Why is the European Commission fining X? Because, in the first non-compliance decision ever adopted under the Digital Services Act, Brussels found on 5 December 2025 that the platform deceived users with its paid blue checkmark, ran an advertising repository that failed the law's transparency test, and shut eligible researchers out of its public data, and it fined X €120 million for those three breaches. X and Elon Musk went to the EU's General Court in February 2026 to have the decision annulled. On 24 September 2026 the fight became a transatlantic one: the United States Department of Justice applied to intervene on X's side, arguing that the Commission had reached beyond its jurisdiction. This analysis explains what the Commission found, how Digital Services Act fines work, what the court can and cannot do, and what the case means for any platform or adviser dealing with EU digital regulation.
What the Commission decided on 5 December 2025
The short answer is that the Commission found X in breach of three separate transparency obligations and imposed a single fine of €120 million to cover them. The decision closed one strand of the formal proceedings the Commission had opened against X on 18 December 2023. Preliminary findings on these three issues were sent to the company on 12 July 2024, and the final non-compliance decision followed almost seventeen months later.
The three findings, each tied to a specific article of Regulation (EU) 2022/2065, the Digital Services Act, were:
- Deceptive design (Article 25(1)). The blue checkmark signalled "verified" status that anyone could buy, without X meaningfully checking who was behind the account.
- Advertising transparency (Article 39). X's public ad repository lacked key information, including the content and topic of adverts and the legal entity paying for them, and was slowed by design features and processing delays.
- Researcher data access (Article 40(12)). X's terms of service barred eligible researchers from independently accessing public data, including by scraping, and its application process put up unnecessary barriers.
The Commission said the amount reflected "the nature of these infringements, their gravity in terms of affected EU users, and their duration". It has not published a breakdown of the €120 million by breach, and the full reasoned decision is not public. Executive Vice-President Henna Virkkunen framed the case as one about trust: deceiving users with blue checkmarks, obscuring information on ads and shutting out researchers, she said, "have no place online in the EU".
The decision also set deadlines. X had 60 working days to tell the Commission how it would end the Article 25 infringement, and 90 working days to submit an action plan for the Article 39 and 40(12) breaches. Those deadlines matter, because the Digital Services Act separates the one-off fine from the ongoing duty to comply, and it is the second that carries the heavier long-term risk.
The blue checkmark: why paid verification was found to be deceptive design
The Commission's view is that a badge which says "verified" when no verification has taken place misleads the people who rely on it. Before Musk's takeover, the blue check on Twitter indicated an account whose identity the company had confirmed. After the change to a paid subscription model, the same symbol could be obtained by paying for X Premium.
Article 25(1) of the Digital Services Act prohibits providers of online platforms from designing, organising or operating their interfaces "in a way that deceives or manipulates the recipients of their service or in a way that otherwise materially distorts or impairs" their ability to make free and informed decisions. This is the DSA's rule against what are often called dark patterns, the same family of design concerns now driving litigation over allegedly addictive platform design in the United States.
Two points in the Commission's reasoning are worth noting for anyone advising a platform. First, the Commission was explicit that the DSA does not require platforms to verify users at all. The breach was the false claim of verification, not the absence of it. Second, the harm the Commission identified was practical: a badge that looks like a trust signal exposes users to impersonation fraud, scams and manipulation by malicious actors, because it becomes harder to judge whether an account and its content are authentic.
X has since changed how the badge is described in Europe. According to reporting on the US intervention, the company began labelling EU subscribers as "premium" rather than "verified" users from May 2026. Whether that change fully answers the Commission's concern is a question of compliance, which runs separately from the court challenge to the fine itself.
The ad repository and researcher data access
The other two findings concern the tools the Digital Services Act gives outsiders to scrutinise the largest platforms, and the Commission found that X had hobbled both. They are less eye-catching than the checkmark but, for regulators, arguably more important, because they underpin the whole system of external oversight.
