1. The definition of recommender systems under Article 3 of the DSA
The term “recommender systems” entered the legal vocabulary of the European Union legislature only with the adoption of the Digital Services Act (hereinafter, the “DSA”), although the term was already well established in the computer science literature (among others, Aggarwal, 2016; Ricci et al., 2022). From a technical perspective, recommender systems are defined as software tools “that provide suggestions for items that are most likely of interest to a particular user” (Ricci et al. 2022).
Consistently with this understanding, Article 3(1)(s) defines them as “a fully or partially automated system used by an online platform to suggest in its online interface specific information to recipients of the service or prioritise that information, including as a result of a search initiated by the recipient of the service or otherwise determining the relative order or prominence of information displayed”.
As Busch stresses, the DSA does “not distinguish between different types of recommender systems such as content-based systems, knowledge-based systems, collaborative systems, or hybrid systems” (Busch, 2023). This appears to reflect the European Union legislature’s primary objective of classifying recommender systems on the basis of their functions and purposes, while leaving the mechanisms and types of algorithms on which they are built in the background. In other words, the DSA classifies as recommender systems all those software tools that ultimately engage users and influence their behavior, regardless of the underlying mechanisms and algorithmic typologies supporting such systems.
Since recommender systems play a key role “in the amplification of certain messages, the viral dissemination of information and the stimulation of online behavior” (Recital 70 DSA), online platforms must ensure that recipients are appropriately informed about the impact of recommender systems on the way information is displayed and presented to them. Moreover, providers must comply with Article 27 DSA by explaining to recipients which parameters are taken into account by recommender systems and how such parameters determine the prioritization of information, in accordance with the principle of transparency. In particular, online platforms must comply with the transparency obligations imposed by Article 27 DSA so as to make the reasons why those parameters have been chosen readily understandable to users, and make recipients aware of their right to opt to modify or influence the main parameters used in their recommender systems. As recommender systems keep growing in sophistication, for instance through the use of AI and deep-learning technique to tailor recommendations towards content that platforms consider most likely to be interesting and engaging for users, the risks of exposing users to potential harm correspondingly increase (Wood, 2024). This is particularly true for children, due to their stage of development, potential vulnerability, and level of understanding.
Since minors may be more easily exposed to content capable of negatively affecting their physical and mental health, and recommender systems may considerably influence their decision-making autonomy, Article 28(1) DSA establishes that “providers of online platforms accessible to minors shall put in place appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors, on their service.” To provide a clear account of the current regulatory framework governing recommender systems addressed to minors, the present work is divided into two core parts. The first is dedicated to a critical analysis of the criteria of appropriateness and proportionality applicable to such measures, whereas the second focuses on a specific aspect of Article 28 DSA, namely the prohibition laid down in Article 28(2) on online platforms presenting advertisements on the profiling of personal data.
2. From Article 28 DSA to the 2025 EU Commission Guidelines
As previously mentioned, Article 28(1) DSA introduces a fundamental shield for minors, requiring providers of online platforms accessible to them to implement these “appropriate and proportionate” measures. However, the provision leaves room for interpretation. Unlike Articles 34 and 35 DSA, which establish a structured framework for the assessment and mitigation of systemic risks applicable to Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs), Article 28 provides for a general obligation on all providers of online platforms accessible to minors, without specifying concrete measures required to satisfy it (Petelin, 2026).
It is against this background that, in July 2025, the European Commission adopted its Guidelines on measures to ensure a high level of privacy, safety and security for minors online (EU Commission, 2025), in accordance with Article 28(4) DSA. The rationale behind these Guidelines is to provide greater practical direction as to how providers may comply with Article 28(1). As Petelin observes, the Commission thereby addressed what she describes as an “apparent shortcoming” in Article 28(1), by “clearly framing this article within a risk-based approach, drawing, to some extent, on the rationale already familiar from Articles 34 and 35 DSA (Petelin, 2026).
However, this does not mean that the Guidelines resolve the uncertainty inherent in Article 28(1), nor that they merely extend the regulatory model established by Articles 34 and 35 to all platforms accessible to minors. The provisions remain distinct in both scope and legal nature. In fact, while Article 28 applies to providers of online platforms accessible to minors irrespective of their size, Articles 34 and 35 establish additional obligations for VLOPs and VLOSEs in relation to systemic risks. It could be therefore argued that the Commission has therefore given Article 28 a more explicitly risk-sensitive interpretation without transforming the provision into a traditional systemic-risk regime. At the same time, the Guidelines do not possess the same legally binding nature as the DSA itself, which limits the extent to which their recommendations can independently determine the content of Article 28(1)’s obligation (EU Commission, 2025).
