New EU Rules on Political Advertising Set to Have Limited Impact on Advertising Ecosystem

On February 27 2024, the European Parliament approved the final text of the Regulation on the Targeting and Transparency of Political Advertising, just a few months ahead of the European elections—the world’s largest trans-national democratic election—set to take place from June 6-9. While most of the Regulation’s more practical provisions won’t have the necessary mechanisms in place in time for this year’s election, the Regulation will nonetheless set the tone for how online political campaigning ought to be conducted in the EU. 

The Regulation establishes obligations for sponsors of political advertising, such as political candidates, parties or campaign organisations; entities that provide political advertising services, such as the preparation or promotion of political advertising; and publishers who are primarily at the end of the chain, publishing and disseminating the advert through any medium. The new rules include increased transparency for political advertising such as labelling associated transparency notices and repositories, alongside limitations on the types of personal data that can be used to target political advertising. Though the resulting text does achieve some notable steps forward in bringing more transparency to political advertising, the law has some significant limitations, particularly for the immediate future. In this blog post, CDT Europe analyses the strengths of the law and outlines opportunities where remaining gaps could still be addressed. 

Defining Political Advertising 

The adoption of the Regulation comes after months of intense negotiations between EU co-legislators. Central to delays in reaching a final agreement was the contentious point of the definition of political advertising, which the entire regulation hinges upon. Lawmakers considered defining political advertising as any message by a political actor that could influence the outcome of an election or referendum—posing a significant risk to political free expression, which is afforded additional protections under international law. Further to significant civil society pressure, lawmakers ultimately agreed to keep non-commercial political speech out of scope by defining political advertising as the “preparation, placement, promotion, publication, delivery or dissemination, by any means, of a message, normally provided for remuneration”.

EU lawmakers also concluded, however, that such political advertising messages could also be prepared and disseminated in the same manner through ‘in-house activities’.  This is assumed to include the activities of large, well-resourced entities who can develop and disseminate their own political advertising without the need to pay a third party service or contractor (i.e. without remuneration). For example, a political party engaging in data mining and targeting users with political campaigns, or in instances where advertising intermediaries that have their own political and policy interests, routinely serve their own adverts to persuade internet audiences to support their corporate positions. Though this is an important aspect to capture within the definition, so that large scale actors cannot subvert their obligations under the law, it would be important to ensure that guidance is provided by the European Commission on what exactly constitutes ‘in-house activities’ to prevent this definition being interpreted too broadly. 

Additional Measures During Elections

The law also outlines more stringent obligations in the months immediately preceding an election, which includes a requirement for political advertising publishers to process notices about potentially unlawful or non-compliant political advertisements within 48 hours in the month preceding an election or referendum. Though this period in the run-up to an election is particularly vulnerable, there are some aspects that need to be considered, particularly to ensure that sufficient safeguards are in place to protect political free expression. 

It is important to remember that the Regulation applies across 27 EU member states, all of which will be holding various elections and referendums at different times. Practical application of these provisions therefore will result in these more stringent measures actually being in place for a vast majority of the time. Alongside this, given the sensitive context of political advertising and the impact on democratic discourse, particular attention will need to be paid to the potential abuse of the notice mechanisms that are in place. 

The European Commission has been mandated to create guidelines to provide more clarity on how these obligations are to be complied with. It will be vital not only for the development of these guidelines to be prioritised, but for relevant experts, including civil society, to be consulted so as to prevent scenarios in which platforms err on the side of caution when receiving notices, and thus leading to the potential over-enforcement of rules moderating these political advertisements or that sufficient safeguards against potential abuse of these mechanisms are missed. 

Limitations on the Targeting and Delivery of Political Advertising

Another priority area throughout the negotiations was how to address the harm caused by the abuse of personal data and use of microtargeting on democratic participation. Lawmakers ultimately agreed therefore that users must provide separate, explicit consent for their personal data to be used in the context of political advertising. The law also prohibits the use of ‘special category personal data’ as defined by the General Data Protection Regulation (GDPR) in the context of political advertising. Recital 77-79 of the law provides two important clarifications on this prohibition. 