Advertising repository (Article 39)
Article 39 requires very large online platforms that show adverts to publish a repository, "through a searchable and reliable tool that allows multicriteria queries and through application programming interfaces", covering every advert for as long as it runs and for a year afterwards. The repository must show, among other things, the content of the advert, on whose behalf it is presented and who paid for it. The Commission found that X's version lacked the content and topic of adverts and the paying entity, and imposed "excessive delays in processing". Accessible ad libraries are how researchers and civil society spot scam campaigns and coordinated influence operations, the problem at the heart of recent consumer complaints against Google, Meta and TikTok over financial scam adverts.
Researcher access to public data (Article 40(12))
Article 40(12) obliges very large platforms to give qualifying researchers access "without undue delay" to data that is publicly accessible on their interface, including real-time data where technically possible, for research into systemic risks in the EU. The Commission's objection was that X's terms of service prohibited independent access, including scraping, and that its processes for researchers "impose unnecessary barriers". In practice, that meant outside experts could not readily study disinformation, algorithmic amplification or other risks on the platform, which is precisely the scrutiny the law was written to enable.
Who the Digital Services Act applies to, and why X is a very large online platform
The Digital Services Act applies to intermediary services offered to users in the EU, wherever the provider is based. Article 2(1) is blunt: the Regulation applies to services "offered to recipients of the service that have their place of establishment or are located in the Union, irrespective of where the providers of those intermediary services have their place of establishment." A US company serving European users is therefore within scope in principle, and Article 13 requires providers with no EU establishment to appoint a legal representative in a Member State.
The heaviest obligations, including Articles 39 and 40, apply only to very large online platforms and search engines. Under Article 33(1), that means services with at least 45 million average monthly active recipients in the EU that the Commission has formally designated. X was designated in April 2023, alongside the other first wave of very large platforms. For these services, Article 56 gives the Commission exclusive power to enforce the systemic-risk rules and a general power to enforce the rest of the Regulation, which is why the case sits in Brussels rather than with a national regulator such as Ireland's, where X's European operations are based and where companies often turn to local counsel in Ireland.
This architecture is at the centre of the US objection. The Justice Department does not dispute that the DSA applies to services offered in Europe. It disputes how the Commission identified the "provider" responsible and which companies and individuals it attached liability to, a point explored below.
How Digital Services Act fines work
Digital Services Act fines can reach 6% of a provider's total worldwide annual turnover, with separate daily penalties to force compliance. Article 74(1) allows the Commission, in a non-compliance decision under Article 73, to impose fines "not exceeding 6 % of its total worldwide annual turnover in the preceding financial year" where the provider has intentionally or negligently infringed the Regulation. The main penalty tools are set out below.
| Tool | Legal basis | Maximum | Used for |
|---|---|---|---|
| Fine for substantive breach | Article 74(1) | 6% of total worldwide annual turnover in the preceding financial year | Infringing the DSA, breaching interim measures or binding commitments |
| Fine for procedural breach | Article 74(2) | 1% of total annual income or worldwide turnover | Incorrect, incomplete or misleading information, refusing inspections and similar failures |
| Periodic penalty payments | Article 76(1) | 5% of average daily income or worldwide annual turnover, per day | Compelling compliance, including with a non-compliance decision |
| Court review | Article 81 | Court may cancel, reduce or increase | Any Commission decision imposing a fine or periodic penalty |
Two features explain why €120 million is modest against the ceiling. The fine was calculated by reference to the nature, gravity and duration of the breaches, and the breaches found were transparency failures rather than the systemic-risk failures, such as illegal content and information manipulation, that remain under investigation. The more significant exposure for X lies in periodic penalty payments under Article 76, which can run at up to 5% of average daily turnover for each day a provider fails to comply with a non-compliance decision.
