X's DSA repair turns ad transparency into an audit test

An advertising repository fails before it becomes empty. It fails when a user cannot search it properly, when results arrive in detached spreadsheets, or when the fields needed to understand who paid for an advert and whom it targeted are missing.

On 16 July, the European Commission accepted X’s action plan to repair those weaknesses under the Digital Services Act. The plan follows the Commission’s December 2025 non-compliance decision and €120 million fine. X now has six months to implement the measures and submit an independent audit.

The decision concerns one very large platform, but it gives smaller advertisers a useful standard. A campaign record should remain understandable after the dashboard changes, the agency contract ends or a regulator asks a question. If the advertiser cannot reconstruct the creative, payer, targeting, timing and approval from its own files, a public repository will not rescue the campaign.

The remedy is about usable evidence

Article 39 of the DSA requires very large online platforms and search engines to maintain a public repository of advertisements. The record must include the advert itself, the person on whose behalf it ran, the person who paid where different, its display period, its targeting parameters and reach figures.

The December decision found that X’s repository did not meet that standard. The Commission identified access barriers, excessive delays and missing information, including ad content, topic and the legal entity paying. It also found that eligible researchers faced unnecessary barriers when seeking public data.

The accepted plan addresses the shape of access, not merely the existence of a database. According to the Commission, X committed to:

• add search filters based on ad content and targeting criteria;
• display results directly in the repository interface instead of separate Excel files;
• publish more information about advertisements;
• make the repository available through an API;
• speed up applications from eligible researchers and provide access free of charge; and
• stop contractually prohibiting eligible researchers from scraping public data.

These are ordinary product details with regulatory weight. Searchability determines whether a journalist can locate a campaign. Stable fields determine whether two campaigns can be compared. An API determines whether a researcher can inspect thousands of records without manually opening each one.

Acceptance is not closure

The Commission consulted the Board for Digital Services before accepting the plan. The Board considered the proposed changes only partially adequate and found the audit measures, and therefore the overall plan, insufficient to address the infringements.

The Commission nevertheless accepted the action plan after clarifying points that X must consider during implementation. It says enhanced supervision will continue, with particular attention to the issues raised by the Board. X must commission an independent external audit, submit the result and fully implement any recommendations.

That sequence matters. The headline is not that X has already produced a compliant repository. It is that the Commission has accepted a route to compliance with an implementation period, external testing and continued supervision.

Checkpoint	Public test	Why it matters
Search	Can a user find an ad by words in the creative and by targeting criteria?	A repository that requires a known campaign ID hides patterns from ordinary scrutiny.
Result format	Do records appear in the interface without a separate spreadsheet workflow?	Friction can make formally available data practically inaccessible.
Required fields	Are creative, payer, dates, targeting and reach present and consistent?	Missing fields prevent accountability across campaigns.
API	Can records be retrieved predictably at useful scale?	Researchers need repeatable collection, not manual screenshots.
Audit	Does an independent report test the live implementation and publish actionable findings?	A plan is evidence only after the controls operate.

Source: European Commission action-plan announcement and Regulation (EU) 2022/2065, Art. 39 and Art. 75. Last verified 2026-07-19.

The advertiser needs a separate evidence pack

The public repository is the platform’s DSA obligation. It is not the advertiser’s project archive. A small business may need to explain a campaign before the platform’s record is complete, after the platform has changed its interface, or in a dispute that involves drafts and approvals never shown publicly.

Keep one compact evidence pack per campaign:

1. the final creative and landing-page version;
2. the legal name of the advertiser and the party that paid;
3. the platform campaign and advert identifiers;
4. targeting and exclusion settings as approved;
5. start and stop times, budget, spend and invoice; and
6. the approval record, including who checked the claim, audience and destination.

Export the platform summary when the campaign closes, but do not rely on that export alone. Keep the approved input beside the delivered result. If a setting changed during the run, preserve the change and its effective time rather than overwriting the first plan.

This is especially important when an agency operates the account. The contract should state who retains campaign exports, how quickly they are delivered and whether the client can still retrieve them after termination. Ownership of an advertising account is not the same thing as possession of a usable evidence trail.

Researchers need a reproducible route too

The X case also covers access to public data for eligible researchers. Under Article 40, vetted researchers may request data needed to study systemic risks in the Union. Delegated Regulation (EU) 2025/2050 adds procedures and technical conditions for that access.

The Commission says X will improve and accelerate application screening, make access free and update terms that restricted eligible researchers from scraping public data. Those commitments should be judged by reproducibility: can two approved teams obtain the same defined public dataset, understand its fields and document when it was collected?

For SMEs buying research, monitoring or brand-safety work, that distinction belongs in the brief. Ask whether a supplier uses the public repository, vetted-researcher access or an unrelated commercial feed. Ask for the query, collection time, missing-field rate and platform identifiers behind any conclusion. A screenshot of a chart is not enough to rerun the analysis.

Run the six-month check now

The smallest useful exercise takes one current campaign and one older campaign. Search for both in the public repository. Compare the visible record with the advertiser’s own evidence pack. Note every field that is missing, difficult to search or impossible to export.

Repeat the same check after X implements the action plan. The comparison will show whether the repair improved practical access rather than only changing policy text. It will also expose gaps in the advertiser’s own retention before a dispute turns them into expensive archaeology.

The DSA sets the public transparency floor for very large platforms. Small advertisers do not need to reproduce the platform’s repository. They do need a record that survives the platform. Six files stored at campaign close are cheaper than reconstructing one advert after the dashboard, staff and supplier have all moved on.