EDPB final DSA GDPR guidelines put privacy at the centre of platform compliance by clarifying how content moderation, advertising, recommender systems, age assurance and systemic-risk measures must respect data protection law.
The European Data Protection Board (EDPB) has adopted the final version of its Guidelines 3/2025 on the interplay between the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR). The guidance addresses a practical challenge for online platforms and other intermediary services: many DSA duties require or encourage the processing of personal data, but compliance with the DSA does not displace the GDPR.
For businesses in scope, the central message is that DSA and GDPR compliance must be designed together. A content-moderation measure, advertising control or age-assurance process may serve a legitimate DSA objective while still being excessive, insufficiently transparent or otherwise unlawful under the GDPR. DPOs should therefore be involved when operational teams translate DSA duties into product design, data flows and automated decisions.
The DSA and the GDPR apply together rather than one overriding the other.
The EDPB explains that the two regulations pursue different but complementary objectives. The GDPR protects individuals in relation to the processing of personal data, while the DSA establishes harmonised rules for a safe, predictable and trusted online environment. The DSA is expressly without prejudice to the GDPR and the ePrivacy Directive.
This means that an organisation cannot treat a DSA obligation as a general exemption from GDPR principles. Where the two frameworks cover the same activity, they must be applied coherently and without lowering the protection afforded to privacy and personal data. The legal basis, necessity, proportionality, transparency and security of the processing still need to be demonstrated.
Content moderation must remain necessary, accurate and proportionate.
Providers may voluntarily investigate and address illegal content under Article 7 DSA, and automated tools may form part of that work. The EDPB notes that machine-learning systems used to identify content can involve large-scale processing and may generate false or inaccurate conclusions about users, potentially leading to account restrictions, reputational harm or interference with freedom of expression.
Platforms should therefore apply data minimisation, data protection by design and appropriate safeguards when developing or deploying these systems. The purpose and scope of monitoring should be clearly defined, and providers should evaluate accuracy and the consequences of error rather than assuming that a content-safety objective makes all associated processing proportionate.
Notice and complaint systems need privacy controls from the outset.
The DSA requires mechanisms through which users can report illegal content and, for online platforms, challenge certain moderation decisions. Those processes may collect contact details, allegations, supporting evidence and information about the person who posted the content. Some reports can contain special-category or criminal-offence data.
The guidelines emphasise the need to identify the appropriate GDPR role and legal basis for each processing operation. Platforms should limit the information requested to what is necessary, protect the identity and security of participants, set defensible retention periods and provide suitable transparency. Data submitted for one stage of the process should not automatically become available for unrelated purposes.
Interface design must comply with both DSA and GDPR standards.
Article 25 DSA prohibits online platforms from designing or operating interfaces that deceive or manipulate users or materially distort their ability to make free and informed decisions. The GDPR separately requires valid consent and fair, transparent processing where personal data are involved.
The EDPB warns that compliance with one framework does not guarantee compliance with the other. Consent choices, privacy settings and recommender options should be presented neutrally and with comparable prominence. Repeated prompts, obstructive cancellation paths or visual emphasis that pushes users towards more intrusive processing may create risk under both regimes.
Advertising restrictions can be stricter than the GDPR alone.
The DSA imposes transparency duties for advertising and prohibits online platforms from presenting advertisements based on profiling using special categories of personal data. The EDPB clarifies that this prohibition applies even where a platform believes it has an Article 6 legal basis and an Article 9 derogation under the GDPR.
DSA advertising information is generally provided when the advertisement is shown, whereas GDPR transparency is required when personal data are obtained. Platforms must therefore design separate but consistent disclosures and protect advertising-transparency data against misuse. Compliance teams should map the data, inferences and actors involved in ad selection instead of focusing only on the final advertisement.
Recommender-system choices must be genuine and respected in practice.
Recommender systems can personalise the order or prominence of content using observed behaviour and inferred interests. The guidelines highlight risks around the accuracy and transparency of those inferences, large-scale processing and the possible use of sensitive information. In some circumstances, the presentation of content may also amount to automated decision-making under Article 22 GDPR where it produces serious consequences for an individual.
When platforms offer a non-profiling option, it should be presented on equal terms and should not be undermined by nudging. The EDPB states that, while that option is active, the provider should not continue collecting and processing personal data for the purpose of profiling the user. Product configuration must therefore match the choice communicated through the interface.
Protecting minors does not justify collecting more data than necessary.
The DSA requires online platforms accessible to minors to put appropriate and proportionate measures in place to ensure a high level of privacy, safety and security. The EDPB accepts that these provisions may support a legal obligation under Article 6 GDPR where processing is necessary and proportionate, but they do not provide an unlimited legal basis for age assurance.
Platforms should avoid methods that enable unambiguous identification where less intrusive measures can achieve the objective. The EDPB also cautions against permanently storing an age or age range solely on the basis of Article 28 DSA after the estimation process has served its purpose. Privacy-preserving design should be part of the choice of age-assurance method, not an assessment added after deployment.
Systemic-risk assessments should connect with DPIAs and privacy governance.
Very large online platforms and search engines must assess and mitigate systemic risks under Articles 34 and 35 DSA, including risks to privacy and data protection. The EDPB considers that data minimisation and data protection by design and by default can contribute to this work. Where identified risks involve personal data and are likely to result in high risk to individuals, a data protection impact assessment is likely to be required.
Organisations should align the evidence used for DSA risk assessments, DPIAs, product reviews and executive oversight while preserving the different legal tests. This can reduce duplication and expose gaps where a mitigation adopted for one risk creates a new data-protection impact elsewhere.
DPOs should help connect platform governance across legal and operational teams.
The final guidelines make clear that the interaction between the DSA and GDPR is not confined to legal interpretation. It affects product design, trust and safety, advertising, engineering, security and complaint handling. DPOs should have timely access to these initiatives and enough information to assess the complete processing operation rather than isolated features.
Regulatory cooperation will also become increasingly important. The EDPB stresses the need for cooperation between data protection authorities, Digital Services Coordinators and the European Commission so that the two frameworks are applied consistently. Organisations should expect decisions made under one regime to receive scrutiny through the other.
Discover how Aphaia helps organisations integrate GDPR and DSA compliance.
Aphaia helps organisations assess how platform obligations affect personal-data processing and build practical governance across privacy, digital services and technology teams. Integrated reviews, DPIAs and data protection by design can support DSA objectives without losing sight of GDPR accountability.
