EU Data Board Adopts New Guidelines for DSA and GDPR
Guidelines 3/2025 clarify compliance requirements for online platforms operating within the European Union.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Should online platforms prioritize stricter user privacy protections over personalized advertising and content services?
On September 17, 2026, the European Data Protection Board adopted Guidelines 3/2025 to harmonize compliance between the Digital Services Act and the GDPR. The framework aims to ensure that online providers apply data protection principles consistently across these two major regulatory regimes.
Why it matters
The guidelines clarify complex overlaps between the DSA and GDPR, ensuring organizations can navigate systemic risk assessments and data protection mandates. This move is designed to provide greater legal certainty for providers operating within the European Union.
The guidelines reference GDPR Article 35 for impact assessments and DSA Article 28 regarding the protection of minors. These requirements govern how providers process data while maintaining systemic risk assessments.
The players
European Data Protection Board
This is an independent European body that contributes to the consistent application of data protection rules throughout the European Union.
The details
The guidelines explicitly prohibit advertisements based on profiling using special categories of personal data and require platforms to present recommender system options equally. Additionally, providers are instructed to avoid age-assurance mechanisms that would lead to the unambiguous online identification of users.
Timeline
September 17, 2026: The European Data Protection Board adopted the guidelines.
The Tech Race
This regulation marks a significant step in the ongoing efforts to harmonize the European Union's digital legislative landscape. It replaces piecemeal compliance efforts with a standardized framework for data-heavy technological platforms.
Users can expect more transparency regarding how platforms manage their personal data and recommender system choices. Providers must now ensure that their platforms do not nudge users toward profiling-based options.
The takeaway
Organizations should review their data processing workflows to align with the new guidance on user identification and recommender systems. By prioritizing privacy-focused mechanisms, companies can ensure their services remain compliant with the evolving European digital framework.
Further reading
For more regulatory updates, visit the Cybersecurity section.
Source note: This article includes information reported by Hunton.
Live Poll
Should online platforms prioritize stricter user privacy protections over personalized advertising and content services?
