European Commission fines X €120 million for transparency violations

The European Commission issued a €120 million fine against X on December 5, 2025, marking the first non-compliance decision under the Digital Services Act. The penalty addresses three distinct violations: deceptive design of the platform's blue checkmark verification system, inadequate transparency in its advertising repository, and failure to provide researchers with access to public data.

According to the Commission's press release, X's implementation of the verification badge deceives users by allowing anyone to purchase verified status without meaningful identity confirmation. "On X, anyone can pay to obtain the 'verified' status without the company meaningfully verifying who is behind the account, making it difficult for users to judge the authenticity of accounts and content they engage with," the Commission stated. This practice exposes users to scams and impersonation fraud while violating DSA obligations that prohibit platforms from falsely claiming user verification when no such verification occurred.

The blue checkmark violation carries significant implications for digital marketers who rely on authentic influencer partnerships and brand safety measures. The EU previously investigated how the Digital Services Act targets American platforms, with particular scrutiny on verification and content moderation systems. X's paid verification model fundamentally altered how users assess credibility on the platform after the company discontinued its previous verification system that required identity confirmation.

The Commission's second finding targets X's advertising repository, which fails to meet DSA transparency requirements that became fully operational for all platforms on February 17, 2024. According to the enforcement decision, X incorporates design features and access barriers that undermine the repository's purpose, including excessive processing delays. The platform's ads repository lacks critical information such as advertisement content, topic classification, and the legal entity financing each campaign.

Accessible ad repositories enable researchers and civil society organizations to detect scams, hybrid threat campaigns, coordinated information operations, and fraudulent advertisements. The advertising transparency deficiency directly impacts the marketing community's ability to analyze competitive campaigns and monitor industry practices. Major platforms provide centralized repositories as advertising oversight intensifies across jurisdictions, making X's inadequate implementation particularly notable.

The Commission emphasized that hindering researcher access prevents independent scrutiny of potential risks in online advertising. While the DSA does not mandate user verification, it clearly prohibits platforms from falsely claiming verification completion when no such process occurred. The regulation distinguishes between offering paid features and misleading users about security measures.

X's third violation involves restricting researcher access to publicly available platform data. According to the decision, the platform's terms of service prohibit eligible researchers from independently accessing public data through scraping methods. X implements processes that impose unnecessary barriers, effectively undermining research into systemic risks within the European Union.

The enforcement action builds upon formal proceedings the Commission opened against X on December 18, 2023, examining whether the platform breached DSA provisions related to illegal content dissemination and information manipulation measures. Those broader investigations continue alongside the transparency violations addressed in this decision. The Commission adopted preliminary findings on the verification, advertising, and data access issues on July 12, 2024, before issuing the final non-compliance decision.

Executive Vice-President Henna Virkkunen stated: "Deceiving users with blue checkmarks, obscuring information on ads and shutting out researchers have no place online in the EU. The DSA protects users. The DSA gives researchers the way to uncover potential threats. The DSA restores trust in the online environment. With the DSA's first non-compliance decision, we are holding X responsible for undermining users' rights and evading accountability."

The €120 million penalty calculation considered the nature of these infringements, their gravity regarding affected EU users, and their duration. X now faces specific compliance deadlines for each violation category. The platform has 60 working days to inform the Commission of measures addressing the deceptive blue checkmark usage under Article 25(1) DSA.

For the advertising repository and researcher data access violations under Articles 39 and 40(12) DSA, X must submit an action plan within 90 working days outlining necessary remedial measures. The Board of Digital Services will have one month from receipt to provide its opinion, followed by another month for the Commission's final decision establishing an implementation period.

Failure to comply with the non-compliance decision may trigger periodic penalty payments. The Commission continues engaging with X to ensure compliance with both the decision and DSA requirements more broadly. The enforcement demonstrates European regulators' willingness to impose substantial financial penalties on major platforms for transparency shortcomings.

The decision arrives amid broader European scrutiny of American technology companies' compliance with digital regulations. The EU previously found TikTok and Meta in breach of DSA transparency rules on October 24, 2025, with potential fines reaching 6% of global annual turnover. Those preliminary findings similarly targeted researcher data access and content moderation transparency.

Platform designation criteria under the DSA require averaging monthly active recipients over six-month periods. The regulation applies to Very Large Online Platforms with more than 45 million monthly users in the European Union, representing 10% of the bloc's population. The court upheld Zalando's designation as a very large online platformaffecting 83 million users under this framework.

U.S. Ambassador to the European Union Andrew Puzder characterized the fine as "excessive" and "the result of EU regulatory overreach targeting American innovation." He stated on December 6: "The Trump Administration has been clear: we oppose censorship and will challenge burdensome regulations that target US companies abroad. We expect the EU to engage in fair, open, & reciprocal trade — & nothing less."

Elon Musk responded to the penalty on December 5, claiming the fine applied "not just on X, but also on me personally, which is even more insane." He suggested applying a response "not just to the EU, but also to the individuals who took this action against me." Texas Senator Ted Cruz described the enforcement as "an abomination" and "an attack on a great American job creator & it's an attack on the free speech of every American."

However, legal experts disputed characterizations of the enforcement as censorship. Daphne Keller, Director of Platform Regulation at Stanford Law School, wrote on LinkedIn that the DSA enforcement involves "normal, boring laws" similar to those existing in the United States or receiving bipartisan support. She explained the blue checkmark violation addresses consumer deception comparable to product labeling misrepresentation, while advertising archive requirements have parallels in Texas, Florida, and California transparency laws that survived First Amendment challenges.

