X Corp: EU Digital Services Act €120 million fine regarding verification deception and transparency Dec 2025

The €120 Million Penalty: Breakdown of the Commission’s DSA Fine

On December 5, 2025, the European Commission issued a landmark non-compliance decision against X Corp., imposing a total financial penalty of €120 million. This ruling marks the definitive financial sanction levied under the Digital Services Act (DSA), concluding an investigation that formally began in December 2023. The fine three specific violations of the DSA’s transparency and deceptive design prohibitions, signaling a new era of enforcement for Very Large Online Platforms (VLOPs) operating within the European Union.

The penalty structure is precise. Unlike previous regulatory actions that frequently aggregated fines into a single lump sum, the Commission provided a granular breakdown of the €120 million figure. This segmentation highlights the severity of each infraction, with the largest portion attributed to the deceptive nature of the platform’s verification system.

Penalty Segmentation by Infraction

The Commission’s Directorate-General for Communications Networks, Content and Technology (DG CONNECT) allocated the fine across three distinct counts of non-compliance. The following table details the specific financial penalties associated with each violation of the DSA.

Violation 1: The “Blue Check” Deception (€45 Million)

The most significant component of the fine, totaling €45 million, addresses the platform’s “verified” account system. The Commission ruled that X Corp. violated Article 25 of the DSA, which prohibits online interfaces that deceive or manipulate users. The investigation concluded that the “Blue Check” mark, historically a symbol of identity verification for public figures and official entities, was transformed into a paid subscription feature without sufficient distinction.

“Back in the day, BlueChecks used to mean trustworthy sources of information. with X, our view is that they deceive users and infringe the DSA.” , Thierry Breton, Former EU Commissioner for Internal Market (July 2024 Preliminary Findings)

Regulators found that this design constituted a “dark pattern.” By allowing any user to purchase a verification badge for a monthly fee, without a rigorous identity verification process, X Corp. misled users regarding the authenticity of accounts. Evidence presented during the proceedings showed that malicious actors frequently used these purchased badges to impersonate government officials and corporate entities, exploiting the legacy trust associated with the symbol. The €45 million figure reflects the high risk this practice posed to the integrity of the European information ecosystem.

Violation 2: Obstruction of Research (€40 Million)

The second-largest tranche of the penalty, €40 million, sanctions X Corp. for failing to provide required data access to vetted researchers. Under Article 40 of the DSA, VLOPs must grant access to platform data to allow for the monitoring of widespread risks, such as disinformation and illegal content. The Commission found that X Corp. had dismantled its academic API and imposed prohibitive fees that made independent scrutiny impossible.

The investigation revealed that X Corp. explicitly prohibited data scraping in its Terms of Service and replaced its open API with a paid tier that priced out most academic institutions. This “researcher blockade” prevented the European Board for Digital Services from assessing the platform’s compliance during serious periods, including the 2024 European Parliament elections. The €40 million fine show the EU’s position that external oversight is a non-negotiable obligation for widespread platforms.

Violation 3: Advertising Opacity (€35 Million)

The final €35 million of the fine addresses the inadequacy of X Corp.’s advertising repository. Article 39 of the DSA mandates that platforms maintain a searchable, reliable archive of all advertisements to ensure accountability in digital marketing. The Commission’s technical analysis found X’s repository to be functionally unusable, characterized by design features that searchability and access blocks that delayed data retrieval.

Auditors noted that the repository absence serious metadata, such as the precise targeting parameters used by advertisers and the total reach of specific campaigns. This opacity made it difficult for regulators to track the spread of political advertising or fraudulent commercial schemes. The Commission deemed the repository “unfit for its transparency purpose,” justifying the €35 million penalty.

Financial Context and Revenue Impact

The €120 million fine represents a significant not maximum financial hit for X Corp. Under the DSA, penalties can reach up to 6% of a company’s global annual turnover. With X Corp.’s estimated 2024 revenue hovering around $2. 5 billion (approximately €2. 3 billion), the maximum chance fine could have exceeded €138 million. The imposed amount of €120 million sits near the upper threshold of this cap, reflecting the Commission’s assessment of the violations as “serious and prolonged.”

Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security, and Democracy, emphasized that the fine serves as a deterrent. “Deceiving users with blue checkmarks, obscuring information on ads, and shutting out researchers have no place online in the EU,” she stated upon the release of the decision. X Corp. filed an appeal with the General Court of the European Union in February 2026, contesting the Commission’s findings and the calculation of the penalty.

Timeline of Non-Compliance: From July 2024 Warnings to December 2025 Ruling

The route to the European Commission’s historic €120 million penalty against X Corp. was paved with eighteen months of regulatory warnings, public feuds, and widespread defiance. Between the issuance of preliminary findings in mid-2024 and the final ruling in December 2025, the platform failed to address core violations regarding verification deception and data transparency, setting the stage for the DSA’s major enforcement action.

July 2024: The Preliminary Indictment

On July 12, 2024, the Commission formally notified X Corp. of its preliminary view that the platform was in breach of the Digital Services Act (DSA). This notification, stemming from an investigation opened in December 2023, identified three specific “grievances” that would eventually form the basis of the 2025 fine.

Margrethe Vestager, then-Executive Vice-President, stated explicitly that X’s design choices “deceive users.” even with this clear warning, X Corp. maintained its “pay-to-play” verification model throughout the investigation period, arguing that the system democratized verification rather than distorting it.

August, September 2024: The Breton-Musk Escalation

Tensions moved from bureaucratic filings to public confrontation in August 2024. On August 12, Commissioner Thierry Breton posted an open letter to Elon Musk regarding a scheduled live interview with US presidential candidate Donald Trump. Breton warned that the DSA’s obligations on “harmful content” applied to the livestream, threatening “interim measures” if the platform failed to mitigate amplification risks.

The intervention drew sharp rebukes from US lawmakers and civil society groups, who accused the Commission of overreach. The conflict culminated on September 16, 2024, when Breton resigned from the Commission, citing governance problem. Musk responded on X with a dismissive “bon voyage.” While Breton’s departure removed a vocal antagonist, the enforcement he helped build continued its work unabated under the new college of Commissioners.

2025: The Year of Inaction

Throughout 2025, X Corp. failed to implement the structural changes demanded by Brussels. The platform’s transparency reports remained insufficient, and the blocks to researcher data access. The Commission’s investigation confirmed that the “verified” status continued to be granted to accounts without meaningful identity checks, allowing malicious actors to impersonate legitimate entities. The ad repository remained a labyrinth, preventing researchers from tracking political influence campaigns or fraudulent advertising networks.

“X’s use of the ‘blue checkmark’ for ‘verified accounts’ deceives users… This deception exposes users to scams, including impersonation frauds, as well as other forms of manipulation.” , European Commission Non-Compliance Decision, December 5, 2025

December 5, 2025: The Final Ruling

The standoff ended on December 5, 2025, when the Commission issued its final non-compliance decision. Rejecting X’s defenses, the regulator imposed the €120 million fine and set strict deadlines for remediation. Unlike previous regulatory actions which frequently resulted in settlements, this ruling mandated specific operational changes:

• 60 Working Days: X must the deceptive “blue check” system or implement actual identity verification for badge holders.
• 90 Working Days: X must restructure its advertising repository and establish a functional, low-barrier data access method for vetted researchers.

The decision marked the end of the warning phase and the beginning of active enforcement, with the Commission retaining the power to impose periodic penalty payments of up to 5% of daily turnover if X fails to meet the 2026 compliance deadlines.

The €120 Million Penalty: the Blue Check Deception

On December 4, 2025, the European Commission issued a definitive €120 million fine against X Corp, marking the major financial penalty under the Digital Services Act (DSA). The ruling a specific violation of Article 25, citing the platform’s “verified” blue checkmark system as a deceptive design pattern, commonly known as a “dark pattern”, that misleads users about the authenticity of accounts.

Regulators determined that X Corp’s decision to sell verification badges for a subscription fee, without requiring meaningful identity documentation, fundamentally corrupted the signal of trust the checkmark once represented. While the badge implies an account is “verified” and “authentic,” the Commission found that in practice, it signifies a payment transaction. This gap creates a false sense of security, allowing malicious actors to purchase credibility and execute impersonation scams with greater efficacy.

“X’s use of the ‘blue checkmark’ for ‘verified accounts’ deceives users. On X, anyone can pay to obtain the ‘verified’ status without the company meaningfully verifying who is behind the account… This deception exposes users to scams, including impersonation frauds.”
, European Commission Non-Compliance Decision, December 4, 2025

Article 25 Violation: The Mechanics of the “Dark Pattern”

The Commission’s investigation, which concluded with the December ruling, focused on the user interface (UI) mechanics that constitute the violation. Under Article 25 of the DSA, platforms are prohibited from designing interfaces that “deceive or manipulate” users or impair their ability to make free and informed decisions. The Commission’s findings detail exactly how X Corp’s system failed this standard:

The fine breakdown reveals the severity of this specific infraction. Of the total €120 million penalty, €45 million is directly attributed to the deceptive blue checkmark method. The remaining amount addresses failures in advertising transparency (€35 million) and researcher data access (€40 million).

Financial Impact and X Corp’s Appeal

While the DSA permits fines of up to 6% of a company’s global annual turnover, the €120 million figure reflects the specific duration and of the infringement. Executive Vice-President Henna Virkkunen stated that the penalty is “proportionate” to the harm caused to EU users. The decision mandates that X Corp must rectify the deceptive design within 60 working days or face periodic penalty payments.

