If you buy advertising that reaches people in Europe, European law has given you, since March 2024, a free daily record of what you actually paid for each individual advertisement, plus the data needed to have the inventory verified by a firm of your choosing.
Almost nobody claims it. Partly because the right is buried in three paragraphs of a regulation most coverage reduces to a story about browser choice screens on phones. Partly because it is scoped in a way that surprises people: the test is where the person who sees the advertisement is, not where you are. A company in Chicago running campaigns into Germany is inside the scope. The same company running campaigns in Ohio is not.
This article sets out what the regulation is, who it binds, what it grants you, and, more usefully, what each platform actually hands over when you go and look. Because the right exists, but its implementation carries limits that the platforms document themselves, in filings that are public and almost never read.
What the Digital Markets Act actually is
The text. Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector, published in the Official Journal of the European Union on 12 October 2022.
Its purpose, in its own words: to ensure “contestable and fair markets in the digital sector” for all undertakings. Put plainly, to stop a handful of very large platforms from locking up access to their users or quietly favouring themselves.
The date everyone cites is the wrong one. The regulation entered into force on 1 November 2022 and became applicable on 2 May 2023. Neither date is the one that matters. Article 3(10) gives designated undertakings six months to comply with articles 5, 6 and 7, which means the substantive obligations only became binding on 7 March 2024. The real track record is two and a half years, not four. The Commission makes this point itself.
And here is what separates it from every other digital statute: it binds seven companies. This is not a regulation of the internet. It is a regulation of seven named undertakings. For everyone else, including your business, the DMA creates no obligations at all. It creates claims.
That asymmetry is the single most useful thing to understand about it. Most regulation arrives as a cost. This one arrives, for a company your size, as a set of things you are entitled to ask for.
Who it binds, and why only three names matter to you
Note what that last line means. Several large advertising businesses argued that they were not an important enough gateway to be regulated, and won. So the advertising provisions of this regulation reach three companies: Alphabet, Amazon and Meta. If you buy media anywhere else, none of what follows applies to that spend.
Does any of this reach a US advertiser?
This is the question that decides whether the rest of the article is useful to you, and the answer is more favourable than most people assume.
The regulation sets no establishment test. Article 5(9) speaks of “each advertiser to which it supplies online advertising services”. There is no condition in the drafting about where that advertiser happens to be incorporated, and no recital introduces one.
What the platforms scope is delivery. Amazon states the rule about as plainly as it can be stated, in its public documentation: “The billable event (impression or click) must have been served to an EU country.” It then gives an example that settles the question entirely: “a Japanese advertiser who has campaigns in Japan can access the report, but it is expected that the report will not have any pricing data for the Japanese advertiser.”
Read what that example concedes. A company with no European presence whatsoever is not shut out of the report. It simply finds the report empty, because none of its advertisements reached anyone in the EU. Flip the facts and the conclusion flips with them: run campaigns that reach EU users, and the data is yours.
Alphabet and Meta scope it the same way. Alphabet’s documentation states that no report is generated where an account has no traffic served to EEA end users on a given day, and Meta describes its dedicated pricing report as covering “ads delivered to people in the EEA”. One wrinkle worth flagging for completeness: Alphabet’s compliance report describes the consent it seeks from publishers as consent to share price data “with EEA advertisers”, which sits a little awkwardly beside its own access rule, under which recipients “must be Google’s advertiser customers, or third parties acting on their behalf” with no geographic qualifier attached.
So the practical position is this. If you are a US company with any European campaign activity, however modest, you hold a data right over that portion of your spending that you hold over no other part of it. Most advertisers in that position have never exercised it, and many have never been told it exists.
And the converse is just as firm. Campaigns served entirely to users outside the European Economic Area are outside the scope. Nothing in this regulation gives you a data right over your domestic US spend. If that strikes you as the more consequential gap, the section below on what the United States offers instead is the one to read.
The part nobody explains: three provisions written for advertisers
Three paragraphs create rights that are enforceable against the designated advertising businesses. They are exercisable on request, free of charge, and the text expressly extends them to third parties authorised by the advertiser, which is what makes an external audit legally possible.
