On 17 September 2026, the European Data Protection Board (EDPB) published its final guidelines on the interplay between the General Data Protection Regulation (GDPR) and the Digital Services Act (DSA) (available here). While the GDPR regulates the processing of personal data, the DSA seeks to create a safer and more transparent online environment by imposing a broad range of obligations on online intermediary services, including hosting providers, online platforms, marketplaces, social media networks, search engines, and providers of conduit and caching services. These obligations cover areas such as illegal content, child protection, content moderation, online advertising, recommender systems, and personalization.
As organizations are increasingly facing both legal frameworks, questions have arisen about how the GDPR and the DSA interact in practice. The EDPB’s final guidelines aim to address those questions, providing practical guidance on topics ranging from profiling and targeted advertising to content moderation, age verification, and the processing of sensitive personal data. For organizations subject to the DSA, the guidelines offer a valuable roadmap for ensuring compliance with both regimes.
Key Takeaways from the EDPB’s Guidelines
While the guidelines clarify the respective scopes of the GDPR and the DSA, their real value lies in the practical guidance they provide on how the two frameworks interact in practice. Some of the most significant takeaways are set out below:
- Voluntary content moderation tools still require a GDPR legal basis. Where online intermediaries voluntarily use tools, including AI-powered systems, to detect or address illegal content, any resulting processing of personal data must comply with the GDPR. Because the DSA does not require the use of such tools, the EDPB considers that this processing generally cannot rely on compliance with a legal obligation under the DSA. Instead, it will often need to be justified on the basis of the intermediary’s legitimate interests, unless another applicable legal requirement specifically mandates the processing;
- Automated content moderation may trigger the GDPR’s automated decision-making rules. Organizations using automated tools to detect illegal content should assess whether moderation measures such as account suspensions, content removals, or advertising restrictions produce legal or similarly significant effects on individuals. If they do, the GDPR’s restrictions on automated decision-making may apply;
- Notice-and-action procedures remain subject to core GDPR principles. Because notice-and-action mechanisms often involve personal data relating to reporters, reported users, and other affected individuals, organizations must continue to comply with GDPR principles such as data minimization, purpose limitation, fairness, and transparency. These principles remain fully applicable where AI-enabled tools are used to handle reports about illegal online content;
- Complaint-handling systems create additional GDPR obligations. Online platforms are considered as data controllers in relation to personal data processed through DSA complaint-handling mechanisms. They must therefore meet GDPR requirements relating to transparency, data minimization, and appropriate retention periods;
- Dark patterns prohibited under the DSA may also raise GDPR concerns. Practices such as infinite scrolling, autoplay features, excessive gamification, and other engagement-driven design techniques may be difficult to reconcile with GDPR requirements where they rely on the processing of personal data. In particular, organizations may face challenges identifying a valid legal basis for such processing and demonstrating compliance with key GDPR principles, including lawfulness, fairness, transparency, and data minimization;
- Online platforms may be joint controllers. Online platform operators may qualify as joint controllers alongside sellers or advertisers where they exercise a decisive influence over how advertisements or listings are presented, organized, promoted, or optimized for their own commercial purposes. In such circumstances, platforms may assume broader responsibilities under the GDPR and should ensure that appropriate governance measures, transparency mechanisms, and contractual arrangements are in place to address their role as joint controllers;
- Recommender systems require GDPR transparency. Where personalized recommender systems rely on personal data, platforms must comply with the GDPR’s transparency requirements. The EDPB provides further guidance on the specific information that should be provided to users regarding the operation of these systems and the use of their personal data. These obligations become particularly important where recommendations may significantly affect individuals, such as in connection with housing, employment, or other opportunities that can materially influence a person’s circumstances; and
- Age verification must be privacy-preserving. The EDPB provides detailed guidance on how age-verification measures can be implemented consistently with the GDPR, emphasizing data minimization, proportionality, and the use of privacy-friendly approaches.
Why This Matters
The EDPB’s guidelines will be particularly relevant to organizations offering online services in the EU, whether they are established within or outside the EU. Because many DSA obligations involve the collection and use of personal data, compliance with the DSA cannot be assessed in isolation from the GDPR.
The guidelines provide much-needed clarity on how the two regimes interact in practice and offer concrete direction on a range of operational and technical issues, from content moderation and recommender systems to age verification and online advertising. In doing so, they help reduce legal uncertainty and provide organizations with a clearer framework for designing and implementing DSA-compliant services while meeting their GDPR obligations.
The A&B Privacy, Cyber & Data Strategy team can help organizations navigate the practical challenges of complying with the DSA and GDPR.