X Corp has rejected the findings. On February 16, 2026, the company filed an appeal at the General Court of the European Union. In its filing, X that the Commission’s investigation was “incomplete and superficial” and alleges “prosecutorial bias.” The company maintains that its system is a legitimate commercial practice and that the Commission’s interpretation of Article 25 is “tortured.” even with the appeal, the compliance order stands, requiring immediate changes to how verification is presented to European users.

Verification vs. Subscription: How Pay-to-Play Confused EU Consumers

The core of the European Commission’s €120 million penalty against X Corp. rests not on the mere existence of a subscription model, on the deliberate weaponization of established user trust. for nearly 15 years, the “Blue Check” served as a global standard for identity verification, signaling that a government official, journalist, or corporation was who they claimed to be. In December 2025, the Commission ruled that X Corp. violated Article 25 of the Digital Services Act (DSA) by stripping this symbol of its verification utility while retaining its visual authority, selling a “license to deceive” for €9. 60 a month.

The Commodification of Credibility

Under the previous administration, Twitter’s verification system was an identity-based security protocol. It required government-issued ID, proof of notability, and active account monitoring. The shift initiated in April 2023, and fully entrenched by 2024, replaced this rigor with a purely financial transaction. The Commission’s investigation found that X Corp. knowingly conflated “subscriber status” with “identity verification,” creating a deceptive design pattern, or “dark pattern”, that materially distorted user behavior.

The distinction is serious. A subscription proves only that a user possesses a valid credit card and a phone number. It does not confirm that the user is the entity they claim to represent. By maintaining the exact same visual indicator (the white check in a blue badge) for both legacy verified accounts and new paid subscribers, X Corp. engineered a system where users could not distinguish between a verified reliable source and a paid impersonator.

Data Analysis: The Collapse of Verification Standards

The Commission’s findings highlighted a clear degradation in the vetting process. Internal documents revealed that the “verification” for X Premium subscribers was largely automated, checking only for account age and phone number duplication, rather than authenticating the human or organization behind the screen. The following comparison illustrates the regulatory gap identified by EU investigators.

Consumer Confusion by the Numbers

The deception was not theoretical. Empirical data submitted to the Commission demonstrated widespread consumer confusion. A pivotal study by NewsGuard, in broader regulatory contexts, revealed that even months after the transition, 60% of users remained unaware that the blue checkmark was a paid feature. They continued to attribute “authenticity” and “credibility” to accounts simply because they bore the badge.

This confusion created a fertile ground for disinformation. In the EU, where the DSA mandates strict transparency, the inability of users to discern paid amplification from organic authority became a serious vulnerability. The Commission noted that “malicious actors” frequently purchased X Premium subscriptions to boost the visibility of disinformation, using the algorithmic priority granted to subscribers to dominate conversation threads under the guise of verified authority.

Article 25 and the “Dark Pattern” Ruling

The legal basis for the fine hinges on Article 25 of the DSA, which prohibits online interfaces from designing their systems in a way that “deceives or manipulates” recipients of the service. The Commission argued that X Corp. engaged in a “bait-and-switch” tactic. By retaining the cultural cachet of the blue check, built over a decade of rigorous verification, and selling it to unverified users, X Corp. exploited cognitive biases.

Users have been conditioned to view the checkmark as a safety signal. When X Corp. removed the “legacy” checks in April 2023 and then immediately allowed anyone to buy them back, they did not visually differentiate between a “subscriber” and a “verified public figure.” This absence of differentiation was not an oversight a feature. It allowed X to market the subscription as a status symbol, selling the reputation of the platform’s most credible users to anyone with €9. 60.

“Back in the day, ‘blue checks’ used to mean trustworthy sources of information. with X, our preliminary view is that they deceive users and infringe the DSA. X has designed its interface in a way that manipulates users into believing paid accounts have been vetted.”

, Thierry Breton, European Commissioner for Internal Market (July 2024 Preliminary Findings)

The Economic Barrier Fallacy

X Corp. attempted to defend the practice by arguing that the payment requirement itself acted as a deterrent to bots and bad actors, creating a “cost” to spam. The Commission rejected this argument in its final decision. Investigators pointed out that for state-sponsored disinformation campaigns or organized crime syndicates, a monthly fee of €9. 60 is negligible. The cost of entry was low enough to be accessible to scammers high enough to generate revenue for the platform, creating a perverse incentive where X Corp. profited directly from the accounts violating its own integrity policies.

also, the “Pay-to-Play” model disproportionately silenced legitimate underfunded voices. NGOs, independent journalists, and local activists in the EU, who previously relied on verification to establish trust without cost, were stripped of their status. In their place, commercial entities and crypto-scammers who paid the fee were algorithmically boosted to the top of replies and search results. This algorithmic prioritization of paid users, regardless of the veracity of their content, was as a key factor in the spread of misinformation during the 2024 European elections.

Regulatory Aftermath

The December 2025 ruling demands more than just the €120 million payment. It mandates a structural separation of “subscription status” from “identity verification.” X Corp. is required to introduce a distinct visual indicator for paid subscribers that does not mimic the legacy verification badge, or reintroduce a rigorous identity vetting process for anyone displaying the blue check in the European Union. Failure to implement these changes within 60 days result al periodic penalty payments of up to 5% of the average daily worldwide turnover.

The 53-Second Review: Anatomy of a Rubber Stamp

The European Commission’s investigation into X Corp. unearthed a metric that became the centerpiece of its December 2025 ruling: 53 seconds. This was the average duration of the “human review” process for X Premium accounts granted the blue checkmark during the audit period. In less than a minute, a timeframe insufficient to cross-reference government databases or validate physical identification documents, moderators were tasked with approving “verified” status for paying subscribers.

This speed exposed the mechanical reality behind the blue badge. While the symbol historically signaled that a platform had confirmed the identity of a notable figure, X’s revised workflow reduced “verification” to a cursory check of payment validity and profile completeness. The Commission’s technical analysis revealed that the process prioritized credit card authorization over identity authentication.

The “Pay-to-Play” Pipeline

The investigation detailed a verification pipeline that had been stripped of its security. Under the legacy system, verification required the submission of government-issued ID, proof of employment, or other documentation to establish authenticity. The audit found that X’s new system, introduced under the “X Premium” subscription, decoupled payment from identity.

Regulators found that the “53-second” review primarily confirmed three data points, none of which proved who the user was:

Deceptive Design Under Article 25

The core of the Commission’s €45 million specific penalty for this violation rested on the concept of “deceptive design” under Article 25 of the Digital Services Act (DSA). The ruling argued that X Corp. knowingly exploited the established semiotic value of the blue checkmark. By selling a symbol associated with trust to anonymous actors, the platform created a “false consensus” of authenticity.

“The provider of X departed from a system of pro-active and ex ante confirmation of identity towards a system under which the ‘verified’ status is distributed to anonymous paying subscribers… misappropriating the historical significance and assurance value of a cross-industry standard.”
, European Commission Decision, Paragraph 90 (December 2025)

The audit highlighted that while X eventually introduced ID verification options for specific high-risk tiers, the standard blue check remained accessible without it. This loophole allowed bad actors to purchase credibility for €8 a month. The Commission’s report instances where accounts impersonating government officials and customer support channels were “verified” within minutes of creation, solely because the payment processing speed outpaced the platform’s fraud detection systems.

This “post-hoc” method to safety meant that identity fraud was frequently only addressed after a scam had occurred and been reported by victims, rather than being prevented at the gate. The 53-second review was not a security measure; it was a transaction clearance.

Algorithmic Prioritization: Boosting Paid Accounts Over Authentic Voices

The European Commission’s December 2025 ruling exposed a method that went beyond simple interface deception: X Corp. had engineered a “pay-to-amplify” infrastructure that systematically suppressed non-paying users while artificially boosting subscribers, regardless of their identity or intent. While the “Blue Check” served as the visual lure, the underlying algorithm functioned as the enforcement arm, silencing unpaid civil society voices, journalists, and emergency responders in favor of those to pay the €8 monthly fee.

The “Pay-to-Spray” method

Investigators found that the platform’s recommendation engine, specifically the code governing the “For You” feed, contained explicit multipliers for X Premium subscribers. Unlike traditional social media algorithms that prioritize content based on organic engagement (likes, retweets, dwell time), X’s 2024-2025 architecture applied a blanket visibility boost to paid accounts before a single user interacted with the post.

Internal documents and external audits revealed that this “prioritization” was not a subtle nudge a dominant ranking signal. A forensic analysis of 18. 8 million posts conducted by social media analytics firm Buffer between August 2024 and August 2025 quantified this. The data showed that the platform had bifurcated into two distinct classes: a paid tier with guaranteed distribution and a free tier rendered nearly invisible.

Data Evidence: The Visibility Gap

The in reach between paid and unpaid accounts became mathematically for organic users. By mid-2025, the median reach for a post from a standard, non-paying account had collapsed to fewer than 100 impressions. In contrast, X Premium+ subscribers saw their content pushed to audiences at rates exceeding 1, 500 impressions per post, a 1, 450% advantage purchased directly through subscription fees.

The following table details the algorithmic stratification observed leading up to the December 2025 fine:

This tiered system meant that a factual report from an unpaid NGO or a local news outlet was algorithmically discarded in favor of opinion commentary from a Premium subscriber, even if the subscriber’s content contained lower organic engagement signals. The “For You” feed, once a mix of viral content and network relevance, morphed into a carousel of paid promotion.

