Digital marketing · AI Act

Digital marketing — AI Act: targeting, content and manipulation

AI is used for targeting, optimisation, and the generation of advertising content. Under the AI Act, these use cases generally fall under limited risk, subject to transparency requirements and the prohibition of manipulative practices. This guide clarifies the classification and key points to watch.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: AI Act.
  • Advertisers and agencies deploying AI for targeting and content generation are deployers; tool publishers are providers.
  • Qualify use cases.
  • Marking AI-generated content.
  • Prohibit manipulation.
  • Up to €35M or 7% for prohibited manipulative practices, in addition to the GDPR risk on profiling.

Regulatory deadlines

The key dates of this regulation.

August 2024

Entry into force

In force

February 2025

Ban on prohibited practices

In force

August 2025

General-purpose AI models (GPAI) & governance

In force

August 2026

High-risk system obligations (Annex III)

In force

August 2027

High-risk embedded in products (Annex I)

Upcoming

What does the AI Act cover?

The AI Act prohibits manipulative techniques that exploit individuals' vulnerabilities. It requires transparency regarding AI-generated content. Targeting and optimisation, without manipulation, fall under limited risk.

The underlying profiling remains governed by GDPR.

Is the 'Digital marketing' sector concerned?

Advertisers and agencies deploying AI for targeting and content generation are deployers; tool publishers are providers.

The sensitive boundary is manipulation: personalisation exploiting vulnerabilities would be prohibited.

Detailed obligations

Qualify use cases

Confirm the limited risk of targeting and optimisation.

Marking generated content.

Labelling AI-generated advertising content.

Prohibiting manipulation

Rule out any technique exploiting vulnerabilities.

Articulate with GDPR

Coordinating transparency and the regulation of profiling.

Sanctions & risks

Up to €35M or 7% for prohibited manipulative practices, in addition to the GDPR risk on profiling.

Application timeline

  • 1Entry into force. 1 August 2024.
  • 2Prohibitions. Since February 2025.
  • 3Transparency. Progressive.

Common mistakes in the sector

  • 1Manipulation. Exploiting vulnerabilities to convert data.
  • 2Unmarked content. Distributing AI-generated content without transparency.
  • 3Profiling ignored. Overlooking GDPR compliance.
  • 4Absent qualification. Not assessing AI use cases.

Practical case

An agency uses AI to generate visuals and target audiences. A limited-risk use case, it labels AI-generated content, prohibits any manipulative techniques, and aligns its targeting practices with the GDPR framework for profiling.

Compliance roadmap

  1. 1

    Inventory. Mapping targeting and content generation.

  2. 2

    Qualify. Confirm limited risk.

  3. 3

    Mark. Flag AI-generated content.

  4. 4

    Frame. Prohibit manipulation.

  5. 5

    Articulate. Coordinate with GDPR.

Frequently asked questions

Generally no: limited risk.

Back to the Digital marketing guideDigital marketing & GDPR

Take action on AI Act

Free assessment or a chat with an expert dedicated to digital marketing.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the digital marketing sector secured their compliance with DCO.

See testimonials