Laureline Lemoine is a Senior Associate at AWO. We discussed the European Commission’s first non-compliance decision under the Digital Services Act (DSA) against X. This follows Laureline’s
webinar on the topic with EU DisinfoLab.
Q: Can you introduce the European Commission’s decision against X under the DSA?
Laureline: In December 2025, the European Commission imposed a €120 million fine on X for breaching several of the Digital Services Act’s (DSA) core obligations. This was the EC’s first formal non-compliance decision under the DSA.
The decision is significant for two main reasons. First, it marks a turning point in the enforcement of the DSA. Until now, the Commission had primarily operated in a supervisory capacity, focusing on monitoring compliance and engaging with platforms. This case signals a clear shift toward formal findings of non-compliance and the imposition of financial penalties. It is both the first non-compliance decision and the first fine issued under the DSA.
Second, it provides one of the earliest and most detailed indications of how the Commission will interpret and apply the DSA in practice. The decision therefore provides guidance not only to platforms, but also to regulators, researchers and civil society actors about what kinds of conduct will be considered non-compliant and how evidence will be assessed.
The case focuses on three specific areas: the misappropriation of X’s blue checkmark and account verification system, the functionality of its advertising repository, and its approach to providing data access to researchers. These are all central elements of the DSA’s broader framework for transparency, accountability and user protection.
At the same time, the decision has unfolded in a highly politicised transatlantic context. The DSA has become a focal point for criticism from some U.S. policymakers, who frame it as a form of censorship. European institutions have consistently rejected that characterisation, but the broader political environment is clearly influencing how these enforcement actions are perceived.
This political backdrop has shaped how the decision has been received and even how it became public. Notably, the full decision has not yet been officially published by the Commission and only became accessible after being subpoenaed and released by the U.S. House Judiciary Committee.
Q: What were the main infringements identified by the Commission?
Laureline: The Commission identified three main infringements, all of which relate to provisions that it considers “self-executing”: Article 25(1) on interface design, Article 39 on ad repositories and Article 40(12) on researcher access to data.
The first infringement concerns Article 25(1) and X’s blue checkmark and verification system. Historically, the blue checkmark signified that an account had been verified as authentic and notable such as public figures, journalists and organisations. Under X’s new model, the checkmark is tied to a paid subscription. The Commission found that this redesign misappropriates the historical meaning of the verification badge and departs from cross-industry standards, thereby misleading users about the authenticity and reliability of accounts.
The Commission’s reasoning is particularly detailed here. It points to the persistence of legacy visual cues, the lack of clear information about the meaning of the badge, and the role of algorithmic amplification in promoting paid accounts. It also highlights evidence that malicious actors were able to exploit the system, including in areas such as financial fraud.
The second infringement concerns Article 39, which requires very large online platforms to provide a functional and accessible ad repository. The Commission found that X’s repository was effectively unusable: it lacked meaningful search functionality, did not allow multi-criteria queries, omitted required information, and suffered from reliability issues. These shortcomings undermined the very purpose of the provision, which is to ensure transparency around online advertising.
The third infringement relates to Article 40(12), which governs access to platform data for researchers. The Commission found that X dismantled its previous academic access programme and replaced it with a restrictive and largely ineffective system. It imposed fees, applied overly narrow eligibility criteria, rejected the vast majority of applications, and failed to provide meaningful communication or justification for those rejections.
Q: What were the implications of the Commission focusing its decision on ‘self-executing’ provisions, and what happens next?
Laureline: This case focuses on relatively “easy” and straightforward infringements as these provisions are self-executing. This means infringements are clear, can be factually well-documented, and legally unambiguous, which is not the case for all DSA provisions. For example, the risk assessment obligation under Article 34 presents greater complexity.
On this basis, the Commission explicitly rejected X’s argument that the absence of detailed guidance created legal uncertainty. The Commission emphasised that its power to issue guidance is discretionary, and that these ‘self-executing’ provisions are binding as written and do not depend on further clarification.
The Commission adopted a proportional approach to the evidence, arguing that this category of obligation should not require an excessive burden of proof, drawing on analogies with consumer protection law, where misleading practices can be assessed based on the perspective of the average user, without requiring exhaustive technical evidence. At the same time, the Commission stressed that evidence must be methodologically sound and factually relevant. It relied on a combination of its own observations, expert input, platform documents and third-party research. Notably, civil society reports, complaints and interviews played a significant role in supporting its findings.
The Commission used this framing to justify a relatively assertive enforcement posture. It found that X acted intentionally or, at a minimum, negligently, stressing that a platform of its size and experience cannot claim ignorance of clear legal obligations. This finding was central to the imposition of a financial penalty.
In calculating the €120 million fine, the Commission drew on established principles from EU competition law, including the concept of a “single economic unit.” This allowed it to take into account the broader corporate structure surrounding X, rather than limiting the assessment to a single legal entity. It also assessed the seriousness of the infringements by reference to their nature, scope, and impact. It found that the interface design infringement was particularly serious because it directly deceives users, while the other infringements undermined the effectiveness of the DSA as a whole. It also considered the widespread use of X in the EU and the need for deterrence.
This approach has important implications. It suggests that, at least for certain types of infringements, the Commission is willing to act decisively on the basis of publicly observable evidence. It also confirms that external actors, such as researchers and civil society organisations, can meaningfully contribute to enforcement.
Procedurally, the case now moves to the EU courts, as X has appealed the decision. This process is likely to take significant time. In the meantime, X is required to comply with the decision, and already paid the fine or provided a financial guarantee. The Commission also retains the power to impose periodic penalty payments if X fails to comply, and in extreme cases, to pursue further enforcement measures. However, some of these more drastic tools, such as access restrictions, are subject to very high thresholds and are unlikely to be used in this context. A last-resort enforcement measure such as a ban can only be deployed for criminal offences posing a threat to life or safety of persons, which is not the case for the infringements in this case.
Q: What are the broader implications of this decision for DSA enforcement and the role of civil society?
Laureline: This decision demonstrates that the Commission can identify and sanction clear violations using relatively accessible forms of evidence.
It also highlights the importance of selecting cases strategically. By focusing on provisions that are self-executing and factually straightforward, the Commission was able to establish an early precedent without becoming entangled in more complex or contested areas of the law.
Another important implication concerns the role of third parties. The decision shows that civil society organisations and researchers can play a meaningful role in enforcement by documenting non-compliance and providing methodologically sound evidence. Because these types of infringements are observable without access to confidential data, external actors can help bridge the information gap between platforms and regulators.
At the same time, the case raises open questions about the future of DSA enforcement. It remains to be seen how the courts will respond to the Commission’s reasoning, how the Commission will approach more complex obligations, and whether enforcement will remain consistent in a politically charged environment.
