The DSA Showed Teeth Against X but the EU Is Afraid to Call It a Win

In the last weeks of 2025, the European Commission issued its first fine under the Digital Services Act (DSA). It notably found that X’s use of its “blue checkmark” for verified accounts deceived users and that it had failed to meet its obligation to maintain a functioning advertising repository. As a result, the European Commission issued a €120 million fine and gave the company three months to comply.

This decision is the culmination of a two-year process, which represents the first full enforcement of provisions of the DSA, a European regulation aimed at, inter alia, mandating transparency and accountability of very large online platforms.

While some skepticism may be legitimate regarding the length and the relative opacity of these proceedings — especially given the European Ombudsman reprimand of the Commission last year on similar grounds — it seems, at first glance, that this first decision illustrates very well what the DSA is intended to achieve. The regulation indeed puts the spotlight on platforms for their deceptive systems and fines them for not complying with transparency.

On such an important milestone, and given the willingness from Europeans to act strongly on redressing the worst excesses of social media platforms, it was clear that a victory could be claimed by the European Commission. After all, one would remember, for instance, how the fines against Google were announced as a European victory for its antitrust regulation.

Unfortunately, with the DSA, the story is being told a different way.

It all starts with how the fine was communicated to the public on 5 Dec. 2025. One could reasonably expect the President and the Vice President of the European Commission to take the stage and announce how Europe can regulate companies infringing European laws. What Europeans got was a simple press release, pushed to journalists on a Friday afternoon and a briefing five days later. On such a landmark regulation, the absence of any political endorsement of such a decision is hard to interpret.

At the beginning of 2026, at EU DisinfoLab, we noticed that the press release about the ruling did not include the legal decision in which the infringements were described in detail, unlike other decisions in the DMA, for instance. We felt that, for transparency reasons and the respect of the rule of justice, it was crucial that this ruling be made public. We believed such publicity would have been a cornerstone to debunk the fanciful and nonsensical disinformation campaigns claiming the EU was censoring speech. This is why, in early January, we submitted a request to access documents through an official procedure that obliges EU institutions to release official documents or formally justify any refusal.

The decision was eventually published in mid-January. Not by the European Commission, but by the US House of Representatives, which released it as part of their crusade against European sovereignty and autonomy.

The decision shows how the Commission has been diligent in requesting all internal documentation from X. It also shows how the Commission relied on multiple packages of evidence provided by European civil society organizations to prove X’s infringements. And how the Commission countered X’s claims that more guidelines were needed for DSA enforcement by stating that the DSA is enforceable as it is. This represents a demonstration of how the Commission has been strong, solid and diligent in its preparation of the case.

We then asked the European Commission, after the US release, why they still haven’t published it. Among the legal exceptions cited in the Commission’s response to our request, the most striking argument to us was its reference to the investigated companies’ commercial interests. The institution stated that such publication “could jeopardize the willingness of undertakings to cooperate with the Commission.”

Reading this statement from the Commission raises another question. Should one read that the Commission is afraid that companies infringing its own regulation would not be willing to be investigated?

Eventually, the decision provided all the enforcement next steps. The company’s to-do list was clear: propose remedies to the infringements and pay the fine, or provide a financial guarantee until its appeal possibilities are exhausted. Paying 120 million euros is not a small amount for a company that, according to Irish media reports, lost 753 million euros in 2022.

According to media reports, X met the initial deadline to offer its first remedies and address the fine. This was another opportunity for the Commission to claim victory. For instance, it could have announced that the fine had been paid or demonstrated that DSA could trigger real consequences for tech companies and Europeans. Instead of this, it remained silent.

Only when asked whether the fine had been paid, the European Commission stressed that X was “cooperating.” And when asked again about the payment modalities of the fine, the answer was that it was not “in the habit of the European Commission of communicating about financial transactions happening between private businesses and the Commission.”

This tone and language are concerning. Given the strong enforcement powers granted by the legislator to the European Commission to deter platforms from breaking the law, what is preventing the Commission from being clear and decisive? Did X pay the fine or provide a financial guarantee? And what would constitute acceptable guarantees for the Commission? And why were none of these details communicated?

Who is more scared of the DSA?

Just last month, at the DSA Observatory conference in Amsterdam, the European Commission told civil society: ”Do not let yourself be scared” by threats, pressure, campaigns and judicial actions targeting them.

Civil society is not scared. It is actually these platforms that should be. In the Netherlands, Bits of Freedom obtained, in court, for Dutch Instagram users, the non-profiling feed mandated by the DSA. In German courts, Democracy Reporting International (DRI) was granted access to X data to research potential manipulations during the Hungarian elections. This demonstrates that only permanent, public, financial and legal pressure can work to force these systems to change.

If European civil society is showing courage with so little protection and support, why is the Commission so afraid to capitalize on its own wins and the wins of others in private enforcement? Is there any willingness to change attitude, especially with some companies publicly misrepresenting EU regulation?

Answering this question is as crucial as winning the legal battles. Europe should show that it’s not intimidated by attempts to attack and undermine its laws. Any timidity would answer the initial question: X has reason not to be afraid of the DSA as long as the Commission is afraid of enforcing it.

Maybe it’s civil society’s role to take the lead, and to say to the Commission: do not let yourself be scared. Democracy, justice and the rule of law can only be enforced if you believe in your own powers. But as the main enforcer of Big Tech platforms, you won’t be able to hide from your own accountability.

At the time of writing, the European Commission has still not published the legal decision on its website.