EDPB finalises guidance on how the DSA and GDPR interact

On 21 September 2026, the European Data Protection Board announced final guidelines on the Digital Services Act and GDPR. Adopted on 17 September after consultation, the guidance explains how online intermediary services should apply the two frameworks together.

The final Guidelines 3/2025 cover content moderation, advertising, recommender systems and protection of minors. They explain that, where the DSA prohibits advertising based on profiling using special-category personal data, a GDPR legal basis and Article 9 exception do not override that prohibition.

Platform privacy teams should therefore review advertising decisions under both frameworks and identify which DSA duties apply to their service type and scale. Consent alone may not resolve the issue. These are final interpretive guidelines; they do not introduce a new regulation or general compliance deadline.