The European Commission’s first major enforcement action under the Digital Services Act (DSA) offers an early glimpse of how the European Union intends to regulate large digital platforms—and how far that approach may diverge from the U.S. model.
The DSA is an EU regulation governing how online intermediary services operate, including social-media platforms, online marketplaces, app stores, and online booking services. Because it is a regulation rather than a directive, it applies directly across all EU Member States and does not require each country to pass its own implementing law. Rather than focusing primarily on whether specific pieces of content are legal or illegal, the DSA targets how platforms are structured and run. Oversight extends to how “very large online platforms” (VLOPs) design their interfaces, how transparent they are about advertising, and how accessible their data is to outside scrutiny. The DSA classifies platforms with at least 45 million monthly active users in the EU as VLOPs.
The European Commission’s enforcement action against X marks the first major attempt to apply this framework in practice. In April 2023, the Commission designated X (formerly Twitter) as a VLOP pursuant to Article 33(4) of the DSA. In December 2025, the Commission fined X €120 million for “breaching its transparency obligations under the Digital Services Act (DSA).” The Commission cited three alleged infringements: the design of X’s “blue checkmark,” deficiencies in its advertising-transparency tools, and restrictions on researchers’ access to public data.
The decision offers an early case study of how the DSA may be enforced. It also raises broader questions about the scope of EU platform regulation, the role of transparency as a regulatory tool, and the growing divergence between European and U.S. approaches to governing digital markets.
Understanding the decision requires understanding what the DSA does—and does not—do. The regulation does not redefine what speech is legal or illegal; those determinations remain governed by existing EU and national law. Instead, the DSA imposes procedural and structural obligations on large platforms aimed at creating a safer, more transparent, and more accountable online environment. In practice, that means requiring transparency tools, systemic-risk assessments, and data-access mechanisms designed to make platform operations more visible and subject to outside scrutiny.
Brussels vs. the Blue Checkmark
The European Commission’s first finding concerned the design of X’s verification system. Article 25(1) of the DSA prohibits platforms from designing or operating interfaces that deceive or manipulate users, or that materially distort their ability to make free and informed decisions. Recital 67 elaborates on this prohibition by targeting so-called “dark patterns”—interface designs that impair users’ autonomous decision making through their structure or presentation, even if the effect is indirect or unintentional.
The Commission focused on how the blue checkmark functioned within X’s interface. Under Twitter’s earlier system, the checkmark signaled that an account’s identity had been verified. After the platform transitioned to X, verification became subscription-based and involved less vetting. The visual presentation of the “verified” status, however, remained largely the same.
In the Commission’s view, this continuity preserved the checkmark’s historical meaning, even though the underlying verification process had changed. As a result, users could continue to interpret the symbol as indicating that an account had undergone the same identity checks as before:
(87)“The results demonstrate a significant mismatch between perceptions and reality: more than half of respondents misunderstand Twitter’s blue check verification policies to still require proof of identity”
The Commission also evaluated the design in its broader context, as Recital 67 requires. Verification symbols, it noted, function across platforms as indicators of authenticity. Major services commonly use them to signal that an account belongs to a genuine public figure, brand, or institution:
(91) “The Commission therefore took the view that the design, organisation and operation of X’s online interface is deceptive to X’s recipients, since the provider of X materially changed the verification process as compared to cross-industry standards”
X did take steps to clarify the new meaning of the “verified” label. The platform provided explanatory information and introduced certain safeguards after redesigning the verification system. The Commission nevertheless concluded that these measures did not overcome the visual and historical cues associated with the symbol. The decision also did not explain how a platform could measure or neutralize such effects ex ante, leaving the compliance standard somewhat unclear.
The Commission further emphasized that verification status interacts with platform architecture. Accounts labeled “verified” may receive greater visibility or perceived authority through ranking and recommendation systems. In that context, ambiguity about the symbol’s meaning could have an outsized effect on user decision making. Disclosure measures, the Commission concluded, did not adequately prevent users from treating the label as a signal of authenticity.
