Media law compliance is not one body of rules but four, and a Dutch business that publishes, advertises or runs a platform is subject to all of them at once: European platform regulation, the Media Act and the rules on audiovisual services, copyright and portrait rights, and the advertising, consumer and data protection rules that govern how you reach an audience. Most of it is directly applicable European law, enforced in the Netherlands by the ACM, the Dutch data protection authority and the Commissariaat voor de Media. This article sets out what actually binds a company and where the enforcement risk sits.
What media law covers for a business
The term media law is used loosely, and that vagueness is itself a compliance risk, because it hides the fact that different obligations attach to different roles. A company that only publishes its own content on its own site has an intellectual property and advertising problem. A company that hosts content uploaded by others is an intermediary service and falls under the Digital Services Act. A company whose service is an online video channel with a substantial audience may qualify as a commercial media service on demand and fall under the Media Act, with a registration duty at the Commissariaat voor de Media. The first question in any assessment is therefore not which rules exist but which role your service occupies, because the same organisation often occupies several. Our general introduction to hukum media ing Walanda maps the field; what follows concentrates on the compliance work it generates.
The Digital Services Act and who enforces it here
The Digital Services Act applies in full and scales its obligations by role. Every intermediary needs a single point of contact and terms of service that explain, in clear language, any content restrictions and how content moderation and any automated tools are used. Hosting services must have a notice and action mechanism and must give a reasoned statement to the user whose content is restricted. Online platforms carry more: an internal complaints procedure, cooperation with out-of-court dispute settlement, priority handling of notices from trusted flaggers and a ban on interface designs that distort a user’s free choice. Marketplaces must trace and verify their business users before letting them sell. Advertising must be recognisable as such, with the advertiser identified and the main parameters of the targeting disclosed, and advertising based on profiling using special categories of personal data, or directed at users known to be minors, is prohibited.
Enforcement in the Netherlands runs through the ACM, which is the Dutch Digital Services Coordinator, with the data protection authority responsible for the provisions that turn on personal data; the Dutch implementing act giving both of them their powers took effect on 4 February 2025. Very large platforms and search engines are supervised directly by the European Commission, and the Digital Markets Act obligations on designated gatekeepers are a Commission matter as well, although businesses that depend on those gatekeepers acquire rights they can invoke. We set out the practical consequences for companies in our article on the Digital Services Act and Digital Markets Act, and for advertisers specifically in the DSA rules on online advertising.
The AI Act: what already binds you and what does not yet
For anyone producing content, the AI Regulation matters mainly through its transparency obligations, and those are among the parts that already apply. A person interacting with an AI system must be told that they are; synthetic audio, image, video and text content must be marked in a machine-readable way; and where a deep fake or AI-generated text on a matter of public interest is published, that has to be disclosed. The prohibitions on unacceptable practices and the rules for general-purpose AI models are also in force. What has been postponed is the high-risk regime: the digital omnibus package moved the obligations for the systems listed in Annex III to 2 December 2027 and those for products covered by Annex I to 2 August 2028. The separate AI Liability Directive has been withdrawn, so liability for damage caused by AI output continues to be assessed under ordinary Dutch law, including product liability and the general tort provision.
In practice this means a marketing department using generative tools has obligations now, not in 2027. Our guides on drawing up an AI policy lan ing praktik AI sing dilarang set out what to put in place.
Using other people’s content, images and faces
Copyright arises without registration and belongs to the maker; for work made by employees in the course of their duties it belongs to the employer, but for work made by freelancers and agencies it does not, unless it has been transferred in a signed deed. That single point causes more disputes than any other in this field: a company pays for a campaign, receives the files, and discovers years later that it holds a limited licence rather than the rights. Check what your agency contracts actually assign, and check whether the licence covers the media, territory and duration you are now using. Quotation is permitted within narrow limits, and using a photograph you found online is not one of them, as we explain in copyright on photographs.
