Guidance on DSA and GDPR interplay

Guidelines 3/2025 on the interplay between the DSA and the GDPR

The Guidelines address the interplay between the DSA and the GDPR for intermediary service providers processing personal data while meeting DSA obligations, covering notice-and-action mechanisms (Articles 16-17 DSA), recommender systems (Articles 27 and 38 DSA), protection of minors (Article 28 DSA), and advertising transparency and profiling-based advertising (Article 26 DSA). On notice-and-action, hosting providers should collect only data necessary to assess a notice and enable, but not require, notifier identification unless essential to determining illegality; revealing a notifier's identity requires prior notice, and fully automated decisions here must meet Article 22 GDPR safeguards. On recommender systems, where a non-profiling alternative exists, both options must be presented equally without nudging users toward profiling, and once selected, profiling-related data collection should stop. On minors, the Guidelines caution against age-assurance methods enabling unambiguous identification and against retaining estimated age-range data, requiring necessity and proportionality. With respect to GDPR, the Guidelines discuss Article 6 legal-basis requirements and Article 9 special-category-data conditions relative to the DSA's profiling-based advertising prohibition, noting it applies even where a provider could rely on an Article 6(1) basis with an Article 9(2) derogation, and address Article 22 safeguards against automated decisions in notice-and-action.