The European Commission announced Friday that X has been fined €120 million ($140 million) for violating the European Union’s sweeping digital transparency rules—an enforcement that lands with the force of a regulatory thunderbolt. The Commission accused the platform of “deceiving” users through its paid blue check verification system and flouting core obligations under the Digital Services Act, the bloc’s groundbreaking online-safety regime.

EU Says X Misled Users With Paid Checkmarks

Under the DSA, platforms must avoid deceptive design practices, a mandate the Commission says Elon Musk’s X clearly breached. According to the findings, any user can purchase “verified” status without the company meaningfully confirming their identity.

That system, the Commission said, transforms the blue checkmark—from once a trust badge—into a Trojan horse.

“This deception exposes users to scams, including impersonation frauds, as well as other forms of manipulation by malicious actors,” the Commission wrote, underscoring how the paid badge muddies users’ ability to assess authenticity.

While the law does not require platforms to verify users, it does prohibit falsely suggesting that verification has taken place.

Transparency Failures in Ads and Research Access

The ruling also blasted X for major gaps in its advertising transparency repository, which should allow investigators to trace the origin, sponsor and purpose of ads. Instead, the repository was found missing key elements including ad topics, funders, and timely access.

These deficiencies, combined with long delays for researchers seeking entry, undermine the ability to detect disinformation campaigns, fake ads, coordinated manipulation, or hybrid threat operations.

The Commission further said X was blocking researchers from accessing public data by imposing unnecessary restrictions and embedding barriers in its terms of service, including preventing public-data scraping by qualified academics.

X did not immediately respond to requests for comment.

A First-of-Its-Kind Fine Under Europe’s Tough New Rules

The €120 million penalty is the first ever issued under the Digital Services Act, a 2022 law designed to tighten oversight of tech giants and shield users from harmful content. The Commission opened its investigation into X in 2023, probing potential failures across illegal-content controls, disinformation monitoring and transparency mandates.

The act works in tandem with the Digital Markets Act as part of the EU’s global push to rein in the power of large online platforms—which European regulators increasingly describe as operating with outsized influence over politics, commerce and public discourse.

X Among the EU’s Most Heavily Regulated Platforms

X is one of 17 designated “very large online platforms”, a category for services with massive reach and heightened systemic risk. Reports indicate X had 112 million monthly active European users in 2023, placing it firmly within the DSA’s strictest tier.

Under the act, these platforms must:

• Provide simple tools for users to report illegal content

• Implement risk-mitigation systems tailored to misinformation

• Offer researchers reliable, timely access to data

• Maintain fully transparent, searchable ad repositories

The Commission’s first DSA designations, adopted in April, named platforms including Amazon, Apple’s App Store, LinkedIn, Google Search, Bing and numerous Meta-owned services such as Facebook and Instagram.

The ruling against X signals that Brussels intends to enforce its new digital rulebook aggressively—and that the age of light-touch governance for tech giants in Europe is officially over.