role is not to create technical standards itself, but to provide the legal clarity necessary for the industry to develop its own "common language" or technical protocols. This regulatory foundation would enable a consistent a nd universal presentation of transparency information to users across the EU. The need for standardi s ed transparency labels and messages was highlighted to ensure that citizens can easily understand targeting information regardless of the platform they use. Some participants cited international examples, such as developments in Japan, where technical standards are being created to give publishers better access to tracking information. Participants argued that transparency and accountability obligations can and should be shared among actors, allowing for greater flexibility in a complex supply chain. Effective coordination could rely on automated data exchange mechanisms and the use of c ommon metadata formats. A significant risk was identified: the exchange of transparency - related metadata between entities may itself constitute personal data processing. The Guidelines should address this to ensure such transfers are properly regulated. Stakeholders also requested clarification on the interaction between the IAB Europe ruling and Recital 78 TTPA , which concerns the prohibition of using third - party data for political targeting. There is a need to understand how these restrictions impact the practical exchange of information and targeting capabilities within the current ecosystem.