Elon Musk’s X has been fined €120 million, or around $140 million, for violating the Digital Services Act’s transparency rules in a landmark piece of enforcement from the European Commission. The site breached the DSA in relation to its misleading blue checkmark system, its lack of information on ad data stored within its platform, and its hindrance of researchers’ access to public data.
The fine, the first of its kind under the EU’s law governing online governance, places X on a strict timeline for compliance and suggests that the Commission is willing to police design decisions and data access — not just content — on the largest online platforms.
Why the EU Acted Under the Digital Services Act Enforcement
The DSA was designed to mitigate systemic risks and increase accountability for platforms of such vast reach. As a Very Large Online Platform, X falls under higher requirements for transparency, user protection, and data access for vetted researchers studying online harms.
Investigators found that X’s practices obscured fundamental signals on which users rely to assess whether or not a result is authentic or advertising, and prevented independent auditing. The Commission stressed that such transparency is not a matter of choice, but rather an obligation required by the DSA.
How the blue checkmark sits at the center of the EU case
Once a badge of identity verification, the blue checkmark became a paid feature after the platform changed hands in ownership, casting doubt on what that icon means in essence.
Regulators contend that the design amounts to an implied verification of account when there has been no such verification, a dark pattern design practice against which the agency specifically warns.
The risks are not theoretical. Impostor accounts that were replicas of brands and public figures proliferated after checkmarks became a paid feature. One widely circulated example was a fake pharmaceutical account that briefly tweeted “insulin is free,” erasing billions from the real company’s market value. And enforcers say such events are proof that interface signals can mislead users — and the markets.
Advertising Accountability and Access to Research
Immediately after the DSA’s enactment, platforms would be required to maintain a public ad repository with substantial information about the content, sponsor, targeting, and delivery of each ad they host. The Commission determined that, with X’s library being too skinny to enable any real check, researchers and watchdogs have been deprived of the systematic information they need to monitor influence campaigns or find organized manipulation.
The law also requires — and numerous VLOPs say that they are allowing — vetted researchers to access public data. X cut off broad API access and replaced it with paywalled, restrictive data tiers, a move that academic groups and the European Digital Media Observatory have said undercuts studying disinformation and election integrity. Regulators have said that DSA requirements are not met by this.
Penalties and Next Steps for X Under the EU DSA
X has 60 business days to develop a plan concerning the blue checkmark’s design and labeling, and 90 days to address issues in its advertising repository as well as revive compliant access for vetted researchers. Missing the deadlines can prompt further daily penalties and higher fines.
The DSA carries penalties of up to 6% of a company’s worldwide annual turnover and periodic penalty payments worth up to 5% of average daily income. X can fight the decision in EU courts, but unless a court suspends enforcement, its clock will keep ticking on compliance.
Broader Signal to Tech Platforms from EU Enforcement
This is a further reminder that EU enforcement continues to go far upstream, even reaching into product design and data transparency. Pressures against other big platforms in recent months — ranging from addictive design features to protections for minors to ad targeting — have signaled a broader move from voluntary pledges of good intentions to binding enforcement and financial repercussions.
For users and advertisers on X, the practical result might be clearer identity labels, a more informative ad library, and reopened avenues for independent research. The message is clear to platforms of all types: if an icon, a setting, or an API gate can mislead or obscure oversight at scale, we’re watching — and now so too are regulators in Europe.
