GDPR22 Sep 2026DSA Art. 26, DSA Art. 28, DSA Art. 34, DSA Art. 35, GDPR Art. 6(1)(c), GDPR Art. 9, GDPR Art. 13, GDPR Art. 22, GDPR Art. 35
On 17 September 2026 the EDPB adopted version 2.0 of Guidelines 3/2025 on the interplay between the Digital Services Act and the GDPR, the final version after public consultation. The guidelines address, among other things, advertising and the ban on using special categories of data (Article 26 DSA), recommender systems, the protection of minors under Article 28 DSA, including age assurance, and systemic-risk management by very large platforms and search engines (Articles 34 and 35 DSA), where the EDPB states a data protection impact assessment is likely to be mandatory if systemic risks are identified.
What to do: If you provide an online platform or search engine subject to the DSA, review your advertising, recommender-system and age-assurance processing against the final guidelines and update your records or DPIAs where they depart from them.
Legal status: EU guidance · Jurisdiction: EU
Official source: EDPB ↗