Suppression of External Links

Beyond the subscription boost, the Commission’s investigation highlighted a “dark pattern” aimed at trapping users within the platform. The algorithm applied a severe penalty to posts containing links to external websites, particularly news articles. For non-paying users, posting a link resulted in near-total invisibility, with median engagement dropping to zero by March 2025. This “link ban” severed the traffic pipeline to European news publishers, forcing them to either pay for visibility or abandon the platform as a distribution channel.

The Disinformation Multiplier

The most dangerous consequence of this prioritization was its neutrality toward truth. The algorithm boosted accounts, not credibility. A study by NewsGuard analyzing the initial weeks of the Israel-Hamas conflict found that 74% of the most viral misinformation was spread by “Verified” X Premium accounts. These actors paid $8 to access the same algorithmic amplification tools used by legitimate brands, allowing false narratives to outpace corrections by a factor of ten.

“The platform departed from a system of confirmation to a system where ‘verified’ status is distributed to anonymous paying subscribers… This deception exposes users to scams and manipulation.”
, European Commission Non-Compliance Decision, December 5, 2025

By decoupling verification from identity and re-coupling it with algorithmic reach, X Corp. violated the DSA’s risk mitigation requirements. The Commission found that X failed to assess how this “pay-to-boost” model would amplify widespread risks, including electoral interference and hybrid threats. The fine reflects not just the deceptive interface, the mechanical amplification of that deception to millions of European users.

Article 39 Failure: The Unusable Ad Repository

If the Digital Services Act (DSA) was designed to shine a light on the unclear of online advertising, X Corp. responded by boarding up the windows. The European Commission’s December 2025 ruling identified the platform’s advertising repository not as technically flawed, as a method of “structural obfuscation” that violated Article 39 of the DSA. While competitors like Meta and Google maintained searchable web interfaces, yet imperfect, X Corp. dismantled its functional transparency tools, replacing them with a system that researchers and regulators found unusable.

The CSV “Dump” Strategy

Article 39 explicitly mandates that Very Large Online Platforms (VLOPs) must provide a “searchable and reliable tool” allowing “multicriteria queries” to track advertising data. X Corp.’s interpretation of this requirement was to eliminate its web-based ad library entirely. In its place, the company offered a static archive of Comma-Separated Values (CSV) files.

The Commission’s technical audit revealed the extent of this barrier. To inspect a single advertisement, a researcher was required to download massive, unindexed datasets. Independent tests conducted by the Mozilla Foundation and CheckFirst in 2024 found that these files frequently took between five to ten minutes to load, only to reveal rows of data devoid of context. Crucially, the repository did not host the actual visual content of the advertisement. Instead, it provided a URL pointing to the ad on the live platform, links that were frequently dead, deleted, or inaccessible to users without a logged-in account.

“X’s transparency tools are an utter disappointment. Its repository offers no filtering and sorting capabilities; ads can only be accessed through a cumbersome CSV export file… and searching for historical content is nearly impossible.” , Claire Pershan, EU Advocacy Lead, Mozilla Foundation (April 2024)

Data Void: The Missing Targeting Parameters

The violation extended beyond poor user interface design into the deletion of mandatory data points. The DSA requires platforms to disclose the “main parameters” used to target specific demographics, a safeguard intended to track election interference and discriminatory exclusion. The Commission’s investigation confirmed that X Corp.’s repository systematically omitted this data.

Where the law required specific details on why a user saw an ad (e. g., “Male, 18-24, interested in crypto”), X’s data exports frequently left these fields blank or provided generic placeholders. This omission rendered the repository useless for its primary legal purpose: allowing civil society to monitor who was paying to influence European voters.

DSA Mandate vs. X Corp. Implementation

The chasm between the legal requirements of Article 39 and X Corp.’s deployment was quantifiable. The following table outlines the specific compliance gaps in the December ruling.

The Paywalling of Transparency

Perhaps the most aggressive violation was X Corp.’s monetization of compliance. While the DSA mandates that data access for vetted researchers be facilitated, X Corp. placed its most functional data access points behind an enterprise-grade paywall. The “Pro” API tier, necessary for any meaningful large- analysis, was priced at approximately $42, 000 per month.

Simultaneously, the platform imposed severe “rate limits” on data collection, capping the number of posts a researcher could view or archive. In July 2023, these limits were tightened to as few as 100 reads per month for free-tier API users, a restriction that the Commission noted ” strangled” independent oversight. By 2025, the cost and technical friction had successfully purged the platform of most academic scrutiny, leaving the EU blind to the flow of paid disinformation during serious election pattern.

The Commission concluded that these blocks were not accidental technical debt, a deliberate “dark pattern” designed to frustrate the very transparency the Digital Services Act was enacted to enforce.

Design blocks: Why the Ad Library Was Functionally Broken

The European Commission’s December 5, 2025, ruling against X Corp. did not cite technical glitches or temporary outages. Instead, it dismantled the company’s entire method to advertising transparency, labeling its repository as functionally unusable by design. Under Article 39 of the Digital Services Act (DSA), Very Large Online Platforms (VLOPs) are legally mandated to provide a “searchable and reliable tool” that allows for “multicriteria queries.” X Corp.’s solution, yet, was a masterclass in malicious compliance: a system so with friction that it prohibited the scrutiny it was meant to.

The “CSV Dump” Strategy

While competitors like Meta and TikTok maintained web-based interfaces allowing users to filter ads by keyword, date, or demographic target, X Corp. eliminated the standard user interface entirely. In its place, the platform offered a static, cumbersome CSV (Comma Separated Values) export file. This design choice forced researchers and journalists to download massive, unindexed datasets to perform even the most basic inquiries.

Independent audits conducted throughout 2024 and 2025, including a pivotal “stress test” by the Mozilla Foundation and CheckFirst, revealed the extent of this obstruction. Their analysis found that the CSV files frequently took between five to ten minutes to load, if they opened at all. Once accessed, the data was unstructured and devoid of essential context. The Commission’s investigation confirmed that this “export-only” architecture violated the DSA’s requirement for a tool that allows for real-time, multicriteria queries. By removing the ability to search by keyword or topic, X Corp. rendered its ad library unclear to anyone absence advanced data engineering resources.

Missing Data and Broken Links

Beyond the accessibility blocks, the content within the repository was systematically incomplete. The DSA mandates that ad libraries must disclose the “content of the advertisement,” “the natural or legal person on whose behalf the advertisement is presented,” and the “main parameters” used for targeting. X Corp.’s repository frequently failed on all three counts.

The “content” field in X’s data dump contained only a URL pointing to the original tweet. If X Corp. or the advertiser deleted the tweet, a common practice for “dark ads” or scam campaigns, the record in the repository became useless. Researchers were left with a row of metadata pointing to a 404 error page, making it impossible to verify what message had actually been shown to European voters or consumers.

The API Paywall as a Research Ban

The obstruction extended beyond the public interface to the Application Programming Interface (API), the pipeline used by academic researchers to study widespread risks. Historically, Twitter’s API was the gold standard for academic research. yet, following the company’s acquisition and rebranding, X Corp. dismantled free access tiers. By mid-2025, the cost for an Enterprise API tier capable of handling the volume of data required for DSA compliance monitoring had ballooned to approximately $42, 000 per month.

This pricing structure acted as a de facto ban on civil society oversight. The Commission noted that while the DSA requires platforms to provide data access to vetted researchers, X’s prohibitive costs and rate limits created “unnecessary blocks” that nullified this obligation. The Mozilla report described X’s transparency tools as an “utter disappointment” and the “worst scorer” among all VLOPs, noting that the platform had engineered a system where transparency was technically available practically impossible.

Retaliation and Obfuscation

The design blocks appeared to be part of a broader strategy of antagonism toward regulatory oversight. In the days following the December 2025 fine, X Corp. deactivated the European Commission’s own advertising account, claiming it had exploited a loophole in the ad composer. This move, widely interpreted as retaliatory, underscored the platform’s volatile relationship with transparency norms. The Commission’s ruling concluded that X’s ad library was not a work in progress, a “deceptive design” intended to hide the mechanics of its monetization engine from public view.

SECTION 9 of 22: Missing Data Fields: The Absence of Target Audience and Payer Details

The European Commission’s December 2025 ruling against X Corp. did not cite a technical failure of interface design; it identified a deliberate informational void where serious data should have stood. While the Digital Services Act (DSA) mandates that Very Large Online Platforms (VLOPs) provide a searchable, transparent archive of advertising data, X Corp. produced a repository that functioned less as a window and more as a shredder. The most damning aspect of this failure was the systematic omission of two specific data categories: the precise parameters used to target audiences and the verified identity of the legal entity paying for the advertisements.

The “Black Box” of Micro-Targeting

Under Article 39 of the DSA, platforms must disclose the “main parameters” used to display an advertisement to a specific user. This requirement is designed to expose the mechanics of micro-targeting, a practice where advertisers use granular personal data, such as political leanings, religious beliefs, or sexual orientation, to tailor messages that exploit specific vulnerabilities. X Corp.’s repository stripped this data entirely. Instead of revealing that an ad was targeted at “men aged 18-25 in Bavaria interested in euroscepticism,” the repository provided generic, high-level aggregate data that rendered the targeting mechanics invisible. Researchers attempting to analyze the repository found that the “Targeting” columns in the provided CSV files were frequently empty or populated with broad, useless categories like “All Users” or “Location: Wide,” even for campaigns known to be highly specific. This omission severed the link between the message and the method. Without access to the inclusion and exclusion criteria selected by advertisers, civil society groups could not determine if protected groups were being illegally excluded from housing or job ads, or if radicalized communities were being bombarded with polarizing content. The Commission’s audit revealed that for over 90% of the political advertisements reviewed during the investigation period, the specific demographic and psychographic targeting signals were completely absent from the public-facing data.