What the text actually says
It is worth reading, because the drafting is sharper than the summaries of it.
Article 5(9) requires the gatekeeper to supply each advertiser, “or third parties authorised by advertisers, upon the advertiser’s request, with information on a daily basis free of charge, concerning each advertisement placed by the advertiser”. Three items specifically: the price and fees paid, deductions and surcharges included; the remuneration received by the publisher, subject to that publisher’s consent; and “the metrics on which each of the prices, fees and remunerations are calculated”.
Article 6(8) goes further, and it is the one to remember. The gatekeeper must give advertisers and publishers, “as well as third parties authorised by advertisers and publishers, upon their request and free of charge, with access to the performance measuring tools of the gatekeeper and the data necessary for advertisers and publishers to carry out their own independent verification of the advertisements inventory, including aggregated and non-aggregated data”. The text adds that the data must be provided “in a manner that enables advertisers and publishers to run their own verification and measurement tools”.
Your tools. Your vendor. Your queries. Not the platform’s dashboard.
What happens when the other side says no
Here is the detail commentary almost universally drops, and it changes the calculation.
The publisher’s remuneration is disclosed to you only “subject to the publisher’s consent”. You would reasonably assume a refusal guts the right. It does not. The very next subparagraph provides that where a publisher withholds consent, “the gatekeeper shall provide each advertiser free of charge with information concerning the daily average remuneration received by that publisher, including any deductions and surcharges, for the relevant advertisements”.
A refusal costs you granularity, not the information. You drop from a figure per advertisement to a daily average per publisher. That is worse, but it is a long way from nothing, and it is still more than any advertiser had before 2024. The mirror provision protects publishers when it is the advertiser who refuses.
What each platform actually hands over
The right is identical for all three. The implementation is not remotely identical. We went and read the compliance reports these companies file with the Commission and publish themselves, because that is where the operative limits are written down, not in their help centres.
Alphabet. The obligation takes the form of a daily downloadable file, separate for each advertising product, on the advertiser side and the publisher side alike. For every billable advertisement it carries an event identifier, the amount you paid, and the amount bid into the auction. Switching it on is self-service, inside the product’s settings. For article 6(8), Alphabet offers publishers a non-aggregated data solution and has extended the availability of free click-level reporting to advertisers. Worth noting: its most capable analysis environment predates the regulation, is not presented as the compliance answer, and sits behind a spend threshold.
Amazon. The clearest of the three, and the only one with dedicated public documentation. A pricing transparency report sits in the advertising console and in the publisher portal. More to the point, Amazon states in its compliance report that it has introduced “a new clean room environment where Advertisers can independently verify the performance of their ad campaigns”. That is the most literal reading of article 6(8) of the three. Sharing data with the counterparty is, however, off by default.
Meta. This is where reading the filing changes the conclusion you would have drawn from the marketing pages. Meta explains that it complies with article 5(9) in two ways: through the tools it already offered advertisers, and “by maintaining an additional pricing report in respect of ads shown on third-party applications via Audience Network”.
Read that again. The report built specifically for this regulation covers third-party app inventory only. For your campaigns in the Facebook feed, on Instagram, in Reels, which is to say for most of what an advertiser spends with Meta, the company’s position is that its pre-existing tooling already satisfies the obligation.
The position is not unreasonable. Articles 5(9) and 5(10) are drafted for an intermediation scenario: they speak of the price paid by the advertiser and the remuneration received by the publisher. Where Meta sells inventory on its own surfaces there is no third-party publisher, and half the obligation has nothing to describe. But the practical result stands: across the bulk of your Meta budget, this regulation has given you nothing you did not already have.
Three limits that keep this from changing the game
A right of access is only worth what you can do with the data. Three obstacles, each documented either by the platforms or by the Commission, explain why these obligations have not yet reshuffled anything.
The first is technical, and it is the most severe. Alphabet’s compliance report states, of the files produced under articles 5(9) and 5(10), that they contain “an Event ID, which does not function as a join key with Campaign ID (available in other reporting provided by Google) or any other event-level data provided by Google”. The stated justification is commercial confidentiality, end-user privacy and invalid-traffic protection.