A recognisable person in your material brings a second right into play. Under the Copyright Act a person depicted can oppose publication of their portrait where they have a reasonable interest in doing so, and for commercial use that interest is readily accepted; a signed release, covering the same media, territory and duration as your licence, is the only reliable answer. The rules are set out in our article on hak potret. Material generated by an AI tool raises the opposite problem: output that involves no human creative choices is generally not protected by copyright at all, which means you may not be able to stop a competitor from using the same image, and the terms of the tool may in any case limit what you are allowed to do with it commercially.
Advertising, reviews and influencer marketing
Dutch advertising law has a business-to-business track and a consumer track. Misleading advertising towards other traders is governed by the Civil Code provision on misleading advertising, under which the advertiser bears the burden of proving the accuracy of the claims once their correctness is disputed. Towards consumers the unfair commercial practices regime applies, with its lists of practices that are misleading or aggressive in all circumstances, enforced by the ACM with administrative fines and by competitors and consumer organisations through the courts. Alongside the statute sits the self-regulatory Dutch Advertising Code and its complaints board, which is fast, cheap and public, and whose rulings are widely reported; a company that ignores a recommendation is named. Our article on laku komersial ora adil works through the tests.
Two specific areas deserve separate attention because enforcement has been active. Consumer protection rules now expressly forbid presenting reviews as genuine without taking reasonable steps to check that they come from actual purchasers, and forbid submitting or commissioning false reviews; incentivised reviews have to be disclosed. What a business may and may not do with reviews written about it, including when a negative review crosses into unlawful conduct, is covered in online reviews under Dutch law. Influencer marketing carries a disclosure duty for paid partnerships, contractual responsibility that runs back to the advertiser, and, for larger video channels, the Media Act registration duty mentioned above; see pemasaran influencer ing Walanda.
Personal data in publishing and marketing
Every content operation is also a processing operation. Direct marketing needs a lawful basis, and for electronic messages the telecommunications rules add a separate consent requirement with a limited exception for existing customers and a mandatory opt-out in every message. Cookies and comparable techniques on your site need consent unless they are strictly necessary or purely functional, and consent obtained through a banner that makes refusal harder than acceptance is not consent; that is where the data protection authority and, under the Digital Services Act, the ban on distorting interface design meet. Audience measurement, tracking pixels in newsletters and the sharing of audience lists with advertising platforms all require a documented basis, a processor agreement and, where the processing is systematic and large-scale, an impact assessment carried out before launch rather than after.
When a publication about your company is unlawful
The mirror image of publishing is being published about. Dutch law does not treat a damaging publication as unlawful merely because it is damaging. The court weighs the seriousness of the accusation, the support it finds in the available facts, the way it is presented, the public interest in the subject and the position of the person concerned, against the freedom of expression protected by the Constitution and the European Convention. A poorly substantiated accusation presented as fact and put to a wide audience is where claims succeed. The remedies are rectification, removal, damages and, where speed is essential, interim relief proceedings, but a demand for prior removal directed at journalism rarely succeeds and a badly judged threat tends to enlarge the story rather than end it. Where the material is a manipulated video, criminal law may add a route, as set out in our article on deepfake miturut hukum Walanda.
How to organise media law compliance
Start by writing down which role each of your services occupies and which regime follows from it, because everything else depends on that classification and it is the first thing a regulator will ask. Then build a register of the content assets you use and the rights you hold in them, with the licence, its scope and its expiry date next to each item, and add the releases for identifiable people. Put the same discipline into your agency and freelance contracts: an express transfer of copyright where you need ownership, a warranty that the material does not infringe third party rights, an indemnity that survives termination, and clarity about who holds the rights in AI-assisted output.
Operationally, three procedures do most of the work. A takedown and notice procedure with named owners and a fixed response time, so that a complaint about content on your platform is not handled ad hoc. A pre-publication check for campaign material that covers substantiation of claims, licences, releases and disclosure of any AI involvement. And a record of decisions, because in almost every one of these regimes the obligation is not only to act correctly but to be able to demonstrate that you did. Reviewing that set once a year, and whenever a new service is launched, is cheaper than the alternative.
Law & More advises Dutch and international companies on the media, advertising, copyright and platform rules that apply to what they publish, and defends them when a regulator, a competitor or a person portrayed objects. If you are launching a service, revising your contracts or facing a complaint, contact our media law team in Eindhoven or Amsterdam.