Notably, the Commission did not claim that X’s verification system facilitated illegal or harmful speech. The concern instead centered on how the design affected users’ understanding of information. The persistence of the verification symbol, in the Commission’s view, preserved a meaning that no longer corresponded to the underlying verification process.
Diverging Regulatory Philosophies
This reasoning reflects a broader divergence between European and American approaches to regulating digital platforms.
Under the DSA, large-scale distortions in user understanding can justify regulatory intervention even without a demonstrated connection to unlawful outcomes. The focus lies on platform design and systemic effects.
U.S. constitutional law takes a different starting point. Lawful speech is presumptively protected under the First Amendment, even if audiences misunderstand it. The constitutional framework assumes that individuals may encounter misleading claims and evaluate them independently without government redesign of the communicative environment.
Misunderstanding alone rarely justifies regulation under U.S. law. Even commercial speech—subject to somewhat reduced constitutional protection—can generally be restricted only when it involves materially misleading claims that risk concrete consumer harm. The U.S. Supreme Court has also recognized that some false statements fall within First Amendment protection. In United States v. Alvarez, the Court held that the First Amendment protected a man’s false claim that he had received the Congressional Medal of Honor, emphasizing that the Constitution does not allow the government to suppress speech simply because it is false.
A similar principle appears in U.S. consumer-protection law. Liability under Section 5 of the Federal Trade Commission Act typically requires a materially misleading practice that causes—or is likely to cause—concrete consumer harm. The Federal Trade Commission’s (FTC) deception standard focuses on material misrepresentations that consumers rely on to their detriment, not mere misunderstanding.
Viewed through that lens, user confusion about verification badges reflects uncertainty about a platform signal, rather than unlawful conduct. The contrast highlights a broader shift that commentators have identified in European competition policy. Recent analyses—including discussions surrounding the Commission’s draft guidance under Article 102 of the Treaty on the Functioning of the European Union (TFEU)—suggest that enforcement increasingly relies on structural presumptions rather than effects-based analysis centered on demonstrated consumer harm.
From an American perspective, requiring platforms to mitigate the effects of lawful but misunderstood signals risks blurring the line between regulating platform architecture and indirectly shaping permissible expression.
Extraterritorial Effects
This broader debate has drawn attention in the United States. Some lawmakers have characterized the Digital Services Act as part of what the House Judiciary Committee described as a “foreign censorship threat.” Their concerns extend beyond the removal of illegal content. Critics argue that provisions such as Article 22—which grants priority status to government-designated “trusted flaggers”—may encourage platforms to align moderation practices with European regulatory preferences.
The evidentiary basis in the decision reinforces these tensions. In paragraph 87, the Commission cites a study finding that more than half of respondents misunderstand the blue-checkmark system. The study surveyed 299 U.S. residents, even though the enforcement action concerns systemic risks to EU users.
The DSA applies to companies outside the European Union that offer services to EU users, so relying on non-EU evidence is legally permissible. At the same time, the regulation was designed to address risks affecting “European users in their everyday lives.” Evidence drawn exclusively from American respondents complicates the claim that the enforcement action targets harms specific to the European market.
U.S. lawmakers have seized on this dynamic. Critics argue that “the threat to American speech is clear,” contending that European regulators may classify political speech, humor, and other First Amendment-protected expression as “disinformation” or “hate speech,” and then require platforms to adjust their global moderation systems accordingly.
Reporting in The New York Times suggests that some EU officials and experts hope the DSA’s influence will extend beyond Europe. The goal, in that view, is to shape platform policies globally.
If so, the implications extend well beyond the European Union. Structural obligations under the DSA could reshape platform architecture worldwide, influencing speech environments in jurisdictions built on materially different constitutional traditions.