Translated: you receive the exact price of every advertisement, and you cannot determine which campaign it belonged to. You hold the truth at the event level and the truth at the campaign level, and you are structurally prevented from putting them side by side. That is the heaviest constraint in the entire mechanism, and it is deliberate.
The second is scope, which we have just seen at Meta.
The third is the binary consent. The Commission puts it flatly in its April 2026 staff working document: “currently gatekeepers only allow a global consent (yes or no) for a party to share or not share pricing information with counterparties”. You cannot consent for one counterparty and not another, for one campaign and not another.
That same document is, for the rest, remarkably even-handed, and deserves quoting in both directions. On one side, the Commission judges that these developments “represent a clear step beyond the pre-DMA baseline”. On the other, it records that business users report “persistent issues in obtaining sufficiently granular and comparable data”, and adds a sentence worth dwelling on: those businesses “often mentioned gatekeepers’ arguments around privacy to justify withholding sufficiently granular data which, according to these stakeholders, can perpetuate information asymmetries”.
Its list of unresolved problems is specific: “insufficient granularity for comparability, lack of standardisation across platforms, inflated campaign metrics, geographical limitations on reporting, and restricted access to raw or log-level data”. Some member states pressed for an interoperability obligation on advertising tools. The Commission’s own conclusion is cautious: “it is also therefore too early to fully assess whether it is necessary to consider amending the provisions or their scope”.
What that means for you. You hold a real, exercisable right of access that did not exist before March 2024. You can audit one advertising business. You cannot yet put two of them side by side on the evidence. That is still a great deal more than most advertisers ever ask for.
How to actually exercise it
Step five deserves its caveat. Article 27 allows any third party, “including business users, competitors or end users”, to inform the competent national authority or the Commission directly. But the same article states that the Commission retains full discretion over what it does with that information. A report does not create a right to a decision, unlike a formal complaint in antitrust practice. It is nonetheless the route the regulation provides, and the preliminary findings issued since 2024 show these reports do feed the pipeline.
The other provision worth knowing about
If your business depends on a designated platform rather than merely advertising on it, article 6(9) is the one to read. GDPR has granted a right to data portability since 2018, but without any obligation to provide tooling or continuity: you can request an export and then work out what to do with it.
The DMA adds the part that was missing. The gatekeeper must provide effective portability “including by providing, free of charge, tools to facilitate the effective exercise of such data portability, and including by the provision of continuous and real-time access to such data”. Article 6(10) extends equivalent continuous, real-time access to business users for the data their own activity generates on the platform.
That is the difference between being handed an archive and being given a feed. The Commission reports that more than forty companies, mostly small and medium enterprises, have built services on this basis. Modest against the ambition of the text, but it is a category of business that did not previously exist.
Breach of any of this is expensive in principle: up to 10 per cent of worldwide turnover, rising to 20 per cent for a repeat breach, which the regulation defines narrowly as the same or a similar infringement, on the same core platform service, within eight years of an earlier finding. Three non-compliance decisions have issued so far, totalling 1.59 billion euros, and none of them has approached the statutory ceiling.
What the United States offers instead
Nothing comparable, and the reason is structural rather than accidental. Europe legislated an obligation in advance. The United States litigates conduct after the fact. Both approaches are defensible. They produce very different things for an advertiser.
The litigation route, briefly. In the Justice Department’s advertising technology case in the Eastern District of Virginia, Judge Leonie Brinkema found in April 2025 that Google had unlawfully monopolised the publisher ad server market and the ad exchange market, and had unlawfully tied the two. Notably for advertisers, the claim concerning advertiser ad networks failed, because the court was not persuaded that a distinct relevant market had been established.
The remedies opinion, 106 pages, issued on 2 September 2026 and unsealed on the 16th, declined to order divestiture of the exchange and imposed behavioural remedies instead: sharing real-time bid data with rival ad servers, and an end to first-look and last-look bidding privileges, among others. A final judgment had not been entered at the time of writing, and an appeal is expected.
