Elon Musk’s social media platform X has been hit with a formal complaint because of alleged breaches of the EU’s Digital Services Act (DSA): the platform appears to have used sensitive personal data for targeted advertising.
The complaint is filed by nine civil society organisations including European Digital Rights (EDRi), AI Forensics and Centre for Democracy and Technology Europe (CDT).
It comes after evidence compiled by AI Forensics on the basis of X’s Ad Repository, found that “major brands as well as public and financial institutions engaged in targeted online advertising”, based on special categories of personal data, such as political opinions, sexual orientation, religious beliefs and health conditions.
Under the DSA, which entered into force for the largest online platforms – which includes X – in late 2023, platforms are prohibited from offering targeted advertising based on profiling using these special categories of data.
AI Forensics uncovered evidence, for example, that “X allowed Total Energies, the multinational energy and petroleum company, to run ads on its platform excluding users who had engaged with keywords related to ecologist political figures,” the complaint said.
In addition, fast-food chain McDonalds could run ads “excluding X users who had engaged with keywords related to McDonalds’ own trade union as well as antidepressants and suicide”.
The organisations call on the national Digital Services Coordinators and the European Commission to investigate the potential breach.
The Commission began an investigation into X under the DSA in December 2023.
In preliminary findings published last summer, the EU executive concluded that blue checkmarks used by the platforms are deceptive and that it falls short on transparency and accountability requirements. X has had the opportunity to reply in writing.
The investigation is still pending.
