The European Commission has hit Elon Musk’s social network X with a €120 million fine after a two-year probe found the platform had misled users, hidden details about advertising and blocked researchers from accessing public data — the bloc’s first major enforcement under its landmark Digital Services Act.

At the heart of the Commission’s case is a redesign of X’s blue checkmark. Once a widely understood signal that an account belonged to a verified public figure or organisation, the badge was turned into something anyone could buy. That change, the Commission concluded, “deceives users”: by letting people pay for the mark without meaningful identity verification, X made it harder for users to judge whether an account — and the content it spreads — is authentic, the EU said. Regulators warned this opens the door to impersonation scams and other manipulation.

The penalty isn’t just about symbols. Brussels found X fell short on two other fronts required by the DSA: it did not make its advertising repository sufficiently transparent, and it restricted researchers’ access to public platform data that’s vital for independent scrutiny of ads and information operations. The Commission argued these failures together undermined users’ ability to detect scams, coordinated manipulation and other harms that flourish in the dark.

The decision is procedural but consequential. The Commission has given X 60 working days to present specific fixes for the blue-tick issue (and a longer window to remedy other breaches), and warned that failure to comply could trigger periodic penalty payments. The fine — while significant — is far short of the brutal ceilings the DSA allows (platforms can be fined up to 6% of global turnover in the worst cases), a point Brussels weighed carefully as it navigates both legal and political consequences.

For X, the ruling arrives after a bruising regulatory run. The EU opened formal proceedings into the company in December 2023, and those preliminary findings about “dark patterns” and limited transparency have been on the table since mid-2024. X repeatedly argued it was trying to comply — adding disclaimers to the checkmark and flagging adjustments to its ad disclosures — but regulators found those steps didn’t go far enough.

Politically, the case has already spilled beyond Brussels. In the United States, Vice-President JD Vance posted on X that the EU “should be supporting free speech not attacking American companies,” calling the reported violations “garbage,” and prompting a public thanks from Elon Musk, who has amplified calls for legal pushback against the Commission. The exchange underlines how the fine sits at the intersection of tech regulation and geopolitics: enforcing European digital rules has become a diplomatic balancing act when the platforms involved are entwined with U.S. political figures and policy debates.

That geopolitical tangle is more than theatre. Ireland — where many big tech companies house their European operations — has opened its own DSA probe into X’s complaint-handling and moderation processes, and policy shifts elsewhere are reshaping the global tech environment: Australia, for one, is rolling out strict age restrictions for social media users under 16 that will come into force this month, a move that puts further pressure on platforms to align features and safety measures with local laws. Regulators and lawmakers worldwide are watching how Brussels enforces the DSA; the X case will be a reference point for future actions against other companies.

For users and researchers, the practical implications are concrete. If platforms can’t be trusted to label identity and sponsorship clearly, ordinary people are easier to fool; if ad libraries aren’t comprehensive and accessible, watchdogs and academics can’t spot fraud, political influence operations or the kinds of targeted scams that exploit opaque ad targeting. The Commission framed its ruling as a defence of the information environment: deceiving users, obscuring information and shutting out independent scrutiny “have no place online in the EU,” executive vice-president Henna Virkkunen said.

X now faces two broad paths: accept the sanctions and design fixes that satisfy EU requirements for transparency and verification, or contest the findings in the courts while continuing to push back politically. Either route will be costly: besides the headline fine, non-compliance can trigger recurring payments and further penalties, and the reputational hit could accelerate advertiser caution and user churn. For regulators, the case is a test of the DSA’s teeth — whether a regulatory regime written to tame digital harms can actually rewire the incentives of one of the most prominent social platforms.

There’s fresh urgency to that experiment. Platforms are no longer judged solely in terms of clicks and growth; they are infrastructures that shape public conversation, election seasons and consumer safety. If the EU’s ruling forces X to reintroduce meaningful verification, broaden ad transparency and open its datasets to legitimate research, it could set new design expectations across the industry. If it doesn’t, the precedent will be more ambiguous — and regulators will have to decide whether to escalate fines or take new legal tacks. For users, researchers and regulators, the next few months will show whether the DSA is a regulatory statement or a durable tool for reshaping the modern internet.