Communications & media compliance: AI Act & GDPR

Why the 'Communication & media' sector is concerned

Generative AI is transforming content production: text, images, voice, video. The AI Act imposes transparency obligations: labelling of AI-generated or AI-manipulated content and disclosure when interacting with an AI. Deepfakes must be flagged as such, with limited exceptions (e.g. artistic purposes).

GDPR governs audience data (measurement, targeting), subscriber data, and prospect data. For media organisations, a journalistic exemption allows, under certain conditions, the processing of personal data for journalistic purposes, in balance with freedom of expression.

Finally, the AI Act prohibits certain manipulative practices; communications and advertising must ensure that prohibited influence techniques are not deployed.

AI Act — transparency of generated content

The AI Act imposes transparency obligations: informing users when they are interacting with an AI, labelling AI-generated or AI-manipulated content, and disclosing deepfakes (with certain exceptions, notably for artistic purposes). These obligations directly affect content production in the sector.

Certain manipulative practices are moreover prohibited.

Key obligations

• Labelling AI-generated or AI-manipulated content.
• Labelling deepfakes (outside exceptions).
• Inform users during interactions with an AI.
• Avoiding prohibited manipulative practices.

GDPR — audiences, subscribers, sources

The sector processes audience data (measurement, targeting), subscriber data and prospect data. GDPR governs consent to trackers, prospecting and advertising profiling. For media organisations, a journalistic exemption reconciles data protection with freedom of expression and information.

Key obligations

• Consent to trackers and regulation of targeting.
• Legal basis for prospecting and subscriber management.
• Journalistic exception for processing carried out for journalistic purposes.
• Security and retention periods.

Comparative overview of regulations

How these regulations interact

AI-generated content sits at the intersection of both texts: AI Act transparency obligations (flagging what is generated or manipulated) and GDPR where personal data is used (for example, a person's image or voice). A deepfake depicting a real individual triggers both an AI Act labelling obligation and GDPR considerations (as well as image rights issues).

On the distribution side, advertising targeting falls primarily under GDPR (trackers, profiling), while transparency on recommendation systems falls under the AI Act and, for large platforms, the DSA.

Application timeline

• 1GDPR. In force; controls on trackers and prospecting.
• 2AI Act. transparency: Transparency obligations applicable on a progressive basis.
• 3AI Act. prohibitions: Manipulative practices prohibited since February 2025.

Applicable penalties

AI Act up to €35M or 7% (prohibited practices) and €15M or 3% (other serious infringements); GDPR up to €20M or 4%. An unlabelled deepfake depicting a real person combines AI Act, GDPR and image rights risks.

Reputation is a core asset in the sector: a failure in transparency can have serious consequences.

Compliance roadmap

• 1Label AI-generated content. Flag AI-generated/manipulated content and deepfakes.
• 2Governing trackers and targeting. Compliant consent and governed profiling.
• 3Invoking the journalistic exception. Securing, for media organisations, processing carried out for journalistic purposes.
• 4Respecting the right to one's image. Articulate GDPR and image rights for content depicting individuals.
• 5Avoid manipulation. Ban prohibited influence techniques.

How Data Comply One supports the sector

Data Comply One covers GDPR and the AI Act on a single platform, with an outsourced DPO, and supports agencies, media companies and ad networks on AI content transparency and audience data governance.

DCO offers tailored templates (AI transparency policy, tracker governance, subscriber management).

Frequently asked questions