EU’s first DSA fine targets X’s verification, advertising and research access

First DSA non-compliance decision

On 5 December 2025, the European Commission issued its first non-compliance decision under the Digital Services Act and fined X €120 million. The decision identified three transparency breaches: the design of the blue-check verification system, shortcomings in the advertising repository, and obstacles to eligible researchers’ access to public data. The Commission’s decision announcement identifies the fine and the three grounds.

The finding about verification concerned a design the Commission considered deceptive; it did not create a blanket requirement that every user verify identity. The decision also did not hold that all content on X was illegal. Its scope was the specified obligations and conduct examined under the DSA, rather than a general adjudication of platform speech.

Transparency obligations as governance rules

The DSA establishes platform duties concerning advertising transparency, access to certain public data for eligible researchers, and regulatory enforcement. The Commission’s action used those governance requirements to address how X designed and administered systems relevant to public scrutiny. It is a regulatory decision against the company, rather than a ruling on an individual user’s private claim. The DSA text sets out the underlying framework.

The advertising repository issue concerns the information made available about advertisements; the researcher-access issue concerns barriers to eligible researchers seeking public data. Neither finding means unrestricted access for every researcher. Together, the three grounds show how transparency obligations can be enforced through a company-level decision and financial penalty.

What the fine establishes

Our analysis: The decision makes transparency duties enforceable through a substantial regulatory fine. Its corporate-governance significance lies in the Commission’s ability to assess specific platform systems and impose consequences when it finds non-compliance. That creates an accountability route focused on institutional design and information access, rather than on proving that particular content caused harm to an individual.

The €120 million penalty is not civil damages payable to users, and the decision does not determine compensation for people harmed by platform activity. Nor does it resolve every question about X’s content or operations. The legally relevant result is narrower: the Commission found three DSA transparency breaches in its first non-compliance decision. The available evidence does not establish an appeal outcome, so no later procedural status should be inferred. The Commission’s account describes the decision; the DSA distinguishes regulatory duties from individual remedies.

The decision is under judicial challenge

The penalty is a regulatory fine, rather than civil damages payable to users. Its three grounds concern specific transparency systems, rather than every question about X’s content or operations. This account reports the Commission’s December 2025 decision under the DSA framework; it does not present that decision as a court determination of individual compensation claims.