A Procedural Win, Not a Finish Line
On July 15, 2026, the European Commission accepted X's corrective action plan to resolve two of the three Digital Services Act (DSA) violations that earned the platform a €120 million fine on December 5, 2025 — the first non-compliance decision issued under the DSA. The case is a useful test of whether the EU's flagship platform law can produce durable technical fixes rather than just headline-grabbing penalties.
What X Actually Broke
The Commission's December decision found X in breach of three obligations: deceptive design in its paid "blue checkmark" verification badge, an advertising repository too sparse and unreliable to support scrutiny, and researcher-access procedures that functioned as a barrier rather than a gateway. The latter two findings map to specific statutory duties — Article 39's public ad-repository requirement and Article 40(12)'s researcher-vetting obligation, both aimed at letting outside researchers study how ads and content amplify disinformation and other systemic risks at platform scale.
Those two obligations are the substance of this week's approval. X committed to a five-part fix for the ad repository: better search filters by ad content and targeting criteria, results displayed directly in the interface instead of exported spreadsheets, response times cut from roughly 200 seconds toward the technical minimum, fuller ad content and redirect-URL disclosure, and API access. On researcher access, X agreed to overhaul its applicant screening, grant qualified researchers free data access, speed up processing, and clarify that its terms of service do not bar collection of public data — addressing the Commission's finding that X's own anti-scraping terms had been used to chill exactly the kind of independent monitoring Article 40 exists to enable.
The Steelman for the EU's Approach
Critics of DSA enforcement often frame it as arbitrary censorship pressure on X in particular. That framing understates what the ad-repository and researcher-access provisions were built to do. Ad repositories are the primary tool independent researchers, journalists, and civil-society groups use to detect coordinated disinformation buys, political ad-spend dark money, and scam networks before they scale — work national regulators and platforms themselves are poorly positioned to do alone. A repository that returns results only as opaque spreadsheet exports, or takes over three minutes to respond, is functionally useless for that purpose. Reporting from Tech Policy Press notes X's researcher-access program had rejected 95.8% of applications before this ruling — a rejection rate that, whatever the cause, left the statutory access right largely theoretical. If the EU's diagnosis is correct, this was less a free-speech dispute than an information-plumbing failure, and forcing a fix is a defensible use of transparency law rather than a speech-code overreach.
Why the Process Still Deserves Scrutiny
Even granting that diagnosis, the enforcement architecture bears real costs that a pro-innovation editorial line should not wave away. X now has six months to implement the plan and a further six months after that to deliver an external audit — a full year, on top of the seven months already elapsed since the December fine, before the Commission can confirm the violations are actually cured. For a platform obligation tied to detecting live disinformation campaigns, an 18-month remediation runway from violation to verified fix is slow by the standards of the problem it's meant to solve. Elections, ad-fraud waves, and coordinated influence operations do not pause for compliance audits.
There is also a asymmetry worth flagging: the Commission's non-compliance procedure, as Tech Policy Press's analysis of the ruling observes, extends functional liability up the corporate chain and relies heavily on independent academic studies rather than disclosed evidentiary standards — useful for building a case, but opaque to the platform trying to anticipate what "compliant" looks like before a fine lands. A predictable rulebook, published in advance, would let VLOPs build compliant ad-repository architecture the first time rather than retrofitting it under a penalty clock. That is not an argument against the substance of Articles 39 and 40; it's an argument that the DSA's enforcement posture still leans more punitive-then-corrective than the clear-standards-first model that tends to produce durable compliance without chilling product iteration elsewhere on the platform.
The Bottom Line
The underlying obligations here — a searchable ad repository, real researcher access to public data — are proportionate and well-targeted; they attack the actual mechanism by which disinformation networks evade detection, not speech itself. The EU deserves credit for pairing a fine with a concrete technical remediation plan rather than settling for a symbolic penalty. But a regulatory regime that takes 18 months from violation to verified fix, atop opaque case-building, is still slower and murkier than the systemic risks it targets warrant. The Commission's next test is not whether it can extract commitments from X — it already has — but whether the audit due in roughly a year actually confirms the ad repository works, or whether "accepted" quietly becomes the last headline anyone reads on this case.