Political Advertising Regulation, Targeting and Ad-Delivery Techniques (Articles 18 and 19)

Article 2(1) applies the Regulation to political advertising where the political advertisement is disseminated in the Union, is brought into the public domain in one or several Member States or is directed to Union citizens, irrespective of the place of establishment of the provider of political advertising services or of the place of residence or establishment of the sponsor.

Article 3, point (2), defines political advertising as the preparation, placement, promotion, publication, delivery or dissemination, by any means, of a message that is normally provided for remuneration or through in-house activities or as part of a political advertising campaign, and that is either by, for or on behalf of a political actor, unless it is of a purely private or a purely commercial nature, or liable and designed to influence the outcome of an election or referendum, voting behavior or a legislative or regulatory process, at Union, national, regional or local level.

The definition excludes (i) messages from official sources of Member States or the Union that are strictly limited to the organization and modalities for participating in elections or referendums, including the announcement of candidacies or the question put to the referendum, or for promoting participation in them, (ii) official public communication by or for a public authority that is not liable and designed to influence the outcome of an election or referendum, voting behavior or a legislative or regulatory process, and (iii) the presentation of candidates in specified public spaces or in the media where law explicitly provides for it and allocates it free of charge, with equal treatment of candidates.

Article 3, point (11), defines targeting techniques as techniques that are used to address a political advertisement only to a specific person or group of persons, or to exclude them, on the basis of the processing of personal data.

Article 3, point (12), defines ad-delivery techniques as optimization techniques that are used to increase the circulation, reach or visibility of a political advertisement on the basis of the automated processing of personal data and that can serve to deliver the political advertisement to a specific person or group of persons only.

Article 3, point (14), defines a controller by reference to Article 4, point 7, of Regulation (EU) 2016/679 or, where applicable, Article 3, point 8, of Regulation (EU) 2018/1725.

Article 18(1) permits targeting techniques or ad-delivery techniques that involve the processing of personal data in the context of online political advertising only when three conditions are fulfilled, set out in points (a) to (c). Under Article 18(1)(a) the controller must have collected the personal data from the data subject.

Under Article 18(1)(b) the data subject must have provided explicit consent, within the meaning of Regulations (EU) 2016/679 and (EU) 2018/1725, to the processing of personal data separately for the purpose of political advertising. Under Article 18(1)(c) those techniques must not involve profiling, as defined in Article 4, point 4, of Regulation (EU) 2016/679, using the special categories of personal data referred to in Article 9(1) of that Regulation.

Article 18(2) prohibits, in the context of political advertising, targeting techniques or ad-delivery techniques that involve the processing of the personal data of a data subject that the controller knows with reasonable certainty to be at least one year under the voting age established by national rules. Compliance with Article 18(2) does not oblige the controller to process additional personal data in order to assess whether the data subject is one year under the voting age.

Article 18 does not apply to communications of a political party, foundation, association or other non-profit body to its members and former members, or to communications such as newsletters linked to its political activities, as long as they are solely based on subscription data, are strictly limited to members, former members or subscribers, are based on personal data provided by them, and do not involve processing personal data to target or otherwise further select the recipients and the messages they receive.

Article 18(4)(a) requires controllers to make sure that a data subject is not requested to consent if he or she has already indicated by automated means that he or she does not consent to data processing for political advertising purposes, unless the request is justified by a substantial change of circumstances.

Article 18(4)(b) requires controllers to make sure that a data subject who does not consent is offered an equivalent alternative for using the online service without receiving political advertising.

Article 19(1) requires controllers that use targeting techniques or ad-delivery techniques in online political advertising involving the processing of personal data, in addition to their other duties under the Regulation and under Regulations (EU) 2016/679 and (EU) 2018/1725, to comply with the requirements in points (a) to (e).

Under Article 19(1)(a) the controller must adopt, implement and make publicly available an internal policy describing clearly and in plain language how such techniques are used, and retain that policy for seven years from the last use of the techniques. Under Article 19(1)(b) the controller must keep records on the use of such techniques and the relevant mechanisms and parameters used.

Under Article 19(1)(c) the controller must provide, together with the indication that the advertisement is political, additional information that lets the individual concerned understand the logic involved and the main parameters of the techniques used, including whether an artificial intelligence system has been used to target or deliver the advertisement.

Under Article 19(1)(d) the controller must prepare an internal annual risk assessment of the use of targeting techniques or ad-delivery techniques on fundamental rights and freedoms, the results of which are to be made publicly available.

Under Article 19(1)(e) the controller must provide, together with the advertisement unless it is included in the transparency notice required under Article 12(1), a reference to effective means to support individuals in exercising their rights under Regulations (EU) 2016/679 or (EU) 2018/1725, including a link to an interface for exercising them.

Where the controller is different from the political advertising publisher, Article 19(2) requires the controller to ensure that the information referred to in Article 19(1), points (c) and (e), is communicated to the publisher. Article 19(3) requires providers of political advertising services to transmit to the controllers, as necessary, the information the controllers need to comply with Article 19(1) and (2).

Article 22(1) makes the supervisory authorities referred to in Article 51 of Regulation (EU) 2016/679 and the European Data Protection Supervisor competent to monitor the application of Articles 18 and 19 in their respective fields of competence.

Article 25(6) provides that, for infringements of the obligations laid down in Articles 18 and 19, the supervisory authorities may within their competence impose fines in line with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.

Article 83(5) of Regulation (EU) 2016/679 sets that ceiling at EUR 20,000,000 or, in the case of an undertaking, 4 percent of the total worldwide annual turnover of the preceding financial year, whichever is higher. Article 25(1) leaves the sanctions for infringements of Articles 5 to 17, 20 and 21 to the Member States.

Article 25(2) sets the maximum amount of the financial penalties that may be imposed at 6 percent of the annual income or budget of the sponsor or of the provider of political advertising services, as applicable and whichever is the highest, or at 6 percent of the annual worldwide turnover of the sponsor or the provider in the preceding financial year.

For infringements of Articles 18 and 19, Article 25(7) lets the European Data Protection Supervisor impose fines within its competence in line with Article 66 of Regulation (EU) 2018/1725 and up to the amount referred to in Article 66(3) of that Regulation.

Article 25(5) treats an infringement of Article 18 as particularly serious where it concerns political advertising published or disseminated during the last month preceding an election or referendum and directed to citizens in the Member State in which the election or referendum is being organized. Article 30(2) applies the Regulation from 10 October 2025.