Advertising Transparency, No Harm Required
The Commission’s second finding concerned X’s alleged failure to comply with the DSA’s advertising-transparency requirements. These rules reflect the European Union’s concern that large-scale online advertising systems may generate systemic risks.
Recital 68 treats advertising transparency as a tool to address risks associated with targeted advertising, including illegal advertising, discriminatory outcomes, and the amplification of harmful content. Recital 95 emphasizes that advertising systems operated by very large online platforms (VLOPs) pose particular risks because of their scale and their ability to target users based on behavior both within and beyond the platform.
To address those risks, the regulation requires heightened transparency and oversight. Article 39 mandates that VLOPs maintain a publicly accessible advertising repository. In practical terms, this repository functions as a public database of advertisements displayed on the platform. It allows outside observers to see which ads ran, who paid for them, when they appeared, and how they were targeted. The goal is to make advertising practices visible enough to permit public scrutiny and regulatory oversight.
Why the Commission Found X Noncompliant
Article 39 also specifies how the repository must operate. Under Article 39(1), it must be searchable and reliable. Article 39(2) requires platforms to allow searches and filtering across multiple criteria, including advertiser identity, subject matter, and time period, and to make the system robust enough to support systematic analysis. The regulation also requires access through an API—an application programming interface—that allows researchers and regulators to retrieve large volumes of advertising data automatically.
Applying this framework, the Commission concluded that X failed to comply with Article 39. Although the platform maintained an advertising repository in formal terms, the Commission found that it did not function as an effective transparency tool.
The repository did not permit comprehensive multicriteria searches across all the information required under Article 39(2). The Commission also found that the API lacked access to the full set of advertising data. As a result, researchers and regulators could not conduct systematic or large-scale assessments of advertising practices on the platform. In the Commission’s view, these limitations substantially reduced the repository’s practical value and undermined the transparency goals of Article 39.
Architecture Regulation vs. Harm-Based Enforcement
This finding reflects a regulatory approach that prioritizes structural transparency in platform architecture. Enforcement does not require proof that any particular advertisement was unlawful. A platform may face liability even when no illegal advertisement has been identified and no specific harm has been demonstrated.
The U.S. regulatory framework approaches advertising infrastructure differently. In the United States, online advertising practices are typically governed through unfairness, deception, and privacy standards. Liability generally arises when advertising is misleading, disclosures are inadequate, or consumer data is misused. The law rarely imposes affirmative design mandates on how an advertising system must be structured or publicly disclosed absent such wrongdoing.
Advertising systems can also intersect with expressive concerns. Decisions about how advertisements are selected, categorized, prioritized, and presented may involve elements of editorial discretion. In the United States, those choices can raise First Amendment considerations, even if indirectly.
For that reason, structural transparency mandates imposed without a showing of harm can appear disproportionate from an American perspective. Disclosure becomes an end in itself, rather than a tool for identifying unlawful conduct. When no illegal advertisement has been identified, requirements aimed at redesigning platform architecture may seem less like consumer protection and more like regulatory oversight of lawful activity.
The DSA’s Researcher Data Pipeline
The European Commission also relied on Article 40(12) of the Digital Services Act, which requires platforms to grant qualified researchers access to publicly accessible data in order to facilitate research into systemic risks associated with very large online platforms.
“Publicly accessible data” refers to information visible to ordinary users of the service, such as public posts, engagement metrics, and other content that can be viewed without special privileges. Although individual users can see this information through the platform interface, researchers typically require technical tools—such as APIs—to collect and analyze it at scale.
Article 40(12) creates a formal access mechanism for that purpose. Platforms must provide access without undue delay when a researcher satisfies the criteria for designation as a “Qualified Researcher.” These criteria are designed to ensure that the research serves a legitimate public-interest purpose and is conducted responsibly.
