The EU's first Digital Services Act fine against X was about blue ticks, an ad database and researcher access

The European Commission's first non-compliance decision against a very large online platform under the Digital Services Act landed on 5 December 2025, and it fined X 120 million euros, about 140 million US dollars. The decision is routinely described as Europe taking on Elon Musk's algorithm. It does not do that. The three infringements the Commission actually found concern a paid verification badge, an advertising database and a researcher application form.

The fine was reported as split across the three findings: about 45 million euros for the deceptive design of the verification badge, about 35 million euros for advertising transparency, and about 40 million euros for researcher data access, according to Euronews and to Wikipedia's account of the decision. The Commission itself framed the total as a proportionality calculation sitting well below the 6 per cent of global turnover the regulation permits.

The first finding rests on Article 25 of Regulation (EU) 2022/2065, which governs the design of online interfaces. Writing in Tech Policy Press on 11 February 2026, after the decision text became available, Matteo Fabbri set out what the Commission relied on. X moved from proactive identity verification to selling verified status to paying subscribers, while keeping the visual design of the old badge and, in the Commission's account, taking over the historical assurance value attached to it. Human review of subscribers averaged between 53 and 79 seconds per account. Replies from verified accounts were given algorithmic priority according to subscription tier. A user who wanted to find out what the badge now meant had to pass through three clicks, a pop-up window and a separate help page.

The second finding, under Article 39, concerns the advertising repository. Users could search it only by member state, one at a time, or by advertiser account, or by timeframe. They could not search by the content of an ad or by its targeting parameters. Response times were inflated to roughly three minutes and twenty seconds per report through artificial browser update checks. The most concrete number in the finding is that only 58 per cent of the ads actually shown to French users appeared in the repository at all, which the Commission attributed in part to deleted advertiser accounts taking their ads with them in breach of the one year retention requirement.

The third finding, under Article 40(12), concerns access to public data for researchers studying systemic risk. Between August and November 2023 X offered no dedicated mechanism at all, only a commercial interface costing up to 5,000 US dollars and an unpublicised email address that never approved a request. The free tier returned 1,500 posts a month. After a dedicated application form appeared, no application was approved before 26 January 2024, and by May 2024 some 95.8 per cent had been rejected, on grounds including that the applicant was located outside the European Union. Applicants who did succeed received one million posts a month, and X's terms forbade independent collection methods such as scraping.

What is missing from the decision is the part most people assume the Digital Services Act is for. There is no ruling on recommender systems, on addictive design, or on the handling of illegal content. Fabbri's reading is that proving those would require investigative tools the Commission did not deploy in this case. Euronews reported that two further investigations into X remain open, one on illegal content moderation and one on the role of the platform's algorithm in radicalisation and election interference. TechCrunch reported that X was given 60 days to address the badge and 90 days to produce remediation plans for the advertising and data access findings. Then Vice President JD Vance publicly opposed the fine before it was announced, framing it as a penalty on an American company for refusing censorship.

The enforcement pattern since has stayed on the same ground. On 24 October 2025 the Commission issued preliminary findings that TikTok and Meta had both breached researcher data access obligations, and that Meta's Facebook and Instagram also failed to give users simple ways to report illegal content or to challenge moderation decisions. Confirmed breaches carry exposure of up to 6 per cent of global turnover. Henna Virkkunen, the Commission's executive vice president for tech sovereignty, said platforms must open their systems to scrutiny. A delegated act on data access entered into force on 29 October 2025.

On 24 July 2026 the Commission issued further preliminary findings against TikTok, this time on minors: that accounts belonging to minors can be set to public, and that content posted by 16 and 17 year olds is recommended through the For You feed to any user anywhere. Those findings are preliminary and TikTok has not yet had a final decision against it.

What remains unknown is whether the Commission can prove a recommender system case at all. Nothing published so far shows it has.