How the turnover ceiling is measured is itself contested. According to reporting on the US filing, the Justice Department objects that the Commission looked to the worldwide turnover of the wider corporate group connected to Musk rather than to X alone. Group-level turnover is familiar from EU competition law, and the same debate runs through the GDPR, as the Irish regulator's recent €403m location-data fine on Google showed.
How the X fine compares with other Digital Services Act fines
X was the first platform fined under the Digital Services Act, but it is no longer the largest. Two e-commerce marketplaces have since received bigger penalties for failures in how they assess and mitigate the risk of illegal products, a systemic-risk obligation rather than a transparency one.
| Platform | Date | Fine | Core finding |
|---|---|---|---|
| X | 5 December 2025 | €120m | Deceptive blue checkmark, deficient ad repository, blocked researcher data access |
| Temu | 28 May 2026 | €200m | Failure to assess the risk of illegal products reaching EU consumers |
| AliExpress | 20 July 2026 | €550m | Failure to assess and mitigate risks from illegal, unsafe and counterfeit goods |
The pattern suggests the Commission scales fines to the type of obligation breached as much as to the size of the company. Our report on the record €550m AliExpress DSA fine sets out how the Commission treated risk assessment failures. X's case is different in kind: it tests the transparency rules that make every other part of the DSA auditable, and it is the one being fought hardest in court.
X's challenge in the General Court
X and Musk are asking the EU's General Court to annul the decision, or at least to reduce the fine. Three actions were lodged on 16 February 2026 and published in the Official Journal on 4 May 2026: Case T-114/26, brought by X Internet and X Holdings; Case T-120/26, brought by X.AI Holdings; and Case T-121/26, brought by Musk personally. The decision imposed the €120 million fine on the addressees jointly and severally, which explains why several entities and Musk himself are applicants.
X has described the investigation as "incomplete and superficial" and has alleged grave procedural errors, a "tortured interpretation" of the obligations and breaches of its rights of defence, including what it calls prosecutorial bias. The Commission said at the time that it had taken note of the challenge and was ready to defend its decision.
The legal framework gives the court wide room. Actions for annulment under Article 263 of the Treaty on the Functioning of the European Union test legality: competence, procedure, the correct reading of the law and proportionality. On the fine itself, Article 81 of the Digital Services Act confers "unlimited jurisdiction", which means the court "may cancel, reduce or increase" it. That power to increase is rarely used, but it is a reminder that challenging a fine is not a one-way bet. The General Court has recently backed the Commission on the companion regime, the Digital Markets Act, in Apple's failed challenge to its gatekeeper designation, although every case turns on its own record. Businesses facing similar proceedings usually instruct specialist dispute resolution and litigation counsel alongside their regulatory team.
Why the United States wants to intervene
The United States says the Commission overstepped its territorial jurisdiction and wrongly extended liability to Musk and to American companies with no link to X's services. On 24 September 2026 the Justice Department filed an application to intervene in Cases T-114/26 and T-121/26 under Article 40 of the Statute of the Court of Justice of the European Union, which allows intervention by a person who can establish an interest in the result of a case.
According to the Justice Department's announcement, the US case rests on two arguments:
- Who the "provider" is. The United States questions whether the way the Commission identified the provider of the service is consistent with the limits international law places on a state's jurisdiction over foreign companies.
- Corporate separateness. It argues that the decision improperly reached Musk as a private individual and separate American entities he owns that have no connection with X's digital services, in effect piercing the corporate veil.
Assistant Attorney General Brett Shumate said the Commission had "inappropriately attempted to expand its regulatory authority to reach American companies not present or operating within its jurisdiction". The Commission's reply, through spokesperson Thomas Regnier, was that it is enforcing its legislation "objectively, transparently" on the basis of a solid case and is ready to defend its position in court.