This distinction is crucial because, although the Guidelines are not legally binding, their practical meaning is hard to dismiss. Indeed, the Commission expressly states that implementing the measures contained in the Guidelines, whether partially or in full, does not automatically establish compliance with Article 28(1). At the same time, the Commission describes the Guidelines as a “significant and meaningful benchmark” for the exercise of its enforcement discretion, which give them practical influence despite their non legally binding nature (EU Commission, 2025). As a result, questions traditionally treated as matters of technical design, such as which kind of signals, implicit or explicit, are used to personalise content, how recommendation objectives are defined, and how systems are evaluated, are increasingly becoming relevant to the assessment of children’s online safety (Naudts et al. 2025; Hakkarainen and Sovalainen, 2025).
The Guidelines translate this approach into practical terms, inviting providers to prioritise explicit signal of user preference over implicit ones, such as time spent viewing content, and reduce the visibility of harmful content, including material relating to unrealistic beauty standards or diets, the trivialisation of mental health issues, radicalisation or violent content (EU Commission, 2025). In addition, recommender systems should be designed so as not to expose minors to risks of addiction and avoid a spiral of escalating exposure to dangerous content, usually defined as the “rabbit hole” effect. (EU Commission, 2025; Petelin, 2026).
This is important in the analysis because, unlike more static forms of interface design, recommender systems can continuously adapt the informational environment to the individual user, shaping which content is prioritised, how frequently it recurs, and what users are more likely to encounter and engage with (Solarova et al., 2026). This dynamic and personalised dimension raises a distinctive challenge for children’s online safety because the potential risk associated with a particular piece of content cannot necessarily be assessed in isolation since risk may emerge from the interaction between content, user, and recommendation mechanism, not only from content alone (Solarova et al., 2026).
Seen in this light, the regulation of these systems reflects a broader shift in the understanding of online safety. As Hakkarainen and Sovalainen suggest, the notion of online safety is moving away from a traditional conception largely centred on whether material is illegal or subject to restrictions, heading towards a more relational understanding of platform-mediated risk. In this new perspective, personalisation signals and ranking metrics carry independent regulatory weight because they shape the environment in which children form preferences. Managing this influence, however, creates a tension between protection and autonomy. In fact, interventions designed to protect children risk restricting their capability in learning how to make independent choices (Solarova et al., 2026). Hence, the challenge lies in balancing safety with room for open exploration, without letting protective design collapse into mere paternalism.
The debate is far from over. In late 2025, the European Parliament welcomed this shift but urged even stronger action, particularly regarding profiling-based and engagement-based recommendations, leaving space for future binding legislative action (European Parliament, 2025). Up until now, these developments remain primarily a matter of soft law, although the call for stronger action indicates that this regulatory approach may continue to evolve.
Furthermore, Article 28(1) and Article 28(2) DSA embody two different regulatory techniques for addressing minors’ protection online. While Article 28(1) adopts a flexible, risk-based standard, Article 28(2) DSA opts for a categorical, non-negotiable prohibition on one narrowly defined practice. The reason why legislator chose a bright-line rule here, rather than a proportionality test, is examined in the following section.
3. No profile-based advertising when the user is a minor under Article 28(2) DSA
Article 28(2) DSA does not impose a general prohibition on profiling minors’ personal data within recommender systems, but specifically prohibits targeted advertising “based on profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679 using a personal data of the recipient of the service when they are aware with reasonable certainty that the recipient of the service is a minor.” This restriction is directly informed by the inherent risks of commercial profiling. Indeed, as Recital 69 DSA stresses, “advertisements based on targeting techniques optimised to match their interests and potentially appeal to their vulnerabilities” can have particularly serious negative effects on minor users.