To qualify, researchers must demonstrate independence from commercial interests, disclose their funding sources, and commit to complying with data-protection, confidentiality, and cybersecurity requirements. They must also show that the requested data access is necessary and proportionate to a defined research project aimed at studying systemic risks under the DSA, such as the spread of illegal content, the effects of recommender systems, or risks to public discourse and electoral processes.
Researchers who meet these conditions may obtain structured access to platform data in order to conduct large-scale analysis.
The Commission’s Findings
The Commission concluded that X’s implementation of Article 40(12) fell short in several respects.
First, it found that X interpreted the eligibility criteria for Qualified Researchers too narrowly (Section 6.3.2.1). According to the Commission, X imposed additional conditions related to institutional affiliation, geographic location, and disclosure requirements that are not explicitly required by the DSA. While Article 40 allows platforms to verify applicants, the Commission determined that X’s approach went beyond verification and materially reduced the pool of eligible researchers.
Second, the Commission found that access granted to approved researchers was too limited in scope and duration. Restrictions on scraping and API functionality made large-scale analysis of public data difficult. In the Commission’s view, access that exists in theory but cannot be used effectively in practice does not satisfy Article 40(12).
These findings have become central to debates surrounding the Digital Services Act. X and several American commentators argue that provisions like Article 40 effectively require predominantly U.S.-based platforms to provide large-scale data access under EU regulatory supervision.
Disclosure Without Demonstrated Harm
The legal baseline in the United States differs significantly. Even when information is publicly visible to users, platforms generally retain broad discretion to restrict scraping, limit API access, or condition access on contractual or commercial terms.
Several legal and policy considerations help explain this difference.
First, mandatory API access can weaken proprietary control over commercially valuable data systems. In the United States, disputes over large-scale data access usually arise under private-law mechanisms—such as terms-of-service agreements and computer-access rules—rather than public-law obligations to provide standardized APIs.
Second, broad API mandates may create security risks. As cybersecurity analysts note, “the ubiquity of APIs brings security risks by expanding an organization’s attack surface, making them a prime target for hackers.”
Third, disclosure mandates can expose commercially sensitive information. Transparency rules that reveal advertiser identity, campaign activity, or targeting parameters may disclose proprietary strategies.
U.S. courts typically require a close connection between compelled disclosure and a concrete regulatory objective—such as preventing fraud, avoiding corruption, or informing voters in campaign-finance contexts. Disclosure obligations generally serve as tools to address identifiable harms.
Article 40 reflects a different regulatory logic. The DSA treats structured data access as a preventive mechanism designed to enable oversight and research into potential systemic risks. Critics argue that this approach risks turning disclosure into an end in itself rather than a tool for addressing concrete wrongdoing.
The Preventive Turn in EU Platform Regulation
The European Commission’s decision illustrates how the Digital Services Act governs platforms through an ex ante, risk-based regulatory model. The finding against X does not rest on evidence of concrete harm. Instead, the Commission concluded that certain design choices, transparency failures, and restrictions on data access could contribute to systemic risks affecting public discourse.
This preventive logic marks a notable shift from frameworks that intervene primarily in response to demonstrated harm. Rather than focusing on identifiable injury, the DSA adopts a more top-down approach to platform governance. Authorities may impose obligations based on assessments of systemic risk and presumptions about potential harm. Under this model, platform practices may be sanctioned because they could distort user understanding or limit external scrutiny at scale.
The same ex ante logic appears in other EU digital regulations, including the Digital Markets Act (DMA). Taken together, these rules suggest a broader shift in the European Union’s regulatory philosophy toward preventive oversight of digital platforms.
Viewed from the United States, the approach looks different. American law generally affords private platforms greater discretion over design choices and the organization of speech-related services. Transparency mandates and data-access obligations imposed without evidence of harm therefore raise questions about the appropriate balance between preventive regulation and platform autonomy.
Those tensions become particularly salient where expressive activity is involved. When regulatory obligations reshape platform architecture, they can indirectly shape the conditions under which speech is distributed and understood.