Set the two timelines side by side. European advertisers have had a daily price file since March 2024. The American case, filed in 2023, produced a remedies opinion in September 2026 that is principally about publishers and is not yet final.
And the voluntary layer is exactly that. Measurement accreditation, supply-chain specifications such as the seller and supply-chain disclosure files, certification seals: all of it is industry self-regulation. A platform may adopt it. Nothing obliges it to, and no penalty attaches to declining. That is the whole distinction this article turns on. The DMA provisions are obligations, breach of which exposes a company to a fine of up to 10 per cent of worldwide turnover.
Bills that would change the US position have been introduced repeatedly since 2022, covering platform self-preferencing, app store conduct and cross-ownership of advertising exchanges. At the time of writing none has passed, and the relevant ones remain in committee.
Why it matters even if you never run a European campaign. The industry’s own numbers explain the appetite. The ANA’s Programmatic Media Supply Chain Transparency Study of December 2023, built on the log-level data of 21 advertisers across 123 million dollars of spend and 35.5 billion impressions, concluded that only 36 cents of every dollar entering a demand-side platform effectively reaches the consumer. In the United Kingdom, ISBA and PwC measured an “unknown delta”, spend that simply could not be traced anywhere in the chain, of 15 per cent in 2020, narrowed to 3 per cent by their January 2023 follow-up. Those are the conditions the European provisions were written against.
Who else is copying this
That last point is the one to take away. Two jurisdictions outside the EU have a comparable regime actually in force, the United Kingdom and Japan, and neither has replicated the advertising disclosure obligations. The UK regulator designated Google in October 2025 for search and search advertising, then imposed conduct requirements on content attribution, fair ranking and data portability. Greater transparency of search advertising sits in its “future consideration” category, and measures on advertising auctions and prices have been deprioritised outright.
So the right described in this article currently exists in exactly one place.
Where to get the text, and the documents that are actually useful
The regulation runs to 66 pages in the Official Journal and reads better than you would fear. Articles 5, 6 and 7 carry almost all of the obligations, and the recitals that precede them explain the reasoning.
The text. The consolidated version folds in the two corrigenda published since 2022 and updates itself if the regulation ever changes, which it has not done on substance.
- Consolidated version, PDF
- Consolidated version, navigable HTML
- Original text as published on 12 October 2022
The documents that tell you what is actually happening. These are less well known and far more useful day to day: the Commission’s own assessment, and what each platform states it provides.
- The Commission’s review report, April 2026
- The accompanying staff working document, where the business feedback sits
- The Commission’s portal, listing gatekeepers and open cases
We link to the official sites rather than hosting copies. A frozen PDF on someone else’s server goes stale without telling you.
What to do with this
Four things, in order of how easy they are.
Switch the disclosures on this week, if you run any European campaigns. The files required by articles 5(9) and 6(8) exist, are free, and are enabled in self-service. Nothing is on by default and nobody is going to suggest it to you. Once enabled, automate the collection: the files are daily and retention is short, so waiting six months before taking an interest means having lost six months of data.
Know in advance what you will not get. With Alphabet you will not be able to tie an advertisement’s price back to its campaign. With Meta the report built for this regulation does not cover your feed or Instagram campaigns. Going in with that knowledge is the difference between a useful exercise and a wasted quarter.
If you spend enough for it to pay, have the inventory verified by a third party. Article 6(8) expressly names third parties authorised by the advertiser. That is the legal basis for an independent audit, and it was close to impossible before 2024. The authorisation is granted inside the interface, and it is the step almost everyone forgets.
If your business depends on a platform rather than merely advertising on it, read articles 6(9) and 6(10). You have a right to export your data continuously and in real time, and to reach the data your own activity generates there. That is what turns switching platforms from a theoretical option into a practical one.
The Digital Markets Act was not written with small and medium businesses in mind, and it asks nothing of them. But it handed them claims that no other body of law provides, on one condition: that somebody asks.
Related reading: Media buying explained and Why CPM varies so much.