Regarding researcher data access, Keller noted that X unsuccessfully sued researchers for data scraping in U.S. courts, and bipartisan congressional legislation supporting both API and scraping access for research purposes gained support through the Platform Accountability and Transparency Act. "That's it! That's everything X is in trouble for in Europe. It's kind of a nothingburger. It is not about speech," she concluded.

The enforcement reflects intensified European regulatory activity around platform transparency and accountability. Commission spokesperson Thomas Regnier previously emphasized that concrete data demonstrates the DSA's effectiveness in protecting legitimate content, citing 35% success rates for user challenges to content removal decisions by TikTok and Meta during the second half of 2024.

For marketing professionals, the enforcement signals continued regulatory pressure on platforms to maintain comprehensive transparency measures. The advertising repository requirements create compliance obligations that could affect how platforms structure ad libraries and researcher access systems. Google enhanced transparency tools throughout 2025, displaying additional information about entities funding advertisements in response to evolving regulatory expectations.

The DSA's transparency framework extends beyond content moderation to encompass how platforms use data and algorithms for content and advertisement delivery. Researchers' ability to access platform data helps illuminate these mechanisms, potentially leading to better understanding of advertising system function and broader societal impacts.

Technical enforcement mechanisms create compliance complexities for designated platforms operating across European markets. The European Data Protection Board clarified DSA compliance requirements on September 11, 2025, establishing how digital marketers must navigate the complex intersection between the Digital Services Act and General Data Protection Regulation.

The Commission possesses additional enforcement tools beyond financial penalties. In extreme cases, regulators can require payment providers, advertisers, and internet service providers to cease working with platforms, preventing revenue generation or territorial access. The enforcement framework extends beyond the UK's approach by incorporating cross-border coordination mechanisms across all 27 member states for platforms operating in multiple jurisdictions.

Resource requirements for DSA compliance prove substantial. Meta assembled a cross-functional team exceeding 1,000 professionals in 2023 to develop compliance solutions, highlighting the regulatory burden on platforms. Investment levels demonstrate how major technology companies prioritize European regulatory adherence despite operational costs.

The advertising repository deficiency particularly impacts marketing professionals who analyze competitive positioning and campaign strategies. Accessible repositories enable systematic monitoring of competitor spending patterns, creative approaches, and targeting methodologies. X's inadequate implementation limits these research capabilities compared to repositories maintained by Google, Meta, and other major advertising platforms.

The decision establishes precedent for how European regulators interpret and enforce DSA transparency obligations against major platforms. Future enforcement actions may reference this non-compliance decision when addressing similar violations by other designated platforms. The €120 million penalty level signals that transparency shortcomings warrant substantial financial consequences beyond warning letters or preliminary findings.

Platform verification systems affect advertising ecosystems by establishing trust signals that marketers use for influencer partnerships, brand safety assessments, and audience targeting decisions. When verification badges lose credibility through pay-to-verify models without identity confirmation, marketing professionals face increased difficulty distinguishing authentic accounts from impersonation or fraud attempts.

The enforcement timeline demonstrates European regulators' methodical approach to DSA implementation. The Commission opened formal proceedings in December 2023, adopted preliminary findings in July 2024, and issued the final non-compliance decision in December 2025. This two-year investigation period reflects the complexity of evaluating platform compliance with multifaceted transparency requirements.

Timeline

• December 18, 2023: European Commission opened formal DSA proceedings against X examining illegal content dissemination and information manipulation measures
• February 17, 2024: Digital Services Act became fully operational for all platforms across European Union
• July 12, 2024: Commission adopted preliminary findings on X's deceptive design, advertising transparency, and researcher data access violations
• September 11, 2025: European Data Protection Board adopted Guidelines 3/2025 on DSA-GDPR interplay for digital marketers
• October 24, 2025: Commission preliminarily found TikTok and Meta in breach of DSA transparency rules with potential 6% fines
• December 5, 2025: Commission issued €120 million fine against X marking first DSA non-compliance decision
• December 6, 2025: U.S. Ambassador to EU Andrew Puzder characterized fine as regulatory overreach targeting American innovation

Summary

Who: The European Commission imposed penalties on X (formerly Twitter) under Executive Vice-President Henna Virkkunen's authority, affecting the platform's 45+ million EU users and restricting researcher access to public data. Elon Musk and U.S. diplomatic officials criticized the enforcement.

What: A €120 million fine for three distinct Digital Services Act violations: implementing a deceptive blue checkmark verification system allowing paid status without identity confirmation, maintaining an inadequate advertising repository lacking content details and legal entity information, and blocking researcher access to publicly available platform data through restrictive terms of service.

When: The Commission announced the decision on December 5, 2025, following formal proceedings opened December 18, 2023, and preliminary findings adopted July 12, 2024. X has 60 working days to address blue checkmark violations and 90 working days to submit action plans for advertising and researcher access issues.

Where: The enforcement applies throughout the European Union's 27 member states under the Digital Services Act framework that became fully operational February 17, 2024, specifically targeting X's operations affecting EU users and researchers conducting systemic risk assessments.

Why: The Commission acted to enforce DSA transparency obligations that protect users from deception, enable civil society scrutiny of advertising risks, and facilitate research into platform systemic risks. The violations undermined users' ability to judge account authenticity, prevented independent analysis of advertisement financing, and obstructed academic research into content exposure patterns.