The European Commission on Thursday proposed a new regulation on the transparency of political advertising. Under the proposal, political ads—both online and offline—would have to carry a transparency notice that says who paid for them, what election or referendum they are linked to, and how the ad was “targeted and amplified” to reach them.

The targeting part is where things get really tricky for Big Tech. The bill wouldn’t ban targeted political advertising outright, but it would ban the targeting of ads based on sensitive personal data, unless the person being targeted gives their explicit consent. The legal definition of “sensitive personal data” is already well established in the EU, thanks to the General Data Protection Regulation (GDPR), and it includes everything from ethnic origin, religious beliefs and sexual orientation to…political opinions.

So no-one would be able to target a political ad at a Facebook user based on them being right- or left-wing, for example, without first getting their explicit permission.

Vera Jourová, the Commission’s vice-president for values and transparency, said Thursday that the law was a reaction to events including the Jan. 6 insurrection in the U.S., the Cambridge Analytica scandal, the Brexit referendum, and Facebook whistleblower Frances Haugen’s recent revelations about the company’s poor handling of disinformation.

“We have seen too many examples of the risks stemming from the digital realm,” Jourová said. “Our aim is to put order in the world of political advertising, especially online. Digital advertising for political purposes is becoming an unchecked race of dirty and opaque methods. Voters increasingly have a problem distinguishing if the content they see is paid for by someone or organic. A recent survey suggests 40% of respondents have difficulty recognizing organic from paid content. They also see an increasing amount of disinformation online.”

Jourová said it was essential that people should learn how often A.I.-powered targeting techniques result in them seeing the ads they see. “Either companies like Facebook are able to publicly say who they are targeting, why and how or they will not be able to do it. We introduce the principle ‘explain or restrain’, because freedom to speak does not mean freedom to reach,” she said.

The law would apply not only to the Facebooks of this world, but also to public relations firms, political parties, data brokers, and even influencers.

The Computer & Communications Industry Association (CCIA), one of Big Tech’s loudest lobbyists in Brussels, said it welcomed the Commission’s “overall objectives”—but it doesn’t seem happy with the targeting requirements.

“We support the goal to create a modern EU-wide framework that provides more transparency in political advertising and that safeguards election integrity and freedom of expression,” CCIA senior manager Victoria de Posson said in an emailed statement. “Currently each state has its own approach for political ads, so more guidance at the EU level would help promote EU-wide efforts, which is particularly important for smaller companies.”

“Some clarifications are however needed, for instance on definitions and targeting requirements,” de Posson added.

The new law would be a regulation, meaning it would apply uniformly across the EU. Like all regulations, it will need to go through the bloc’s lengthy legislative process, and will likely be amended by the European Parliament and by member states. The aim is to get it in place by the 2024 European elections.