Regulation of AI in marketing: what awaits business after new EU laws

Starting from 2025, the European Union will begin implementing the AI Act — the world's first comprehensive law regulating artificial intelligence. It radically changes the approach to using AI in marketing, personalization, data collection, and advertising algorithms.

What is the AI Act?
The AI Act (Artificial Intelligence Act) is an EU regulatory act that:

• Classifies AI systems by risk level: minimal, limited, high, unacceptable.

• Prohibits AI with unacceptable risk (e.g., covert manipulation and social scoring).

• Requires certification for high-risk AI.

• Obliges informing users about interactions with AI.

• Introduces mandatory labeling of generative content (deepfakes, AI advertising, etc.).

Other EU laws affecting marketing:

• GDPR: strengthens consent requirements, algorithm explanations, and data protection.

• Digital Services Act (DSA): demands transparency from online platforms and recommendation algorithms.

• Digital Markets Act (DMA): limits dominant positions of digital giants and their imposed advertising technologies.

Changes in marketing practices:

• Ban on manipulative AI tools (especially for children and elderly).

• Restriction of behavioral targeting without informed consent.

• Mandatory labeling of AI-generated advertising.

• Stricter requirements for explainability — explaining how algorithms work.

• Increased accountability for automated decisions.

Business implications:

• Increased compliance costs.

• Revision of hyper-personalization strategies.

• Stricter legal liability.

• New competitive advantages for “transparent” brands.

• Possible fines up to 7% of annual company turnover.

Table: Before and After AI Act

Impact of AI Act on data and advertising

1. Collection and processing of personal data
   The AI Act reinforces GDPR principles:

• Only lawful, transparent, and limited use of data.

• Clear and voluntary consent required for AI algorithm use, especially for behavioral analysis.

• Users have the right to:

  • know their data is processed by AI;

  • refuse automated decision-making;

  • request explanation of recommendation logic.

2. Behavioral and personalized targeting

• Behavioral targeting is classified as “limited risk.”

• Strict restrictions apply to:

  • minors;

  • elderly people;

  • vulnerable individuals.

• Transparent explanation required on why and how ads are shown to users.

3. AI-generated content and advertising

• Any text, image, video, or voice created by AI must be clearly labeled, e.g., "Created using artificial intelligence."

• Without labeling, ads are considered misleading and illegal.

4. Responsibility for AI advertising systems

• Companies must:

  • conduct AI advertising risk assessments;

  • document algorithm operations;

  • ensure audits of automated marketing systems.

• Violations can lead to fines up to 7% of turnover or 35 million euros.

5. Restrictions for large platforms

• Platforms like Meta, Google, and TikTok must:

  • disclose advertising ranking mechanisms;

  • allow users to opt out of personalized feeds;

  • publish registries of targeted ads (ad repositories).