The first fine under the Digital Services Act: 120 million euros imposed on X

On Friday 5 December the European Commission adopted its first non-compliance decision under Regulation (EU) 2022/2065, the Digital Services Act, and fined X 120 million euros[1]. The decision closes a part of the proceedings that the Commission opened against X on 18 December 2023, eight months after it designated the platform as a very large online platform on 25 April 2023[2]. It rests on preliminary findings that the Commission sent to X on 12 July 2024[2]. The remaining parts of the proceedings, on the dissemination of illegal content and on the effectiveness of X's measures against information manipulation, stay open[1].

Our generation lives on these platforms, and the three breaches concern three things we need from them: to know who is speaking, to know who is paying, and to let researchers check both.

What the Commission found

The first breach concerns Article 25(1) of the Regulation, which prohibits online interfaces designed to deceive or manipulate users. The Commission finds that X's blue checkmark presents an account as verified while anyone can obtain it by subscription, without any meaningful verification of the account holder. The release states that the Regulation does not require platforms to verify users, and that it prohibits a platform from claiming falsely that it has done so[1]. Anyone can buy the checkmark for 8 dollars a month[3].

The second breach concerns Article 39, which requires very large platforms to keep a public repository of advertisements. The Commission finds that X's repository is hard to access and search, that it processes requests with excessive delays, and that it omits information the Article requires, including the content of the advertisement, its topic and the legal entity that paid for it[1]. The third breach concerns Article 40(12), which requires access to public data for researchers who study systemic risks in the Union. The Commission finds that X's terms of service bar eligible researchers from collecting public data independently, including by scraping, and that its access procedures create unnecessary barriers[1].

Euronews reports that the 120 million euros divide into 45 million for the checkmark, 40 million for researcher access and 35 million for the advertising repository, and that a Commission official explained the amount by proportionality[4]. Article 74(1) of the Regulation allows a fine of up to 6 per cent of the provider's total worldwide annual turnover[5]. The fine is therefore well below the ceiling. The release says that the amount reflects the nature of the infringements, their gravity for users in the Union and their duration[1].

The decision also orders conduct. X has 60 working days to tell the Commission how it will end the infringement of Article 25(1), and 90 working days to submit an action plan for the advertising repository and researcher access. The Board for Digital Services will give an opinion within a month of receiving the plan, and the Commission will then decide whether the plan is sufficient and set a period for implementation. Failure to comply may lead to periodic penalty payments[1]. Henna Virkkunen, the Executive Vice-President for Tech Sovereignty, Security and Democracy, said that "the DSA restores trust in the online environment"[1]. On the same day the Commission accepted commitments from TikTok on its own advertising repository and closed that part of its case[3].

The reaction, and what it tells us

X did not answer the Associated Press[3]. Elon Musk wrote the next day that "the EU should be abolished", with sovereignty returned to the Member States[6]. He then reposted an image of the Union flag peeling away to reveal a swastika, with the caption "The Fourth Reich"[7]. X's head of product, Nikita Bier, replied to the Commission's announcement that X had terminated the Commission's advertising account, on the ground that it had posted a link disguised as a video to boost its reach[7].

The reaction from the United States government came before and after the decision. On 4 December the Vice-President, JD Vance, wrote that the Union should support free speech instead of attacking American companies, and he accused the Commission of fining X for refusing to censor[3]. After the decision, the Secretary of State, Marco Rubio, wrote that "the days of censoring Americans online are over" and called the fine an attack on American platforms and the American people. The Commission spokesperson, Thomas Regnier, answered that the rules target no company and no country[3].

We note what the decision does not do. It does not order the removal of any post. It does not touch Community Notes or any moderation choice. It does not fine X for speech. The three findings concern the honesty of a label, the completeness of an advertising register and the access of researchers to data that is already public. A government that calls this censorship defends the right of a company to sell a verification it does not perform. Article 25(1) raises a consumer protection question, and the Commission has treated it as one.

The weakness of the decision lies elsewhere. Two years passed between the opening of proceedings and the first fine, and the amount is below what a platform of X's size would notice. The open part of the case, on illegal content and information manipulation, concerns the elections our generation votes in, and it still has no date.

What we ask

The Commission should publish the non-confidential version of the decision within the month, with the reasoning on the amount, so that the breakdown reported by the press rests on the Commission's own text[4].

The Commission should set a public deadline for its findings on the open parts of the X proceedings, on illegal content and information manipulation, before the end of the first quarter of 2026[2].

The Member States should instruct their Digital Services Coordinators to monitor X's compliance with the 60 and 90 working day deadlines and to report to the Board for Digital Services. The opinion under the decision would then reflect what users in each Member State see[1].

The Union should answer Washington with the text of the Regulation. The High Representative and the Commission should send the decision to the State Department with the three Articles marked, and should ask which of them restricts speech[3].