Legal

EU metes out first-ever Digital Services Act fine, dings X for blue check deception

TikTok, by contrast, satisfied DSA concerns over its ad repository transparency

The European Union has issued its first-ever Digital Services Act fine, slapping Elon Musk's X with a €120 million penalty for breaching the bloc's rules on ad transparency, data access for researchers, and its revamped blue-checkmark system.

The fine, equivalent to $140 million, comes two years after the EU began investigating X for what the Commission said at the time were concerns over the Musk-owned network's handling of "risk management, content moderation, dark patterns, advertising transparency, and data access for researchers." The fine issued Friday concerns advertising transparency and researcher access to data, as well as X's overhaul of its blue check account verification system, which the EU said violates the DSA's provisions on deceptive design practices. 

For those who've opted to purge their memory banks to make room for more valuable information, X, when it was still known as Twitter before Musk bought it, used to reserve blue check marks for accounts deemed noteworthy and needing protection from impersonation. Musk changed all that in a bizarre bid to make blue checks less exclusive, rendering them nothing more than the mark of someone willing to pay for a premium X subscription.

The move led to chaos as paid blue-check accounts impersonated brands, bots multiplied, and users were left unsure who to trust, one of several issues that drew the EU's scrutiny under the DSA.

The DSA, enacted in 2022 alongside the Digital Markets Act, laid out rules for online platforms to follow regarding illegal content, disinformation, and other systemic risks. It applies to all online intermediaries, with extra obligations for any company deemed a very large online platform, or VLOP - a list that includes X regardless of Musk's decision to pull the platform out of participation in the EU's voluntary disinformation code. 

Regardless of whether Musk wants to play ball, the European Commission has still decided that X's handling of its former account verification system "exposes users to scams, including impersonation frauds, as well as other forms of manipulation by malicious actors" because anyone willing to pay the subscription fee can pass themselves off as verified, provided that they have a display name, profile photo, confirmed phone number and "no signs of being misleading or deceptive." It's not going to stop determined fraudsters.

"While the DSA does not mandate user verification, it clearly prohibits online platforms from falsely claiming that users have been verified, when no such verification took place," the Commission said in its press release announcing the fine. 

In addition to the blue check bungling, X was also fined for a lack of transparency in its ad repository, which the Commission said is designed with barriers to access that undermine the point of ad repositories. 

"Accessible and searchable ad repositories are critical for researchers and civil society to detect scams, hybrid threat campaigns, coordinated information operations and fake advertisements," the Commission said. X's ad repository lacks certain critical information, the EC noted, including the content, topic, and "legal entity" paying for use of the advertising space, all of which hinders accountability. The company was also chided for "excessive delays in processing" ad transparency requests. 

The Commission also fined X for limiting the ability of researchers to access public data on the platform (e.g., posts, etc) because its terms of service "prohibit eligible researchers from independently accessing its public data, including through scraping." 

As with the ad repository, X has also imposed "unnecessary barriers" on researchers seeking access to the platform, "undermining research into several systemic risks in the European Union." 

The Commission gave X 60 working days to explain how it intends to deal with its blue checkmark deception, and 90 working days to address regulators' concerns over the ad repository and researcher access. If the company chooses not to get into compliance, Commission spokesperson Thomas Regnier told The Register, it'll become subject to "periodic penalty payments." 

"This is X's choice," Regnier told us. "X did not offer any formal commitments, hence today's fine." 

While Musk hasn't publicly commented on the fine yet, he did retweet a comment by FCC chair Brendan Carr, who called it Europe "fining a successful U.S. tech company for being a successful U.S. tech company" and "taxing Americans to subsidize a continent held back by Europe's own suffocating regulations." 

US Vice President JD Vance also commented on the matter, saying the EU was fining X "for not engaging in censorship," while completely missing the fact that the fine was levied for X restricting access to information that EU law requires to be open and free. 

Asked whether it was concerned over the possible further inflammation of tensions between the EU and US over yet another US tech company being fined for violating the bloc's rules, the Commission was firm in its stance that it has the right to enforce its own laws on foreign companies operating in its space. 

"We have always been clear," Regnier told us. "We have the sovereign to legislate and to enforce our legislation, which we are doing. The DSA applies equally to all online platforms offering their services in the EU."

While X is facing a fine for not complying with the EU's DSA transparency rules, TikTok entered into an agreement with the Commission on Friday to put its advertising repository in line with the DSA.

The Commission said on Friday that TikTok had made binding commitments to the EU that address all of its ad transparency concerns, meaning the platform will be able to continue operating in the EU without facing a fine on that issue.

X didn't respond to a request for comment on the matter. ®