A Six-Month Probation, Not a Clean Bill
On July 15, 2026, the European Commission accepted X Corp's action plan to fix transparency breaches under the Digital Services Act (DSA), closing out the enforcement track that began with a €120 million fine on December 5, 2025 — the first non-compliance decision issued under the law. That fine targeted three failures: a paid "verified" checkmark the Commission said deceived users and fueled impersonation scams, an ad repository too sparse and slow to let researchers scrutinize political and commercial advertising, and terms of service that blocked independent researchers from accessing public platform data, in violation of DSA Article 40(12) (Commission fines X €120 million). X was given 60 working days to address the checkmark issue and 90 to submit a full plan on the rest (eucrim).
The plan the Commission accepted commits X to better ad-repository search filters, in-interface results instead of raw spreadsheets, free API access for eligible researchers, and faster application turnaround. X now has six months to implement it, under an "enhanced supervisory regime" that includes an independent external audit whose findings go straight to the Commission (Commission accepts X's corrective measures).
The Part That Should Give Regulators Pause
Here is the awkward detail: the Board for Digital Services — the EU body of national regulators that reviews these plans — found X's proposal only partially adequate, and flagged the audit provisions specifically as insufficient to close out the infringement. The Commission accepted the plan anyway, layering on the six-month supervision period as its answer to the Board's reservations rather than rejecting the plan and demanding a rewrite.
Steelmanning the EU's Approach
The underlying complaints are not manufactured. A paid verification badge that signals authenticity while doing nothing to confirm identity is a genuine deceptive-design problem, and impersonation scams riding on blue checkmarks are a documented harm, not a hypothetical one. An ad repository that omits who paid for an ad and what it targeted is not meaningfully a repository at all — it defeats the purpose Article 39 exists for, which is letting outside researchers and civil society catch coordinated influence operations and predatory targeting before they scale. And a terms-of-service clause that blocks vetted academic researchers from public data isn't protecting user privacy; it's protecting the platform from scrutiny. Disclosure mandates of this type — publish your ad library, let researchers query your API — are also the least speech-restrictive form of platform regulation available. They don't touch what X allows users to post; they touch what X discloses about how its business works. That distinction matters enormously from a pro-speech standpoint, and it's worth being honest that this is a much easier case to defend than the EU's content-related DSA provisions.
Where the Caution Belongs
The problem isn't the substance of the fixes — it's the process. When a regulator's own technical advisory board says a remediation plan doesn't meet the bar, and the regulator approves it anyway while adding supervision as a patch, it tells every other regulated firm that the Board's opinion is advisory in the softest sense: a factor to be weighed, not a gate to pass. That undermines exactly the kind of predictable, rules-based enforcement that lets companies plan compliance investment with confidence, and it hands critics of the DSA — who already argue the law is enforced by political feel rather than fixed standard — a concrete data point. A six-month audit clock is a reasonable compromise if the Commission is prepared to reopen the fine question when that audit lands short; it becomes regulatory theater if "enhanced supervision" quietly becomes the permanent state of affairs.
The US Has No Equivalent — and Isn't Building One
X is a US company, and none of this obligation exists domestically. The closest analogue, the Platform Accountability and Transparency Act, was reintroduced by Senators Chris Coons and Bill Cassidy on January 7, 2026 — the same basic bundle of a researcher-access safe harbor and public ad/virality databases that the DSA now compels by force of law (Knight First Amendment Institute). PATA has now been reintroduced in some form in nearly every Congress since 2022 without reaching a floor vote (Tech Policy Press). That leaves American researchers and users dependent on X choosing to extend its EU-mandated ad-library and API changes globally — something platforms sometimes do for engineering simplicity, and sometimes don't.
Bottom Line
The substance of what X was made to fix — deceptive verification badges, an unusable ad archive, researcher lockout — was worth fixing, and a disclosure-based remedy is the right tool for the job. But an enforcement process that overrides its own expert board's adequacy finding, rather than sending the plan back, trades a clean precedent for a murky one. Congress, meanwhile, has spent four years failing to legislate the parts of this it could pass without any First Amendment complications at all.