In order to complete the analysis, two aspects require closer examination. First, the EU legislature expressly refers to Article 4(4) of the General Data Protection Regulation (hereinafter, the “GDPR”), which defines profiling as “any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.” An important difference therefore emerges between the DSA and the GDPR, namely that “the DSA provision on profiling-based advertising and children is stricter because it cannot be overridden by parental consent” (Wolters et al. 2025). Under the GDPR, the processing of a children’s personal data may, below the relevant age threshold, be based on consent given or authorised by the holder of parental responsibility, in accordance with Article 8(1). By contrast, Article 28(2) DSA establishes an unconditional prohibition on presenting profiling-based advertisements to minors, which cannot be bypassed through parental consent. Second, this prohibition applies only where online platforms are aware with reasonable certainty that the recipient whose personal data are used for profiling-based advertising is a minor. However, Article 28(3) DSA specifies that compliance with the obligations laid down in Article 28 does not require “providers of online platforms to process additional personal data in order to assess whether the recipient of the service is a minor.” Consistently with the GDPR principle of data minimisation, online platforms are therefore not required to collect additional personal data to determine whether a user is a minor. As Recital 71 DSA clearly states, “in accordance with Regulation (EU) 2016/679, notably the principle of data minimisation as provided for in Article 5(1), point c), thereof, this prohibition should not lead the provider of the online platform to maintain, acquire or process more personal data than it already has in order to assess if the recipient of the service is a minor.” Nevertheless, an ambiguity remains within Article 28(2 DSA: under what circumstances may an online platform be considered aware with reasonable certainty that the recipient is a minor? Indeed, the DSA “does not clarify under what circumstances platforms should know that the recipient is a minor” (Wolters et al., 2025). This uncertainty is particularly relevant because the application of the prohibition laid down in Article 28(2) depends precisely on the platform reaching this level of certainty.
4. Quo vadis online protection of minors?
After a period of regulatory vacuum, the category of recommender systems was finally taken into account by the EU legislature only when the DSA was published on 19 September 2022. Since its entry into force, Article 28 has highlighted the complexity of regulating these systems in the context of the online protection of minors. Indeed, Article 28(4) DSA refers to soft-law instruments, such as the Guidelines, in order to make the framework feasible, effective and efficient, while taking into consideration all the other rights that characterise the protection of minors, including, among others, the right to object to profiling (Art. 21 GDPR) and the right not to be subject to solely automated decisions (Art. 22 GDPR). Moreover, the question of how to make the functioning of recommender systems compatible with the right to freedom of expression and children’s right to develop decision-making autonomy on social media in a safe and meaningful way has attracted increasing scholarly attention (Lavi, 2024; Leijten and van der Hof, 2025; Ungruh, 2025). In the authors’ view, however, the Guidelines do not appear to fully resolve this balancing challenge. Indeed, it is considered necessary to intervene through binding instruments, pursuant to the principle of legal certainty, with the aim of ensuring that the relevant rules are effectively upheld and concretely protected. In other words, whether the DSA can ultimately deliver the level of protection it aims to provide will depend on how its principles are implemented in practice. Further clarification and effective enforcement will therefore be needed to address the evolving risks created by increasingly personalised and engagement-driven recommender systems.
Some of the concerns addressed by the Commission Guidelines has already emerged in Italian enforcement practice. In the 2024 TikTok decision, the Italian Competition Authority (AGCM) considered the repeated recommendation of similar, potentially harmful content together with minors’ vulnerability, and the personalised default feed and TikTok’s interest in maximising engagement (AGCM, 2024). It concluded that these elements caused “undue conditioning” under consumer law and imposed a fine of 10 million euros. Although the decision does not expressly qualify recommender systems as manipulative, it shows how personalised and engagement-driven recommendation may affect users’ ability to make free and informed choices.
A related concern emerged in July 2022, when the Italian Data Protection Authority issued a formal warning after TikTok proposed to rely on legitimate interests, instead of consent, for profiling used for personalised advertising (GPDP, 2022). The Authority questioned the adequacy of the proposed legal basis and raised concerns about the possibility that age-verification measures could expose minors to profiling-based advertising. Although the two Italian decisions preceded the Commission Guidelines and concerned different regulatory regimes, they portray what the Guidelines subsequently seek to address, including user profiling, age assurance, harmful recommendations, and engagement-driven recommender systems. However, the DSA still represents an important step towards regulating recommender systems in this field through Article 28, although further legislative interventions may be relevant to resolve interpretative issues and contradictions between the DSA and the GDPR. From the authors’ perspective, it appears difficult to reconcile paragraphs 2 and 3 of Article 28, especially in light of the GDPR. Since online platforms are not required to process additional personal data to verify age, this limitation directly affects the protection of minors in the context of recommender systems, as platforms cannot effectively tailor or restrict recommendation algorithms without processing the very age-related data they are encouraged to limit.
