Privacy & Cybersecurity Law Blog

On September 17, 2026, the European Data Protection Board (“EDPB”) adopted Guidelines 3/2025 on the interplay between the Digital Services Act (“DSA”) and the EU General Data Protection Regulation (“GDPR”) (the “Guidelines”). The DSA establishes accountability standards for online platforms regarding illegal and harmful content.

The Guidelines are intended to help organizations subject to both regimes apply them consistently where DSA obligations involve the processing of personal data or rely on GDPR concepts. The Guidelines address several areas of practical overlap, certain of which are detailed below.

Content Moderation and Notifications

When a hosting provider receives a notice about potentially illegal content under the DSA, the process often involves the processing of personal data, such as information about the notifier, the person concerned or staff responsible for moderation. The EDPB clarifies that providers should collect only the personal data necessary and should not require the notifier to be identified unless necessary (e.g., to assess the notice or prevent misuse of the reporting system).

Advertising and Recommendations

With regard to advertising, the EDPB confirms that the DSA prohibition on presenting advertisements based on profiling using “special categories of data,” particularly sensitive personal data under Article 9 of the GDPR (such as health data, racial or ethnic origin, religion or sexual orientation), adds a separate restriction to the requirements of the GDPR. This prohibition applies even where a provider relies on a GDPR legal basis and an exception under Article 9 of the GDPR.

For recommender systems, which determine the content suggested to users, the EDPB notes that where providers offer different options, they should present them equally and should not nudge users toward profiling-based options. Providers must also honor users’ choices. While the non-profiling option is active, providers should not continue collecting and processing personal data to profile users for recommendations.

Protection of Minors

Article 28 of the DSA requires providers of online platforms accessible to minors to put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security of minors on their services. According to the EDPB, this requirement may support reliance on Article 6(1)(c) of the GDPR where personal data processing is necessary to comply with a legal obligation provided that the processing is necessary and proportionate, which the controller must demonstrate. However, the EDPB considers that providers should avoid age-assurance mechanisms that enable the unambiguous online identification of users and should not estimate or verify, and permanently store, a user’s age or age range as a result of the age-estimation process based solely on Article 28 DSA.

Risk Assessments

The EDPB notes that very large online platforms and very large online search engines, as defined under the DSA, must assess the systemic risks arising from the design and operation of their services and implement proportionate mitigation measures. Where these risks involve the processing of personal data, providers should align their assessments with GDPR principles and, where appropriate, complement or integrate them with a data protection impact assessment under Article 35 of the GDPR.

Review the Guidelines 3/2025.