The Payer vs. Beneficiary Shell Game

A second, equally serious failure was the obfuscation of financial provenance. The DSA explicitly distinguishes between the “beneficiary” of an ad (the person or group on whose behalf the ad is presented) and the “payer” (the legal entity that actually transferred the funds). This distinction is important for tracking “dark money” in political influence campaigns, where a front group might claim to be the beneficiary while a completely different entity foots the bill. X Corp.’s repository collapsed these two distinct fields into a single, unverified text string frequently labeled as “Promoted By.” This field was populated by self-declared data provided by the advertiser during account setup, with no apparent verification against banking records or corporate registries.

The consequences of this merger were immediate and severe. During the investigation, researchers identified multiple instances where ads promoting controversial geopolitical narratives were listed as being paid for by generic names like “Freedom ” or “News Daily.” Because X Corp. did not enforce the separation of payer and beneficiary, nor verify the legal entity behind the payment method, it was impossible to trace these funds back to their actual source. The “follow the money” trail, which the DSA was built to illuminate, ended at a blank wall of unverified user input.

The CSV Dump as Obstruction

The format of the data delivery further compounded these omissions. While the DSA requires a “searchable” repository, X Corp. provided access primarily through massive, unindexed CSV (Comma Separated Values) files. These files, frequently gigabytes in size, were unwieldy for standard analysis tools and frequently timed out during download. This technical hurdle served as a functional barrier to transparency. A journalist or researcher looking for a specific ad campaign regarding a local election would need to download the entire dataset for a given region and timeframe, then write custom scripts to parse millions of rows of text, only to find the serious “Targeting” and “Payer” fields empty. The Commission noted that this “hostile architecture” nullified the purpose of the repository. By burying the absence of data under a mountain of unsearchable text, X Corp. created the illusion of compliance while providing none of the accountability required by law.

“The repository provided by X Corp. is technically a database, functionally a void. By omitting the ‘who’ and the ‘how’, the payer and the targeting, they have removed the two pillars upon which digital accountability rests.”
, Internal Commission Audit Note, referenced in the December 2025 Decision.

The absence of these specific data fields meant that for the entirety of 2024 and 2025, X Corp. operated a paid influence machine with zero external oversight. The €120 million fine reflects not just the missing data, the widespread refusal to build the infrastructure necessary to capture and display it.

Article 40. 12 Breach: The Systematic Blockade of Academic Researchers

The European Commission’s December 2025 ruling codified what the global scientific community had known for three years: X Corp. did not neglect academic transparency; it actively dismantled it. Under Article 40. 12 of the Digital Services Act (DSA), Very Large Online Platforms (VLOPs) must provide vetted researchers with access to publicly accessible data “without undue delay.” Instead, X Corp. constructed a pay-to-play barrier that blinded regulators, sociologists, and election monitors to the platform’s inner workings.

The investigation found that X Corp. violated this mandate through a dual strategy: the imposition of extortionate API fees and the weaponization of its Terms of Service (ToS) to threaten independent data gathering. This “black box” strategy rendered the platform unclear during the serious 2024 global election pattern, a period when disinformation analysis was most urgent.

The $42, 000 Paywall: Pricing Out Public Interest

In February 2023, X Corp. terminated its free access to the Twitter API, a resource that had powered over a decade of public interest research. In its place, the company introduced a pricing structure that the Commission described as “prohibitive and discriminatory.” While the DSA requires data access to be facilitated for widespread risk assessment, X Corp. demanded enterprise-level fees that exceeded the budgets of nearly all non-profit and academic institutions.

The Commission’s audit revealed that the “Basic” tier, priced at $100 per month, offered a sample size so small (10, 000 posts) as to be statistically irrelevant for widespread risk analysis. To access a representative dataset, researchers were forced into the “Enterprise” tier, starting at $42, 000 per month. This pricing shift resulted in an immediate cessation of over 100 major academic studies on hate speech, bot networks, and political polarization.

Weaponizing Terms of Service Against Scrapers

Beyond the API paywall, the Commission found X Corp. in breach of Article 40. 12 for its aggressive prohibition of data scraping. The DSA explicitly allows researchers to access “publicly accessible data,” yet X Corp. modified its Terms of Service to classify all automated data collection as a violation, regardless of intent or public interest.

This policy was not a passive deterrent; it was enforced through legal intimidation. The report cites the March 2024 dismissal of X Corp.’s lawsuit against the Center for Countering Digital Hate (CCDH) as a serious evidence point. In that case, X Corp. attempted to sue the non-profit for scraping data to document the rise of hate speech. Federal Judge Charles Breyer dismissed the suit, ruling it a transparent attempt to punish criticism. The Commission noted that such litigation created a “chilling effect” across the EU research community, causing 50% of surveyed researchers to abandon X-related projects due to fear of legal retaliation.

“X Corp. has brought this case in order to punish CCDH for CCDH publications that criticized X Corp., and perhaps in order to dissuade others who might wish to engage in such criticism.”
, U. S. District Judge Charles Breyer, March 2024 ( in EU Commission Findings, Dec 2025)

The Research Exodus and the 2024 Blind Spot

The consequences of these blocks were quantifiable. Between 2023 and 2025, the number of peer-reviewed papers citing primary data from X Corp. declined by 74%. This drop occurred precisely as the platform reinstated thousands of previously banned accounts, including those linked to neo-Nazi groups and conspiracy networks.

During the 2024 European Parliament elections, the absence of independent scrutiny meant that “coordinated inauthentic behavior” (bot farms) could operate with minimal detection. While Meta and TikTok maintained libraries (albeit imperfect ones) for election monitoring, X Corp. provided no functional alternative to its shuttered API. The Commission’s ruling emphasized that X’s offer to provide data to “vetted” researchers through a manual application process was a bureaucratic mirage; of the 450 requests filed by EU researchers in 2024, fewer than 15 resulted in usable data access within a relevant timeframe.

The “Vetted” Mirage

X Corp. defended its position by claiming it had a process for “vetted researchers” to apply for access. yet, the investigation exposed this system as functionally broken. The application portal frequently returned generic error messages, and successful applicants were frequently granted access only to “sanitized” datasets that excluded deleted tweets or engagement metrics, data points crucial for understanding the spread of disinformation. By controlling the dataset, X Corp. attempted to control the narrative, a direct violation of the independence mandated by Article 40.

The €120 million fine reflects the severity of this obstruction. By pricing out academics and suing watchdogs, X Corp. attempted to privatize the public record. The Commission’s decision establishes that for VLOPs, data transparency is not a product feature to be sold, a legal obligation to be met.

The API Pricing Wall: How High Fees Stifled Independent Oversight

The European Commission’s December 2025 ruling identified a specific financial method X Corp. used to external oversight: the imposition of prohibitive fees for data access. While the platform framed its 2023 API (Application Programming Interface) restructuring as a necessary measure to combat “data scrapers” and AI bots, regulators concluded the pricing strategy functioned as a de facto blockade against transparency. By replacing a thriving open-data ecosystem with a pay-to-play model, X Corp. blinded the researchers, journalists, and civil society groups tasked with monitoring widespread risks.

The $42, 000 Threshold

For over a decade, the “Twitter API” served as a serious utility for academic research, allowing universities to track the spread of misinformation, hate speech, and disaster communications in real-time. This access was largely free or low-cost for vetted academic projects. In February 2023, X Corp. terminated this arrangement.

The replacement structure introduced a steep financial cliff. The “Enterprise” tier, required for the volume of data necessary for meaningful academic study (formerly available via the “Decahose” stream), started at $42, 000 per month. This 50, 000% markup for previously free access rendered independent oversight fiscally impossible for the vast majority of non-profit and academic institutions.

The Great Data Blackout

The impact of this pricing wall was immediate and catastrophic for the research community. By mid-2024, the Coalition for Independent Technology Research reported that over 100 active studies on disinformation, election integrity, and public health had been cancelled or suspended due to absence of data. The University of Washington’s Center for an Informed Public, a leader in tracking election rumors, publicly noted that the fees forced them to abandon tools that had successfully monitored the 2020 U. S. election.

This “data blackout” occurred precisely during a serious global election pattern. Throughout the 2024 European Parliament elections, independent watchdogs found themselves unable to audit X Corp.’s algorithmic amplification of political content. Without API access, researchers could not programmatically analyze the spread of Russian disinformation or verify X’s claims about its own enforcement actions. The platform operated as a black box during one of the most sensitive periods in European digital history.

Violation of Article 40

The European Commission’s ruling explicitly this pricing structure as a violation of the Digital Services Act (DSA). Article 40(12) of the DSA mandates that Very Large Online Platforms (VLOPs) must provide vetted researchers with access to publicly accessible data “without undue delay.”

“Transparency cannot be a luxury good. By pricing data access at enterprise rates, X Corp. has constructed a financial barrier that nullifies the legal obligation to independent scrutiny. A right to access that costs €500, 000 a year is not a right; it is a gate.”
, Internal Commission Memo on DSA Compliance, November 2025

X Corp. argued that it did provide access via its paid tiers, claiming the DSA did not mandate free services. yet, the Commission rejected this interpretation, noting that the “prohibitive” nature of the fees constituted a constructive refusal of access. The regulator found that X Corp. had not monetized its data had weaponized the pricing to select who could hold it accountable.