Firstly, the text indicates that the exemptions to the use of special category personal data that usually apply in the context of Article 9(2) of GDPR cannot be relied upon in the context of online political advertising. Simply put, entities covered by the Regulation cannot use sensitive data such as that revealing a user’s racial/ethnic origin, political opinion, religious belief or sexual orientation, to target nor deliver political advertising, and they additionally cannot rely on ‘legitimate interests’ as a reason to avoid this limitation—which can be in the case for non-political advertising. The text also establishes that the prohibition applies both when special category data has been collected directly, and when observed/inferred from the processing of non-special category personal data. These important clarifications not only aligns the Regulation with additional restrictions introduced by the Digital Services Act, but also ensures that users’ most sensitive data cannot be used to target them with potentially harmful political advertisements. 

Unfortunately, however, EU lawmakers failed to prohibit the use of inferred and observed data more broadly, such as in cases recently seen in Hungarian elections. This undermines the aforementioned prohibitions, as users can still be targeted with political advertising based on widespread data collection and inferences made on their personal data, and means the potential for abuse of such data in the context of political advertising remains. Alongside this, the standard for obtaining ‘explicit consent’ is yet to be properly clarified. Therefore, the European Data Protection Board must make the most of the opportunity provided by the Regulation to establish guidelines in this regard to provide clarity on this process.  

A Long Road to Meaningful Transparency

Where this Regulation has made headway is through the introduction of several transparency obligations, many of which build upon some existing industry standards. These include requirements for all political advertisements to be clearly labelled, for detailed transparency reports to be made easily accessible, and for providers of political advertising services to maintain records of the services they provide for a period of seven years. Alongside this, the European Commission is now tasked with managing a new European repository for online political advertisements. If well enforced, there will be significantly less opacity about the political advertising ecosystem.

Unfortunately, however, these important transparency measures will not come into effect for another 15 months, with the repository not being established for another two years, as lawmakers opted to have the specifics of these provisions outlined in non-legislative acts that still need to be drafted and approved. This means that some of the most useful provisions of the law will not be in place for the upcoming European elections or indeed the numerous national, regional and local elections occurring across the EU in the next 18 months. 

The decision to address questions lawmakers couldn’t unstick during negotiations through these acts is both a hindrance and an opportunity. On the one hand, there will be more time for consultation with civil society and public-interest technologists in the development of key mechanisms. On the other hand, the Regulation will have limited impact on the European political advertising landscape in the meantime, leaving numerous upcoming electoral processes without the additional protections this law was aimed to provide. 

Clarifying Cooperation within the Enforcement Regime

The Regulation touches upon several important aspects of existing EU law including data protection, privacy, and platform governance. The sheer complexity of the law is evident in the enforcement regime which foresees, at minimum, Data Protection Authorities, Digital Services Coordinators under the DSA, the European Data Protection Supervisor, European Data Protection Board, authorities designated under the Audiovisual Media Services Directive, and relevant national electoral authorities, all having responsibilities to enforce specific aspects of the law.

Given this complexity, priority will need to be placed on establishing coherent cooperation mechanisms between these entities as a first point of order. A standing space for expert stakeholders such as civil society, election observers, and journalists will need to be established to consult with supervisory authorities to ensure a human-rights centred approach to enforcement is maintained.  

Conclusion

Whether this Regulation has the ability to truly shift the status quo of political advertising remains to be seen. The immediate outlook looks tentative, but further analysis will need to be conducted once key transparency provisions come into place. Fortunately, all essential aspects of the law will be reviewed within two years after each election to the European Parliament. In the meantime, it is pertinent to understand how this Regulation will operate in tandem with several other existing mechanisms established to protect European elections, including those established by the DSA, and elaborated further in the draft guidelines for risk mitigation and election integrity as well as the Code of Practice on Disinformation. 

Having engaged intensely throughout the development of the Regulation, CDT Europe will continue to monitor its progress closely, and will continue to advocate for avenues for civil society to inform effective, rights-informed implementation and enforcement.