The filing sits within a wider dispute between Washington and Brussels over digital rules. In December 2025 the US State Department imposed visa bans on former Commissioner Thierry Breton, whom it described as the "mastermind" of the DSA, and four others. American authorities have also been active on platform regulation at home, from the antitrust monitor imposed on Google's ad-tech business to disputes abroad such as Apple's challenge to UK encryption demands. The intervention does not change the legal test the court will apply, but it adds the voice of a sovereign state to arguments that X was already making, and US-based clients will want advice from advisers in the USA who understand both systems.
What has happened since the fine: compliance and remedies
X has moved to comply on two of the three findings while it litigates. In mid-July 2026 the Commission accepted X's action plan on the ad repository and researcher access. X committed to better search tools and faster responses for the repository, to publish more advert information with API access, and to give eligible researchers free access through a streamlined process, including by changing terms that barred scraping.
X has six months to implement those measures, after which an independent auditor must report to the Commission. The European Board for Digital Services, which advises the Commission, was less satisfied: it judged the measures "partially adequate" and the audit arrangements and overall plan insufficient. The Commission has said it will monitor implementation closely. For X, this is where periodic penalty payments become a live risk if the Commission later concludes that the plan has not been delivered.
Separately, the Commission's investigation into X's handling of illegal content and information manipulation, opened in December 2023, continues, and in January 2026 it opened new proceedings into Grok, X's generative AI tool, and the platform's recommender systems.
What happens next, and how long it could take
The next step is for the General Court to decide whether to admit the United States as an intervener. If it does, the US will be able to file a statement in support of X's position, but it cannot widen the case beyond the pleas X and Musk have raised. The main timeline so far is below.
| Date | Event |
|---|---|
| 18 December 2023 | Commission opens formal DSA proceedings against X |
| 12 July 2024 | Preliminary findings on checkmark, ads and data access |
| 5 December 2025 | Non-compliance decision and €120m fine |
| 16 February 2026 | X, X.AI Holdings and Musk lodge three actions at the General Court |
| 4 May 2026 | Actions published in the Official Journal |
| Mid-July 2026 | Commission accepts X's action plan on ads and researcher access |
| 24 September 2026 | United States applies to intervene |
After the written procedure, the court may hold a hearing before giving judgment. General Court cases of this kind commonly take well over a year from filing, and any judgment can be appealed to the Court of Justice on points of law. Throughout, the decision remains in force: an action for annulment does not suspend it unless the court orders otherwise, so X's compliance obligations continue while the case runs.
What this means for platforms, counsel and advisers
The practical lesson of why the European Commission is fining X is that the DSA's transparency duties are enforceable obligations, not box-ticking. For in-house counsel at platforms, marketplaces and ad-funded services with EU users, several points follow:
- Audit interface claims. Any badge, label or status that implies verification or endorsement must match what actually happens behind it.
- Treat ad libraries and researcher access as products. The Commission judged usability and speed, not merely whether a tool existed.
- Map the corporate chain. The US arguments show that who is named as the provider, and whose turnover counts, can be as contested as the breach itself.
- Plan for compliance during litigation. Challenging a fine does not pause the duty to comply, and daily penalties can outweigh the original fine.
- Keep records with court scrutiny in mind. Procedural fairness is the heart of X's challenge; careful documentation on both sides decides such cases, as the rising number of sanctions for flawed court filings also shows.
When to take specialist advice
Businesses facing a DSA information request, preliminary findings or a designation decision should involve specialist counsel early, because positions taken during the investigation shape any later court case. Corporate INTL's Find an Expert directory lists technology, media and telecoms advisers, regulatory and public law specialists and competition and antitrust lawyers, as well as lawyers in Belgium who work close to the Commission.
Frequently asked questions
Why is the European Commission fining X?
The Commission fined X €120 million on 5 December 2025 for three Digital Services Act breaches: a paid blue checkmark that deceived users about verification, an advertising repository that lacked required information and was hard to use, and terms and processes that blocked eligible researchers from accessing public data.
What are the fines for non-compliance with the EU Digital Services Act?