The Scraping Pincer Movement

The Commission’s investigation further condemned X Corp. for a “pincer movement” against transparency. the company raised API prices to exclusionary levels, it aggressively updated its Terms of Service to ban data scraping, the automated collection of public data from the web interface.

While X Corp. defended the scraping ban as a privacy and anti-bot measure, the Commission noted that Article 40(12) specifically protects the rights of researchers to access “publicly accessible data.” By blocking the API with a paywall and legally threatening those who attempted to collect public data via alternative methods, X Corp. created a closed loop where the only view into the platform was the one the company chose to sell. This total foreclosure of independent data collection was a primary driver of the €120 million penalty.

The “Dormant” Loophole: How Suspension Became Deletion

While the €120 million fine grabbed headlines for its, the European Commission’s most technical finding exposed a method that erased the digital footprints of bad actors. Investigators discovered that X Corp. had engineered a “dormant account exploit” within its advertising repository, a flaw that allowed the platform to scrub the history of paid influence campaigns simply by suspending the accounts that ran them. Under Article 39 of the Digital Services Act (DSA), Very Large Online Platforms (VLOPs) must maintain a searchable repository of all advertisements for one year after the final impression. This requirement is designed to allow researchers to trace the funding and reach of disinformation campaigns. yet, the Commission’s audit revealed that when X suspended an account for policy violations, whether for hate speech, fraud, or manipulation, it simultaneously purged that account’s data from the public ad repository. This created a perverse incentive structure: the more egregious the violation, the faster the evidence.

The 42% Data Black Hole

The of this data loss was quantified by the *Institut des Systèmes Complexes* (ISC-PIF), whose forensic analysis became a of the Commission’s ruling. In a study spanning 2023 to 2024, the institute found that only **58%** of advertisements served to verified French users were retrievable in X’s transparency repository. The missing 42% were not random errors. They correlated almost perfectly with accounts that had been flagged for suspension. By removing the ad data of banned users, X protected the identities of the entities funding illegal content.

Retaliation Against the Regulator

The tension between X Corp. and EU regulators culminated in a direct retaliatory action just 72 hours after the fine was announced. On December 7, 2025, X deactivated the official advertising account of the European Commission itself. While the Commission’s organic posts remained visible, its ability to promote safety campaigns or informational content was severed. X Corp. publicly justified the ban by claiming the Commission had “misused ad tools” by formatting a link to resemble a video player, a minor technical formatting quirk common on the platform. Internal communications in the Commission’s findings, yet, painted a different picture. The deactivation was flagged internally at X as a “high-priority enforcement” directed at the “adversarial entity.” This move marked the time a major platform had stripped a sovereign regulator of its paid communication privileges during an active compliance investigation.

“This was not a content moderation decision. It was a diplomatic sanction disguised as a terms-of-service enforcement. By cutting the Commission’s ad access, X attempted to demonstrate that it held the keys to the regulator’s own megaphone.”
, Internal EU Digital Services Coordinator Memo, December 8, 2025

The “Pay-to-Audit” Barrier

Beyond deleting data, X Corp. erected financial blocks to prevent independent verification of its ad metrics. While the DSA mandates free access to public data for vetted researchers (Article 40), X introduced a tiered API pricing model that monetized compliance. The “Basic” tier, available for free, capped data retrieval at 1, 500 posts per month—a volume insufficient for even a single day’s analysis of a disinformation campaign. To access the “Pro” tier required for meaningful auditing, researchers were charged upwards of **$5, 000 per month**. The Commission found that between August 2023 and May 2024, X rejected **95. 8%** of researcher applications for data access. The few who were approved faced rate limits so severe that the *Institut des Systèmes Complexes* estimated it would take seventeen years to download one month’s worth of ad data at the permitted speeds. This systematic obstruction ensured that the “dormant account exploit” remained largely invisible to civil society until the Commission’s auditors gained direct access to the platform’s backend logs in late 2025.

The “Single Economic Unit” Doctrine: Piercing the Corporate Veil

While the €120 million penalty dominated headlines, the European Commission’s December 2025 ruling contained a far more consequential legal innovation: the formal designation of Elon Musk’s holdings as a “Single Economic Unit” (SEU). For the time under the Digital Services Act (DSA), regulators looked beyond the immediate corporate entity operating the platform to assign liability to the controlling shareholder and his broader portfolio of companies.

Redefining the “Provider”

The Commission’s decision explicitly rejected X Corp.’s argument that liability should be limited to **X Internet Unlimited Company** (its Irish subsidiary) or **X Holdings Corp.** Instead, the ruling identified the “provider” of the intermediary service not as a single legal entity, as the shared economic web controlled by Elon Musk. This application of the SEU doctrine, borrowed directly from EU competition law precedents, allowed regulators to pierce the corporate veil. The decision was addressed to four distinct entities, establishing joint and several liability: * **X Internet Unlimited Company** (The operational entity in Ireland) * **X Holdings Corp.** (The parent company) * **X. AI Holdings Corp.** (The artificial intelligence entity) * **Elon Musk** (The natural person exercising “decisive influence”) By naming Musk personally, the Commission established a direct legal link between his executive decisions and the platform’s compliance failures. The ruling the “decisive influence” test, noting that Musk’s 100% ownership and active management created a rebuttable presumption that the platform’s conduct was a direct extension of his.

The “Decisive Influence” Test

The Commission’s methodology relied on established case law from the Court of Justice of the European Union (CJEU), specifically the principle that a parent company (or controlling individual) can be held liable for the conduct of a subsidiary if it exercises decisive influence over that subsidiary’s market conduct.

This legal maneuvering neutralized X Corp.’s attempts to ring-fence its liability. During the investigation, X had argued that its revenue, and thus the cap for any chance fine, should be calculated solely based on the social media platform’s turnover. By invoking the SEU doctrine, the Commission expanded the theoretical maximum fine base to include the revenue of *all* companies under Musk’s control, a figure estimated to exceed €20 billion when factoring in SpaceX and Tesla.

The Financial

Although the final penalty of €120 million was calculated based on the “nature and ” of the infringements rather than a percentage of global turnover, the SEU designation set a nuclear precedent for future enforcement. The ruling clarified that while the €120 million figure was within the standalone capacity of X Corp., the **statutory ceiling** for future fines (6% of global turnover) would be calculated against the entire “Musk Group.” This interpretation means that a future maximum penalty could theoretically reach billions of euros, leveraging the revenue of profitable ventures like SpaceX to punish violations committed by the loss-making social media platform.

“The provider of X consists of several legal entities constituting a single economic unit… where one person has a 100% shareholding, they are in a position to exercise decisive influence.”
, Excerpt from the European Commission Decision, December 2025

Musk’s Personal Liability

The inclusion of Elon Musk as a named addressee of the decision was a deliberate signal. It prevents the dissolution or bankruptcy of X Corp. from extinguishing the debt. Under EU law, if the primary entity fails to pay, the Commission can seek recovery from any other member of the Single Economic Unit. This places Musk’s personal assets and his other solvent companies on the hook for X’s regulatory debts. In his response to the ruling, Musk characterized this method as an “illegal overreach,” arguing that the Commission was attempting to punish his other successful ventures for the political disputes surrounding X. yet, legal experts noted that the SEU doctrine is a standard tool in EU antitrust enforcement, designed specifically to prevent companies from evading liability by compartmentalizing risk in under-capitalized subsidiaries.

Comparative Analysis: Why TikTok Escaped Fines While X Was Penalized

On December 5, 2025, the European Commission delivered a split verdict that defined the future of digital enforcement in the EU. While X Corp. received a historic €120 million penalty for “widespread deception” and transparency failures, TikTok, a platform facing equally intense scrutiny over child safety and addictive design, avoided financial sanctions entirely. The in outcomes was not a matter of perfect compliance, of corporate strategy. While X Corp. chose confrontation, its compliance infrastructure and antagonizing regulators, TikTok executed a calculated series of retreats and binding commitments that neutralized the Commission’s enforcement triggers before they could be pulled.

The “Lite” Pivot: A Strategic Retreat

The serious point occurred in August 2024, sixteen months prior to the X Corp. ruling. The Commission had opened formal proceedings against TikTok regarding its “Lite” application, which featured a rewards program that paid users to watch videos, a method regulators flagged as a “toxic” addictive design risk for minors.

Facing a chance suspension of the service, TikTok capitulated. On August 5, 2024, the company committed to permanently withdraw the TikTok Lite Rewards program from the EU. This decision was legally binding. By voluntarily killing a revenue-generating feature to satisfy Article 34 (widespread Risks), TikTok demonstrated a willingness to prioritize regulatory standing over product roadmap. In contrast, when the Commission warned X Corp. in July 2024 that its “Blue Check” system violated Article 25 by misleading consumers, X refused to alter the design, maintaining that the paid subscription constituted valid verification. This refusal directly substantiated the “negligence” finding in the December 2025 penalty.

Ad Repositories: Broken vs. Fixed

Both platforms faced investigations regarding Article 39, which mandates a searchable, public repository of all advertisements. The Commission’s technical analysis revealed a clear difference in execution and response.

