Data subject

A data subject is any living person whose personal data is being collected, stored, or used. In the context of political advertising, this includes voters and other individuals whose information may be processed for targeting or delivering political ads.

Legal Basis

"'data subject' means an identified or identifiable natural person"

— Article 4(1), Regulation (EU) 2016/679 (GDPR)

While the TTPA Regulation (EU 2024/900) does not define data subject directly, it relies on the GDPR definition when addressing the processing of personal data for political advertising purposes.

Why It Matters

Data subjects are at the center of the TTPA's targeting restrictions. When political advertisers use personal data to target or deliver ads online, every individual whose data is processed becomes a data subject with specific rights under EU law.

The TTPA imposes strict limits on what personal data can be used for political ad targeting. Providers of political advertising services must ensure that targeting techniques only use personal data in compliance with both the GDPR and the TTPA. This means obtaining proper consent, respecting data subject rights, and avoiding the use of sensitive categories of data for political targeting.

For individuals, being a data subject means you have the right to know when your personal data is being used for political advertising, to access that data, to object to its use, and to lodge complaints with data protection authorities if you believe your data is being misused for political purposes.

Key Points

A data subject is any natural person whose personal data is processed, including for political advertising purposes
Data subjects have fundamental rights under the GDPR, including rights to access, rectification, erasure, and objection
The TTPA restricts how personal data of data subjects can be used for targeting or delivering political ads online
Special categories of personal data (such as political opinions, biometric data, or health data) face even stricter limitations under the TTPA
Data subjects can complain to data protection authorities if their personal data is misused for political ad targeting
Providers of political advertising services must respect data subject rights throughout the political advertising lifecycle

Data subject vs. End user

While these terms overlap, they are not identical. A data subject is specifically defined by data protection law (GDPR) and refers to anyone whose personal data is processed. An end user, in the context of digital services regulation, is anyone using or receiving a service, regardless of whether personal data is processed.

In political advertising, an individual becomes a data subject when their personal data is used for targeting or ad delivery. They are an end user when they simply view content on a platform. You can be an end user without being a data subject (if no personal data is processed), but if personal data is processed for targeting political ads to you, you are both.

Aspect	Data subject	End user
Legal basis	GDPR (data protection law)	DSA, TTPA (digital services law)
Trigger	Processing of personal data	Use of a service
Rights	Access, erasure, objection, etc.	Transparency, reporting channels
Supervisory authority	Data protection authorities	Digital Services Coordinators, media authorities

Related Terms

Personal data
Targeting techniques
Ad-delivery techniques
Sponsor
Provider of political advertising services
Publisher
Special categories of personal data
Controller
Processor
Political actor

Very transparent. Every political ad will be labelled, linked to a transparency notice with detailed information, and online ads will be searchable in a central European repository.

The Network coordinates election-related cooperation between member states. National contact points for TTPA enforcement should be members of this network where possible.

Election campaigns will need to ensure all paid advertising includes proper labels and transparency notices. Sponsors must be prepared to provide required information to all service providers.

Several major platforms currently do not allow paid political advertising, including some large social networks. This limits where political actors can place paid online advertisements.

The TTPA applies from 10 October 2025. Member States had until 10 April 2025 to designate competent authorities, and the Commission must provide label templates by 10 July 2025.

Publishers must ensure completeness and accuracy of certain information but are not required to verify all sponsor claims. They must correct manifestly erroneous information when they become aware of it.

Yes. When a hosting provider and a website both display an ad, both are considered publishers with responsibility for their specific services. Contracts should clarify how they share compliance duties.

If a publisher removes or disables access to a political ad due to illegality or terms violations, they must still provide access to the transparency information for the full seven-year retention period.