Brussels may threaten social media companies with regulation unless they move urgently to tackle fake news and Cambridge Analytica-style use of personal data before the European elections in 2019.

The EU security commissioner, Julian King, said “short-term, concrete” plans needed to be in place before the elections, when voters in 27 EU member states will elect MEPs. The Cambridge Analytica affair had “served to highlight how important [the issue] is”, he told the Guardian.

Regulators around the world have been rethinking their hands-off approach to social media, after it emerged that Cambridge Analytica had mined data from 50 million Facebook users to secretly target them with ads during the US elections.

Under King’s ideas, social media companies would sign a voluntary code of conduct to prevent the “misuse of platforms to pump out misleading information”.

The code would include a pledge for greater transparency, so users would be made aware why their Facebook or Twitter feed was presenting them with certain adverts or stories. Another proposal is for political adverts to be accompanied with information about who paid for them.

“We want to see whether we can rapidly reach agreement with key platforms and stakeholders on a policy level, with them being a bit more open about why you are seeing what you are seeing,” King said.

“If we are not able to make fast enough progress on voluntary basis, then as we have done in some other areas, we may have to view whether or not we need to look at other alternatives, including of a regulatory nature.”

The ideas are expected to form part of a European commission policy paper on online disinformation, due to be published on Thursday.

An expert report on online disinformation, commissioned by Brussels, last month called for a massive expansion of media literacy in schools, as well as greater collaboration between fact-checking organisers. But the security commissioner would like more urgent action to “boost transparency, traceability and accountability [of platforms], all of this without in anyway falling into the trap of censorship”.

Tech companies are set to welcome the voluntary approach, but raise doubts over some of the proposals. “It is wise they do it this way,” said Cecilia Bonefeld-Dahl, the director general of Digital Europe, which represents the industry. “If you leave people to take responsibility it is better than to punish them for something they haven’t done.”

But she gave a lukewarm response to some of the commission’s key ideas, such as algorithm transparency, where she warned against an overreaction. “For decades we have had a certain group [of TV viewers] getting targeted ads, at certain times targeted to certain programmes. And this is not illegal, so we need to avoid an overreaction.”

On the plans to name funders behind political adverts, she said: “Let us look at the current legislation and see if anything is missing first.”

One prominent member of the commission’s expert group on disinformation warned that self-regulation would not be enough.

“The commission’s dissection of the problem is spot-on but its response lacks punch,” said Monique Goyens, the director general of the European Consumer Organisation. “If the commission is serious about fighting fake news it needs to address the fact that the advertising business model of big online platforms is an accelerant of the spread of disinformation.”

“Judging by past experience, self-regulation will not do the trick to achieve change when it comes to the likes of Facebook.”

The commission’s response to fake news comes as different EU member states consider their options. The French president, Emmanuel Macron, wants electoral authorities to have emergency powers to remove fake news during elections. Germany has introduced a law targeting hate speech and fake news where social media companies can be fined up to €50m (£44m) for failing to remove illegal content.

The EU has also run into criticism over the approach of its counter-propaganda unit, East Stratcom, which runs a website, Disinformation Review, intended to weed out false facts about the EU and tell positive, true stories.

Earlier this year, the taskforce made an embarrassing about-turn after naming three Dutch websites as purveyors of fake news, as a result of translation errors. Newspaper De Gelderlander, anti-EU weblog GeenStijl and the Post Online were removed from the EU v Disinfo site this year, after complaints and threats of legal action. The episode exposed the reliance of the taskforce on a network of NGOs and journalist fact-checkers, who may be using machine translators.

Critics say the example highlights how an “unsystematic” approach risks undermining freedom of expression. Without commenting on the specific case, King said East Stratcom was “doing an important job” of uncovering “systemic attempts to run fake news stories”. Its work is “very difficult and there may be occasions when it is open to challenge and I think they welcome that challenge”.

Barring surprises, King will be the UK’s last European commissioner. A career diplomat, he took up his post following the shock resignation of Conservative peer Jonathan Hill after the Brexit vote in June 2016.

The former ambassador declined to speculate on how a code of conduct or any future disinformation regulation might affect the UK, which would follow all EU laws without any say in making them until the end of 2020, under a mooted Brexit transition.

“I hope the UK will continue to be engaged with this work as we take it forward,” he said, adding that the National Cyber Security Centre in London “is recognised widely, not just in Europe, as a real authority in this field”.