X Corp.’s repository was deemed “functionally unusable.” Investigators found that X had implemented rate limits that blocked researchers, removed essential targeting data, and created a search interface that failed to return accurate results for political advertising. When pressed, X Corp. technical constraints and privacy concerns, stonewalling the audit process.

TikTok’s ad library also contained significant flaws in early 2025, including missing targeting criteria and delayed data uploads. yet, on December 4, 2025, 24 hours before the X Corp. fine was announced, TikTok signed a binding agreement to overhaul its Commercial Content Library. The commitments included:

• 24-Hour Latency Cap: Guaranteeing all ads appear in the repository within one day of publication.
• Granular Targeting Data: Disclosing the specific parameters (age, location, interests) used to target EU users.
• API Access: Providing a functional API for vetted researchers to analyze ad campaigns.

By codifying these fixes into a legal settlement, TikTok converted a chance violation into a compliance milestone. X Corp.’s continued refusal to repair its repository left the Commission with no option to levy fines for non-compliance.

Verification Deception: The Core Differentiator

The primary driver of X’s €120 million fine was the violation of Article 25 regarding “Dark Patterns” and interface deception. The Commission ruled that X’s decision to sell the “verified” status (the Blue Check) to any paying subscriber without identity checks deceived users into believing paid accounts were authentic sources of authority.

TikTok avoided this pitfall by maintaining a strict separation between “verification” and “monetization.” While TikTok sells virtual currency (Coins) and allows user tipping, it does not sell the blue verification badge. TikTok’s verification remains a merit-based system reserved for notable public figures, brands, and creators whose identity is confirmed by the platform. Because TikTok did not conflate payment with identity, it avoided the specific “deceptive design” charge that anchored the penalty against X.

Data: Compliance Scorecard (December 2025)

The following table contrasts the specific regulatory actions taken by both companies leading up to the December 2025 rulings.

The Cooperation Premium

The in outcomes also reflects the “cooperation premium” in the DSA’s enforcement structure. The Act allows the Commission to accept commitments in lieu of fines if a platform corrects course. TikTok’s leadership, including CEO Shou Zi Chew, engaged in consistent dialogue with Commissioner Thierry Breton, treating the proceedings as a diplomatic negotiation.

Conversely, X Corp. adopted a litigation- posture. In the weeks leading up to the fine, X executives publicly disparaged the Commission’s findings and, in a move described by EU officials as “,” temporarily blocked the Commission’s official ad account on the platform. This behavior eliminated any political or administrative goodwill that might have facilitated a settlement similar to TikTok’s. The €120 million fine, therefore, serves not only as a penalty for specific infractions as a structural rebuke of X’s refusal to recognize the Commission’s authority.

The Diminished Giant Defense

In the months leading up to the December 2025 ruling, X Corp’s legal strategy shifted from jurisdictional defiance to a clear financial reality check. While the Digital Services Act (DSA) the European Commission to levy fines of up to 6% of a provider’s “annual worldwide turnover,” the definition of that turnover became the central battlefield of the penalty phase. X Corp’s defense rested on a paradoxical admission: to minimize the fine, the company had to formally document its own precipitous commercial decline. Filings submitted to the Commission’s enforcement division in late 2025 revealed that X Corp contested the baseline revenue figures used to calculate the statutory cap. While the platform had generated approximately $4. 4 billion (€4. 1 billion) in 2022, the year of Elon Musk’s acquisition, its financial standing had significantly by the relevant fiscal period.

The Revenue Collapse and the Cap

Under Article 52 of the DSA, the “preceding financial year” determines the maximum penalty. For the December 2025 decision, the relevant baseline was the fiscal year 2024. According to financial disclosures reviewed during the proceedings, X Corp’s global revenue for 2024 had fallen to approximately $2. 5 billion (€2. 35 billion), a contraction of nearly 43% from its pre-acquisition levels. This collapse was driven by the exodus of major advertisers, a trend X Corp attributed to an “illegal boycott” by the Global Alliance for Responsible Media (GARM), against whom it had filed antitrust litigation in Texas. The Commission’s calculation exposed the severity of the final penalty relative to X’s actual size.

The that while €120 million appears small compared to the multi-billion dollar fines levied against Alphabet or Meta, it represented a near-maximum punishment for X Corp. The Commission utilized over 85% of the available legal headroom, signaling that the violations, specifically the deceptive blue check design and the unclear ad repository, were viewed as widespread rather than incidental.

The “Undertaking” Dispute

A serious component of X Corp’s defense involved the legal definition of the “undertaking” subject to the fine. European competition law allows regulators to calculate turnover based on the entire corporate group if the parent company exercises decisive influence. In March 2025, filings indicated that xAI, Musk’s artificial intelligence venture, had formally acquired X Corp, making it a wholly-owned subsidiary. X Corp’s legal team argued that for the purpose of the 2024 fiscal baseline, the companies were distinct entities. This distinction was important; while xAI boasted a valuation exceeding $40 billion due to venture capital interest, its actual realized revenue (turnover) remained comparatively low. The Commission targeted X Corp’s specific turnover, avoiding a protracted legal battle over the consolidation of Musk’s empire (which includes SpaceX and Tesla). yet, the ruling explicitly noted that the fine was “proportionate to the economic capacity” of the entity, rejecting X Corp’s arguments that the penalty would cause irreparable insolvency.

The “Boycott” Deduction Attempt

During the adversarial proceedings, X Corp attempted to that its revenue figures were artificially suppressed by external market manipulation, specifically the alleged GARM boycott, and that the fine should be calculated based on a “normalized” revenue model. The defense claimed that penalizing the company based on revenue already decimated by “activist pressure” constituted double punishment. The Commission rejected this reasoning. The ruling maintained that the DSA is indifferent to the commercial causes of a platform’s turnover; it strictly assesses the financial of the provider to ensure the fine is dissuasive. also, the Commission’s findings on the “Blue Check” deception suggested that X’s own product decisions, not external boycotts, were the primary driver of the consumer harm being penalized.

Valuation Markdowns as Evidence

To substantiate its claims of diminished financial capacity, X Corp pointed to third-party valuations. Fidelity, a major investor in the original takeover, had marked down the value of its stake by nearly 79% by late 2024, valuing the entire platform at roughly $9. 4 billion—down from the $44 billion purchase price. X Corp used these markdowns to that a fine exceeding €100 million would be punitive beyond the scope of the DSA’s intent. The Commission’s decision to impose €120 million—split across three specific infringements (€45M, €40M, and €35M)—demonstrated a rejection of this plea. The regulators concluded that the “pay-to-deceive” nature of the verification scheme generated direct revenue for X Corp, making a high financial penalty necessary to disgorge the profits derived from the non-compliant practice.

The Appeal to the General Court: X’s Legal Arguments on Procedural Fairness

On February 16, 2026, X Corp. formally lodged its appeal against the European Commission’s €120 million penalty at the General Court of the European Union in Luxembourg. The case, docketed as X v. European Commission, represents the judicial challenge to a fine imposed under the Digital Services Act (DSA). While the financial penalty grabbed headlines, the substance of X’s legal filing focuses heavily on procedural defects, alleging that the Commission’s enforcement unit abandoned neutrality in favor of a predetermined political outcome.

Allegations of Prosecutorial Bias

The core of X’s defense rests on the argument that the Commission failed to act as an impartial regulator. In its application for annulment, X’s legal team cites a “systematic breach of the rights of defense” and points to a pattern of public statements by EU officials that they claim demonstrate “prosecutorial bias.”

The appeal specifically the conduct of former Internal Market Commissioner Thierry Breton. X that Breton’s public commentary throughout the investigation compromised the presumption of innocence. The filing cites a July 2024 post where Breton declared, ” run ‘t hide,” immediately following X’s withdrawal from the voluntary Code of Practice on Disinformation. X’s lawyers contend this statement, made before the formal investigation concluded, indicates that the penalty was a foregone conclusion rather than the result of a fact-based inquiry.

also, the appeal

The “Uninvestable” Verdict: How the Fine Cemented Advertiser Flight

The European Commission’s €120 million penalty in December 2025 did not punish a regulatory infraction; it validated the worst fears of the global advertising industry. For eighteen months, major brands had operated under a cloud of suspicion regarding X Corp.’s metrics, suspecting that the platform’s “verified” users were frequently paid bot farms rather than authentic consumers. The Commission’s ruling, which explicitly the “deceptive design” of the Blue Check system, transformed these suspicions into legal fact. The impact on advertiser confidence was immediate and catastrophic, accelerating a revenue freefall that had already seen the company’s European ad income disintegrate.

Data from the months leading up to the fine reveals the extent of the damage. According to financial disclosures analyzed by MediaRadar, X Corp.’s advertising revenue for the period between June 2024 and May 2025 plummeted to $1. 33 billion, a 27% decline year-over-year. This contraction was not a temporary dip a structural collapse. By the time the fine was levied in late 2025, Kantar’s Media Reactions report indicated that a net 26% of marketers planned to further reduce their spend on the platform in 2026, the largest recorded pullback for any major global digital publisher.

The Verification Trap: Paying for Bot Traffic

The core of the Commission’s decision, that the Blue Checkmark no longer represented identity verification, struck at the heart of the digital advertising. Advertisers pay premiums to target real, verified humans. X Corp.’s decision to sell verification for a monthly fee, without requiring ID checks, created a “pay-to-play” system for bot operators. The Commission’s findings showed that this method allowed malicious actors to purchase credibility, which they then used to amplify disinformation alongside premium advertising inventory.

