The EU's first Digital Services Act fine was about a blue tick, an ad archive and researcher access

The European Commission's decision of 5 December 2025 is routinely described as Brussels punishing X over content moderation or political speech. The Commission's own press release, IP/25/2934, does not mention either. It concerns three transparency duties, and the case that does concern content is a different case that is still open.

The fine is 120 million euros, and the Commission states plainly that it is the first non compliance decision under the Digital Services Act. The three findings are set out with their legal bases. The first is deceptive design of X's blue checkmark, under Article 25(1). The Commission's objection is not that X sells the badge but that it labels the result verified. Anyone can pay to obtain the status without X meaningfully verifying who is behind the account, which the release says makes it hard for users to judge authenticity and exposes them to impersonation fraud. The release is explicit that the DSA does not require platforms to verify users at all; it prohibits them from claiming they have when they have not.

The second is the advertising repository, under Article 39. The Commission found design features and access barriers, including excessive delays in processing, and missing information, specifically the content and topic of advertisements and the legal entity paying for them. The third is researcher access to public data, under Article 40(12). Here the finding is contractual as much as technical: X's terms of service prohibit eligible researchers from independently accessing public data, including by scraping, and its formal access process imposes unnecessary barriers.

The Commission says the amount was calculated on the nature of the infringements, their gravity measured by affected EU users, and their duration. It does not publish a breakdown by breach. Euronews reported a split of 45 million euros for the checkmark, 35 million for advertising transparency and 40 million for researcher access; that apportionment is the outlet's, not the Commission's.

The deadlines are the operative part. X had 60 working days from 5 December 2025 to tell the Commission what measures it intends to take on the Article 25(1) checkmark finding, and 90 working days to submit an action plan on Articles 39 and 40(12). The European Board for Digital Services then has one month from receiving the action plan to give an opinion, and the Commission a further month to reach a final decision and set an implementation period. Failure to comply may lead to periodic penalty payments.

The background section of the release is what most coverage skipped. The Commission opened formal proceedings against X on 18 December 2023 to assess possible breaches connected to the dissemination of illegal content and to the effectiveness of measures against information manipulation. That investigation, the release states, continues. The same proceedings also covered deceptive design, advertising transparency and researcher data access; the Commission adopted preliminary findings on those three limbs on 12 July 2024, and the non compliance decision of 5 December 2025 closes only those three. Executive Vice President Henna Virkkunen framed the decision as holding X responsible for undermining users' rights and evading accountability. Belgium's digitalisation minister, Vanessa Matz, quoted by the Brussels Times, welcomed it in similar terms.

X is contesting it. The company filed an application at the General Court of the European Union in February 2026, the first judicial challenge to a DSA enforcement decision. Reports of the filing date differ: The Record dated it 20 February 2026 and The Cyber Express 23 February 2026. The grounds, as X describes them, are that the Commission's investigation was incomplete and superficial, that there were grave procedural errors and breaches of the rights of defence, and that the Commission misread X's obligations under the regulation. Those are X's characterisations of its own case and have not been tested. A Commission spokesperson said it would defend its position in court. X has also said publicly that it remains committed to user safety and transparency, a claim the company makes about itself.

Three things are unresolved. Whether X's proposed measures on the checkmark and its action plan on the repository and researcher access have satisfied the Commission has not been announced. Whether the General Court will uphold, reduce or annul the fine will take years, and the case will set the first precedent on how the DSA's penalties are calculated and reviewed. And the 2023 investigation into illegal content and information manipulation, the one most readers assume the fine was about, has produced no decision at all.