A coalition of nine civil society groups, led by EDRi, has submitted a complaint to regulators alleging that X violates the Digital Services Act by enabling advertisers to deploy targeted campaigns using people's sensitive personal data. The organisations are urging Digital Services Coordinators and the European Commission to launch investigations and enforce accountability against the platform for breaching fundamental user protections.
Research uncovers targeting based on protected data categories
On July 14, EDRi, AI Forensics, Centre for Democracy and Technology Europe, Entropy, Gesellschaft für Freiheitsrechte e.V. (GFF), Global Witness, Panoptykon Foundation, Bits of Freedom, and VoxPublic filed a formal complaint alleging breaches of Article 26(3) of the Digital Services Act by X, the platform formerly known as Twitter.
AI Forensics examined X's Ad Repository and identified instances where major corporations, government bodies, and financial organisations were permitted to direct advertising toward users based on especially sensitive categories protected under GDPR rules. These categories encompass political opinions, sexual orientation, religious beliefs, and health conditions. Such information is regarded as inherently sensitive due to its capacity to expose intimate aspects of personal identity and heighten exposure to discrimination, harm, and violations of user rights.
The Digital Services Act explicitly prohibits online platforms from using such sensitive information for targeted advertising purposes.
Documented cases reveal potential for abuse and manipulation
AI Forensics documented several concerning instances of targeting practices. Shein, a fast fashion retailer, ran advertisements directed at users interested in French far-left politics. Total Energies, an energy and petroleum multinational, deployed ads specifically excluding users interested in ecologist political figures. McDonald's used the platform to exclude users interested in its own trade union as well as those with interests in antidepressants and suicide.
Through a public-facing tool created by AI Forensics that allows individuals to check whether X displayed them ads based on sensitive profiling, researchers discovered that Brussels Signal, a media organisation with connections to European right-wing parties, targeted users with interests in far-right parties and political figures, apparently to advance far-right movements across Europe.
These cases demonstrate the rationale behind the DSA's strict prohibition on sensitive-data advertising. Permitting advertisers access to such information for targeting purposes creates opportunities for manipulation, including covert efforts by interest groups to shape public opinion in ways that jeopardise online democratic participation and undermine electoral integrity.
Next steps in enforcement
The coalition has submitted the complaint to Digital Services Coordinators in France, Germany, and the Netherlands, urging these authorities to investigate X's conduct and safeguard individuals and communities from discriminatory or exploitative profiling that violates their rights.
Platforms operating at X's scale and reach must adhere to the strictest compliance standards under European law. The signatory organisations, which prioritise digital rights, openness, and democratic values, pledge to track regulatory developments and continue supporting DSA enforcement efforts.
Though imperfect, the DSA has demonstrated its capacity to hold platforms accountable, as shown by previous successful complaints filed against LinkedIn and X that resulted in protections for user rights online.
Source: EDRi (European Digital Rights)