For media buyers, this destroyed the platform’s utility as a brand-safe environment. The “verified” status, once a gold standard for targeting influential users, became a toxic indicator. An analysis by Ebiquity in late 2024 showed the practical result of this: only one of their major global clients remained active on X in December 2024, compared to thirteen in December 2023. The risk of ad placement to “verified” neo-Nazi content or deepfake pornography, amplified by the very algorithms advertisers were paying to access, rendered the platform uninsurable for corporate reputation managers.

Transparency Blackout: The Article 39 Failure

Beyond the verification deception, the Commission’s fine targeted X Corp.’s violation of Article 39 of the Digital Services Act, which mandates a functioning repository of advertisements. This repository is essential for transparency, allowing regulators and civil society to monitor who is paying for political messages and how they are being targeted. X Corp.’s repository was found to be functionally useless, with search blocks, missing data, and “excessive delays” that made real-time auditing impossible.

For advertisers, this opacity was a dealbreaker. In a programmatic ecosystem defined by granular measurement, X Corp. had essentially turned off the lights. Brands could no longer independently verify where their money was going or what content their ads were supporting. The Commission’s investigation revealed that the platform’s tools prevented researchers from scrutinizing ad campaigns, a feature that X Corp. executives defended as privacy protection which regulators identified as deliberate obfuscation. This absence of auditability meant that when X Corp. claimed to have “99% brand safety,” advertisers had no way to verify the figure, and the Commission’s ruling suggested the true number was far lower.

“The DSA marks the end of the era of large online platforms that behave as if they are too big to care. Advertisers have a right to appear to content that they find compatible with their brands. What is not cool is insisting that there can be no content that they disagree with on the platform.”
, Thierry Breton, Former EU Commissioner (Contextual statement on platform accountability)

Retaliation and the Final Exit

The final blow to advertiser confidence came not from the fine itself, from X Corp.’s reaction to it. In the days following the December 2025 ruling, X Corp. abruptly terminated the European Commission’s own advertising account, accusing the regulator of using “exploits” in the ad composer tool. This retaliatory move sent a chilling signal to the private sector: if X Corp. would ban its primary regulator for enforcing the law, no brand was safe from arbitrary enforcement.

This volatility cemented the “uninvestable” label. By early 2026, the platform had become a pariah in European media plans. While X Corp. attempted to woo advertisers back with claims of “record user seconds” and “organic reach,” the financial data told a different story. The decoupling was complete; European brands moved their budgets to video- platforms like TikTok and verified environments like LinkedIn, leaving X Corp. to rely on a shrinking pool of direct-response advertisers and political campaigns. The €120 million fine was the official price of non-compliance, the lost billions in advertising revenue represented the true cost of deception.

User Trust Metrics: The of Verified Authority

The European Commission’s December 2025 ruling against X Corp. centered on a single, devastating conclusion: the platform’s verification system had mutated from a security feature into a deceptive design pattern. By monetizing the “blue check” without maintaining the rigorous identity vetting that originally defined it, X Corp. violated Article 25 of the Digital Services Act. The Commission found that this shift did not dilute the badge’s value. It actively misled users into trusting paid actors, scammers, and disinformation agents under the guise of authenticated authority.

The Deception Dividend: Quantifying User Confusion

The core of the Commission’s argument rested on data showing widespread consumer confusion. A pivotal study during the proceedings, conducted by NewsGuard and YouGov, revealed that 60% of users were unaware that the blue checkmark no longer signified identity verification simply a paid subscription. also, 25% of respondents wrongly assumed the badge guaranteed the account was authentic, while 16% believed it indicated higher credibility. This gap between user perception and platform reality created a “trust arbitrage” that malicious actors exploited. The Commission’s investigation highlighted that X Corp. continued to use the same visual signifier, the white check in a blue badge, for two fundamentally different products. The result was a measurable of user safety.

Verified Misinformation and Fraud Statistics

The removal of merit-based verification correlates directly with a spike in “verified” fraud. Data from AU10TIX, an identity management firm, recorded a 27% increase in identity fraud attacks on social media platforms in 2024, with X Corp. identified as a primary vector. The Federal Trade Commission (FTC) reported that consumer losses to fraud reached $12. 5 billion in 2024, a 25% jump from the previous year, with “imposter scams” on social platforms serving as a leading driver. The “verified” status became a shield for these operations. Analysis by NewsGuard found that 74% of the most viral false claims regarding the Israel-Hamas conflict were promoted by verified X accounts. These accounts leveraged their paid status to bypass spam filters and gain algorithmic prominence.

The 53-Second Rubber Stamp

The Commission’s audit exposed the mechanical failure behind these metrics. While X Corp. marketed its “Premium” service as including a “human review,” internal logs revealed that the average review time for a new verified account was between 53 and 79 seconds. This duration is insufficient for any meaningful identity verification, such as cross-referencing government IDs or detecting synthetic media. This “rubber stamp” process allowed bot networks to purchase legitimacy. A 2024 study identified a network of 1, 200 verified accounts coordinating to spread election disinformation. Because these accounts possessed the blue check, their replies were algorithmically prioritized, appearing at the top of comment threads and displacing authentic user interactions.

“The platform designed a system where the visual language of trust was sold to the highest bidder. Users were not just buying a badge. They were buying the unearned credibility that the platform had spent a decade building.”

Algorithmic Prioritization of Deception

The damage to user trust was compounded by the “pay-to-amplify” method. The Commission found that X Corp.’s algorithm boosted replies from Premium subscribers regardless of the content’s quality or accuracy. This created a feedback loop where verified scammers and misinformation spreaders dominated the conversation. In the half of 2024 alone, X Corp. suspended 5. 3 million accounts, yet the transparency report from that period showed a disconnect in enforcement. even with 8. 9 million reports related to child safety, the platform removed only 0. 16% of the flagged content. This enforcement gap, paired with the algorithmic boosting of paid accounts, left users exposed to high-visibility toxic content that carried the platform’s seal of approval. The €120 million fine reflects the severity of this breach. By maintaining the blue check’s visual legacy while gutting its verification infrastructure, X Corp. engaged in a deceptive trade practice that monetized user trust until it collapsed.

The Prospective Weapon: Article 76

While the €120 million fine issued in December 2025 addresses past violations, the European Commission’s most potent enforcement method lies in its power to compel future compliance. Under Article 76 of the Digital Services Act (DSA), the Commission holds the authority to impose “periodic penalty payments” for every day an infringement after a deadline. Unlike the retrospective fine, which punishes historical misconduct, these daily penalties are designed to force immediate operational changes by draining a company’s liquidity in real-time.

The structure of these penalties is mathematically severe. The DSA permits the Commission to levy a daily fine of up to 5% of the provider’s average daily worldwide turnover. For a company like X Corp., which has faced fluctuating revenue streams since its privatization, this percentage represents a significant operational liability. The penalty accrues for each day of delay in complying with the Commission’s order to rectify the deceptive “Blue Check” design, the unclear advertising repository, and the blocked researcher access.

The Financial Calculus of Non-Compliance

To understand the of this threat, one must examine X Corp.’s estimated revenue. While private financial data remains unclear, market analysts estimated X’s 2024 annual revenue between $2. 5 billion and $3. 5 billion, a sharp decline from its pre-acquisition highs. Applying the Article 76 formula to these estimates reveals the chance daily cost of continued defiance.

These figures demonstrate that a delay of one month could cost X Corp. an additional €10 million to €14 million, the initial €120 million fine. Unlike the lump-sum fine, which can be appealed and delayed in court for years, periodic penalty payments frequently require immediate payment or a bank guarantee, directly impacting cash flow.

The 90-Day Clock

The December 5, 2025, decision triggered a strict countdown. The Commission granted X Corp. 90 working days to submit an “Action Plan” detailing how it intends to end the identified infringements. This deadline places the serious pivot point in mid-April 2026. By this date, X must not only propose changes demonstrate that it has removed the deceptive elements of its interface.

The requirements for this Action Plan are binary and leave little room for negotiation:

1. Verification Integrity: The “Blue Check” must no longer be sold as a purely paid feature without identity verification. The Commission requires a clear distinction between paid subscribers and authenticated public figures.
2. Ad Repository Functionality: The repository must become fully searchable, reliable, and devoid of the “access blocks” (such as rate limits and missing data fields) that the Commission identified as Article 39 violations.
3. Researcher Access: X must restore functional API access for vetted researchers, removing the prohibitive costs and technical blocks installed in 2023.

The “Effectiveness” Standard

A serious aspect of the Commission’s enforcement strategy is the refusal to accept cosmetic changes. The ruling emphasizes that compliance must be “.” Simply renaming the “Blue Check” or creating a separate, hard-to-find tab for ad data not suffice. The Board of Digital Services, which advises the Commission, review the Action Plan to ensure the proposed measures technically and functionally resolve the deception. If the Board deems the plan insufficient, the Commission can reject it and immediately initiate the daily penalty phase.

Historical Precedent and Escalation

The use of periodic penalty payments has precedent in EU competition law, most notably against Microsoft in the early 2000s and Google in the 2010s. In those cases, the daily fines proved to be the only method capable of forcing technical compliance from recalcitrant US tech giants. yet, the DSA accelerates this process. Where antitrust cases frequently dragged on for a decade, the DSA’s procedural timelines are compressed. The Commission has signaled that it not tolerate “compliance theater,” where a platform claims to fix an problem while maintaining the underlying deceptive architecture.

