The European Commission's preliminary findings against X — first issued in July 2024 and now grinding through the next phase of formal proceedings — have become the defining stress test of the Digital Services Act (DSA). For the first time since the DSA's obligations on Very Large Online Platforms (VLOPs) took effect in August 2023, Brussels is attempting to translate the regulation's sweeping text into a concrete enforcement decision against a single company. How the Commission handles this case will shape the next decade of intermediary liability law in Europe — and, by extension, globally.
What the Commission Actually Alleges
The preliminary findings, announced by then-Commissioner Thierry Breton, identified three areas where X is said to fall short of its DSA obligations:
- The blue checkmark redesign. The Commission argues that X's decision to allow any paying user to obtain a 'verified' blue tick — historically a signal of authenticated identity — constitutes a 'dark pattern' that deceives users and undermines the DSA's anti-manipulation rules.
- Advertising repository failures. VLOPs must maintain a searchable, machine-readable ad library so journalists, researchers and competitors can scrutinise paid content. The Commission says X's repository is incomplete and not effectively searchable.
- Researcher data access. Article 40 of the DSA gives vetted academic researchers the right to query platform data on systemic risks. The Commission alleges X's terms of service and API pricing structure make this practically impossible.
Critically, none of these findings target what X hosts. They target how the platform is designed and how transparent it is about its own operations. That distinction matters enormously.
A Welcome Shift Away From Speech Policing
For all the heat the DSA has generated, the X case demonstrates something the regulation's defenders have long argued: at its best, the DSA is not a content-moderation mandate. It is a transparency and due-process regime. The Commission is not telling X what posts to remove. It is asking the company to be honest about who is verified, who pays for ads, and how outsiders can audit its systemic effects.
That is a legitimate and proportionate use of intermediary liability law. The pre-DSA debate in Europe often slid toward 'notice-and-staydown' obligations and aggressive removal mandates that risked over-blocking lawful speech. The DSA — at least on paper — moved the centre of gravity to procedural fairness, risk assessments and researcher access. The X proceeding is the first real chance to anchor that interpretation in case law.
Where the Commission Risks Overreach
That does not mean the case is without dangers. Three in particular deserve scrutiny from anyone who cares about a competitive, innovative internet.
1. Design choices are not always deception
The Commission's 'dark pattern' theory on blue checks is novel. Reasonable people can disagree about whether monetising verification badges is misleading or simply a different — and openly disclosed — product choice. Treating any departure from a prior industry convention as a deceptive design risks freezing platform UX in 2022 amber. Regulators should distinguish between hidden manipulation and visible, contested product decisions.
2. Process risks for non-incumbents
X is a uniquely scrutinised platform, but the precedents set here will apply to every VLOP — including smaller European challengers that may one day cross the 45-million-user threshold. If the Commission can pursue multi-year proceedings with fines of up to 6% of global turnover over interface design, smaller entrants will rationally route around the EU or remain below the VLOP threshold. That is the opposite of what European digital sovereignty advocates say they want.
3. Researcher access must be operationalised, not litigated
Article 40 is one of the DSA's most promising provisions, but the implementing delegated act — adopted only in 2025 — leaves significant uncertainty around vetting, costs and liability. Suing platforms over inadequate access while the framework is still being defined puts the cart before the horse. The Commission and EDMO should publish clear technical templates before any final infringement decision lands.
What a Proportionate Outcome Looks Like
A sensible resolution would lock in the case's transparency wins while avoiding speech-adjacent escalation. That means:
- A binding commitment from X to fix the ad repository to a published technical spec, not a vague standard.
- A negotiated, public researcher-access programme — ideally one other VLOPs can adopt.
- Disclosure remedies on verification (clear labelling of paid vs. identity-verified accounts) rather than a ban on the product feature itself.
- Any monetary penalty calibrated to the procedural breaches, not used as a proxy punishment for editorial decisions or executive rhetoric.
The DSA was sold to European citizens as a rulebook that would make platforms more accountable without turning Brussels into a speech regulator. The X case is the moment that promise is tested. If the Commission lands a clean, narrowly-drawn enforcement decision focused on design transparency and researcher access, the DSA will emerge stronger and the open internet will be better for it. If the case drifts into punishing a platform for being editorially unpopular, every future enforcement action — against TikTok, Meta, Temu or a future European champion — will inherit that political baggage.
Intermediary liability done right is boring, procedural and predictable. That is exactly what Europe should aim for here.