New regulations on transparency and targeting of political advertising

From 10 October 2025, the provisions of Regulation (EU) 2024/900 of the European Parliament and of the Council on the transparency and targeting of political advertising shall apply directly.

Regulation (EU) 2024/900 aims to ensure full respect for fundamental rights and freedoms enshrined in the Charter of Fundamental Rights of the EU when disseminating political advertising in the digital space. It is intended to help citizens make informed choices by facilitating the recognition of political advertising, understanding who is behind it, and whether it is targeted advertising.

Its scope includes:

• Providers of political advertising services – entities engaged in providing political advertising services, excluding purely ancillary services;
• Publishers of political advertising – providers of political advertising services who publish, deliver or disseminate political advertising via any medium;
• Sponsors – entities at whose request or on whose behalf political advertising material is prepared, posted, promoted, published, delivered or disseminated;

Regulation (EU) 2024/900 introduces, among other things:

• An obligation to disclose the financing of political advertisements, indicating who is behind and who funds them;
• An obligation to label them in such a way that the recipient has no doubt about the nature of the message;
• A restriction on targeting, mainly amounting to a ban on profiling users based on special categories of data;
• Mechanisms to counter disinformation and its dissemination in the digital space;
• An obligation to maintain registers and a European repository of political advertising materials;
• A ban on interference by third countries in elections.

The Regulation complements the GDPR with regard to targeting and delivery techniques for online political advertising that rely on the processing of personal data. These are governed by Articles 18 and 19 of Regulation (EU) 2024/900.

According to these provisions, targeting or delivery techniques involving the processing of personal data in the context of online political advertising are permitted if:

• Controllers collect the data for this purpose directly from individuals;
• Data subjects have given explicit consent separately for these purposes;
• They do not involve the use of targeting or delivery techniques for political advertising based on profiling using special categories of personal data. The ban also covers profiling using inferred special categories of personal data.

It is also prohibited to use targeting or delivery techniques for political advertising that involve processing data about individuals who, with sufficient certainty, will not reach the voting age specified in national legislation for at least one year.

To ensure greater transparency and accountability, controllers should implement additional requirements including, among others: adopting a policy describing the use of adopted targeting and delivery techniques for political advertising and their main parameters; maintaining records of their use; conducting an annual assessment of the risk posed by the techniques to fundamental rights and freedoms; providing additional information enabling data subjects to exercise their rights.

Regulation (EU) 2024/900 in Article 22 explicitly states that data protection authorities, including the President of the Personal Data Protection Office, are competent to monitor compliance with the requirements set out in Articles 18 and 19 regarding targeting and delivery techniques in the context of online political advertising, as well as compliance with additional transparency requirements in the use of these techniques.

At the same time, the Regulation grants the European Data Protection Board (EDPB) the competence to prepare guidelines in this area. The EDPB has planned to develop such a document in its Work Programme for 2024–2025.

The European Commission has published general guidelines to assist in the application of Regulation (EU) 2024/900.

Full implementation of Regulation (EU) 2024/900 into the Polish legal system requires the adoption of an appropriate act. The Ministry of Digital Affairs is currently working on its assumptions. The President of Personal Data Protection Office declares support for legislative activities in this regard.

With regard to the processing of personal data in the context of online advertising, it is also worth familiarising oneself with:

EDPB Guidelines 05/2020 on consent under Regulation 2016/679

EDPB Guidelines 03/2022 on deceptive design patterns in social media platform interfaces: how to recognise and avoid them