The Commission can fine a very large online platform up to 6% of its total worldwide annual turnover for breaching the DSA, and up to 1% for procedural failures such as supplying misleading information. It can also impose periodic penalty payments of up to 5% of average daily turnover to compel compliance.
Who is subject to the Digital Services Act?
The DSA applies to intermediary services offered to users in the EU, wherever the provider is based. The strictest obligations apply to very large online platforms and search engines with at least 45 million average monthly active users in the EU that the Commission has designated. X was designated in April 2023.
Does X have to pay the fine while it appeals?
An action for annulment before the General Court does not automatically suspend a Commission decision. Unless the court orders interim relief, the decision stays in force and X's compliance obligations continue. In EU practice, companies that challenge fines commonly provide a bank guarantee or make a provisional payment pending judgment.
Why has the United States joined the case?
The US Justice Department applied on 24 September 2026 to intervene in Cases T-114/26 and T-121/26. It argues that the Commission's approach to identifying the service provider exceeds limits on territorial jurisdiction, and that the decision wrongly reached Musk personally and separate American companies unconnected to X's services.
Can a non-EU government intervene in an EU court case?
Article 40 of the Statute of the Court of Justice allows any person who can establish an interest in the result of a case to apply to intervene, in support of one party. The General Court decides whether to admit the application, and an intervener cannot raise new pleas beyond those of the party it supports.
Could the court increase X's fine?
Yes, in principle. Article 81 of the Digital Services Act gives the Court of Justice of the European Union unlimited jurisdiction over DSA fines, so it may cancel, reduce or increase them. Increases are rare in practice, but the power means a challenge to a fine carries some risk as well as potential reward.
Is the X fine the largest Digital Services Act fine?
No. X's €120 million fine was the first DSA fine, but the Commission has since fined Temu €200 million in May 2026 and AliExpress €550 million in July 2026, both for failing to assess and mitigate the risk of illegal products on their marketplaces.
Has X changed its blue checkmark in Europe?
According to reporting on the US intervention, X began describing EU subscribers as "premium" rather than "verified" users from May 2026. Separately, the Commission accepted X's action plan on its ad repository and researcher data access in July 2026, giving it six months to implement the changes.
Sources
- European Commission: Commission fines X €120 million under the Digital Services Act (5 December 2025)
- Regulation (EU) 2022/2065 (Digital Services Act), EUR-Lex
- US Department of Justice: United States files request to intervene in case brought by X Corp. and Elon Musk (24 September 2026)
- France 24: EU vows to pursue €120 million fine on X after US backs Musk's court challenge
- The Register: Uncle Sam wants in on Musk's €120M fight with Brussels
- UPI: Justice Department joins fight by Elon Musk's X to overturn EU fine
- EU Law Live: Actions by X and Elon Musk contesting the Commission's decision published in the OJ (4 May 2026)
- Agence Europe: X challenges €120 million fine imposed on it under DSA before EU General Court
- European Commission: Commission accepts X's action plan to comply with the Digital Services Act (July 2026)
- European Commission: Commission fines Temu €200 million for breaching the Digital Services Act
- European Commission: Commission fines AliExpress €550 million for breaching the Digital Services Act
- European Commission: Commission investigates Grok and X's recommender systems under the Digital Services Act
- Euronews: US visa ban targets former EU Commissioner Breton over alleged social media censorship
About this article
This analysis was researched and written by The Corporate INTL Newsroom, which covers cross-border legal, regulatory and business developments for lawyers, professional advisers and financiers in over 150 jurisdictions. It has been checked against the Commission's announcements, the text of the Digital Services Act, the US Department of Justice's statement and primary reporting. The Commission's full reasoned decision and the parties' court pleadings had not been published at the time of writing. This article is general information, not legal advice; for advice on a specific matter, consult a qualified adviser. Last reviewed 26 September 2026. For more analysis like this, visit the Corporate INTL newsroom or subscribe to Corporate INTL.