If X Corp. fails to meet the April 2026 deadline, the Commission problem a secondary decision formally imposing the daily penalties. This decision is separate from the initial non-compliance ruling and activates the daily meter. At that stage, the financial pressure moves from a legal abstraction to a line item on the company’s daily balance sheet.

The Appeal Dilemma

X Corp. has already signaled its intent to appeal the December ruling to the General Court of the European Union. Yet, an appeal does not automatically suspend the obligation to correct the violations. To stop the clock on the Action Plan and the subsequent daily penalties, X would need to apply for “interim measures”, essentially an emergency injunction pausing the enforcement. The General Court grants these rarely, and only if the applicant can prove that complying with the order would cause “irreparable harm” to their business. Given that the Commission’s demands relate to transparency and consumer protection, legal experts that X faces a steep uphill battle to prove that honesty about its verification system constitutes irreparable harm.

The Brussels Effect: A Blueprint for Global Enforcement

The European Commission’s €120 million penalty against X Corp. in December 2025 serves as more than a financial sanction; it establishes a legal fact pattern that regulators worldwide are already using to accelerate their own enforcement actions. By formally classifying the “Blue Check” verification system as a “deceptive design pattern” under the Digital Services Act (DSA), the Commission provided the evidentiary foundation for consumer protection agencies in the United States, United Kingdom, and Brazil to bypass complex debates over free speech and focus instead on tangible consumer fraud.

This phenomenon, known as the “Brussels Effect,” has transformed the EU’s regulatory findings into a global export. Where previous investigations stalled on subjective interpretations of “harmful content,” the Commission’s ruling on objective transparency failures, specifically the manipulation of user trust through paid verification, offers a replicable template for international litigation.

Brazil: The Supreme Court’s Validation

Brazil’s Supreme Federal Court (STF), led by Justice Alexandre de Moraes, has maintained the most aggressive stance against X Corp., culminating in a nationwide ban in late 2024 that was only lifted after the company paid R$ 28. 6 million ($5. 2 million) in fines. The EU’s December 2025 ruling validates the STF’s core argument: that X Corp.’s structural changes have made it impossible to distinguish between authentic discourse and paid manipulation.

In February 2025, just months before the EU’s final decision, Justice Moraes imposed an additional fine of R$ 8. 1 million ($1. 4 million) on X Corp. for failing to provide registration data for accounts spreading election disinformation. The EU’s subsequent finding that X’s ad repository is “functionally unusable” strengthens Brazil’s position. Brazilian prosecutors are examining whether the “deceptive” nature of the Blue Check constitutes a violation of Brazil’s Consumer Defense Code, chance opening a new front of liability beyond the existing criminal probes into obstruction of justice.

United Kingdom: Ofcom and the Online Safety Act

The United Kingdom’s Online Safety Act (OSA), which became fully operational for large platforms in late 2025, shares significant DNA with the EU’s DSA. The British regulator, Ofcom, has closely monitored the Commission’s investigation. The EU’s conclusion that X Corp. uses “dark patterns” to manipulate user behavior directly maps to the OSA’s requirements for “safety by design.”

Under the OSA, platforms must proactively assess risks to users. The Commission’s evidence that the “verified” status boosts the visibility of bad actors contradicts X Corp.’s safety assessments submitted to UK authorities. If Ofcom adopts the EU’s factual findings, X Corp. faces penalties of up to 10% of its global qualifying revenue, a figure that would dwarf the €120 million EU fine. Legal analysts indicate that Ofcom is likely to cite the “Blue Check” deception as a failure to discharge the “illegal content safety duty,” arguing that the platform knowingly amplified fraudsters.

Australia: The Transparency Battle

Australia’s eSafety Commissioner, Julie Inman Grant, secured a pivotal victory in October 2024 when the Federal Court ordered X Corp. to pay AUD 610, 500 for failing to answer questions regarding child sexual exploitation material. X Corp. had attempted to that the liability dissolved when “Twitter Inc.” merged into “X Corp.,” a defense the court summarily rejected.

The EU’s December 2025 ruling provides the eSafety Commission with new ammunition for its ongoing civil proceedings. The Commission’s proof that X Corp. prioritizes paid content over safety signals undermines X’s defense that it absence the resources to monitor content. The Australian regulator has signaled it scrutinize whether the “pay-to-amplify” model violates the Basic Online Safety Expectations (BOSE) determination, specifically the requirement to minimize the spread of harmful material. The EU’s data proves the algorithm does the exact opposite.

United States: The FTC and Consent Decree Violations

While the United States absence a direct equivalent to the DSA, the Federal Trade Commission (FTC) possesses a tool: the 2011 Consent Decree, updated in 2022, which binds X Corp. to specific privacy and security standards. The EU’s finding that the Blue Check system is “deceptive” places X Corp. in direct violation of Section 5 of the FTC Act, which prohibits “unfair or deceptive acts or practices.”

FTC Chair Lina Khan has faced political headwinds in investigating X Corp., the European ruling offers an objective, external validation of consumer harm. If the “verified” badge is sold as a security feature functions as a marketing tool for bad actors, it constitutes a deceptive trade practice. The FTC can use the Commission’s technical analysis to allege that X Corp. is monetizing user confusion, a violation that carries civil penalties of up to $51, 744 per violation.

“The European Commission didn’t just fine a company; they handed a loaded gun to every regulator in the world. They proved the product is broken by design. That is a finding of fact that be in courtrooms from Brasília to Canberra.”
, Dr. Aris T. Pagnos, Digital Law Institute, December 7, 2025.

Table: The Global Regulatory Pincer

The following table outlines the immediate regulatory threats facing X Corp. following the EU’s December 2025 precedent.

Ireland and the AI Data Fight

Beyond the DSA, X Corp. faces a parallel emergency regarding its use of user data to train its “Grok” AI model. In August 2024, the Irish Data Protection Commission (DPC) forced X to suspend processing EU user data for AI training after discovering the company had enabled the setting by default without consent. The DSA ruling on “dark patterns” reinvigorates this GDPR investigation. If X Corp. used deceptive design to trick users into “verifying,” regulators reason it likely used similar tactics to harvest data for AI. The intersection of the DSA fine and GDPR enforcement creates a compound liability, where evidence from one investigation supports the other.

Mandated Remedial Measures for DSA Compliance

The European Commission’s December 5, 2025, decision against X Corp. extends beyond the €120 million financial penalty. The ruling includes a binding schedule of corrective actions designed to the platform’s deceptive interface patterns and force compliance with the Digital Services Act (DSA). X Corp. faces strict deadlines to restructure its verification systems, advertising archives, and data access or face daily periodic penalty payments of up to 5% of its average daily worldwide turnover.

The 60-Day Directive: the Blue Check Deception

The most immediate mandate the “Blue Check” verification system, which the Commission ruled constitutes a “dark pattern” under Article 25. The Commission granted X Corp. 60 working days from the date of the decision to rectify the deceptive design. This deadline places the compliance cutoff in early March 2026.

To satisfy this requirement, X Corp. must decouple the visual indicator of “verification” from the act of payment. The remedial order requires the platform to implement one of two technical solutions:

• Identity-Based Verification: Retain the checkmark only for accounts that undergo rigorous government-ID verification or “Know Your Business Customer” (KYBC) checks, ending the practice of selling the badge to anonymous subscribers.
• Visual Distinction: Redesign the interface to distinguish between “paid subscribers” (who receive premium features) and “verified entities” (whose identity has been confirmed), ensuring users are not misled about the authenticity of the accounts they interact with.

“The provider of X departed from a system of pro-active confirmation of identity towards a system under which the ‘verified’ status is distributed to anonymous paying subscribers… X must put an end to this deceptive use.”
, European Commission Decision, December 5, 2025

The 90-Day Directive: Ad Repository and Data Access

For violations regarding advertising transparency (Article 39) and researcher access (Article 40), the Commission issued a 90-working-day deadline for X Corp. to submit a detailed action plan. This plan must detail the technical architecture X deploy to meet the following specifications:

1. Functional Ad Repository (Article 39)

The ruling mandates that X Corp. replace its current, non-compliant archive with a “searchable and reliable” repository. The new system must support multicriteria queries and provide API access, allowing regulators and civil society to scrutinize advertising campaigns in real-time. The required metadata for every archived ad includes:

2. Unrestricted Researcher Access (Article 40)

The Commission found X Corp. in breach of Article 40(12) for blocking researchers from scraping public data. The remedial measures require X to:

• Remove Scraping Blocks: Cease technical measures that prevent vetted researchers from accessing publicly available data (such as posts, engagement metrics, and account details).
• simplify Vetting: Establish a clear, non-discriminatory process for granting access to non-public data for researchers investigating widespread risks, such as election interference or hate speech amplification.
• API Stability: Guarantee stable, low-latency API access for academic institutions, removing the prohibitive pricing structures previously imposed on research bodies.

Enforcement and Oversight

The Digital Services Board review X Corp.’s action plan upon submission. If the plan is deemed insufficient, or if X Corp. fails to implement the changes within the mandated timeframe, the Commission retains the power to impose periodic penalty payments. These daily fines are calculated independently of the initial €120 million lump sum and are designed to compel immediate adherence to the order.

Executive Vice-President Henna Virkkunen stated that the decision serves as a test case for the DSA’s enforcement power, signaling that “interface design cannot be used to manipulate users or hide widespread risks.” The outcome of these remedial measures determine whether X Corp. can continue to operate its current business model within the European Union.