X's €120M Fine Was About Researcher Data, Not Blue Checks

The European Commission handed X a €120 million fine (about $145 million at then-prevailing rates) on December 5, 2025, and the press release led with blue checks and ad transparency. The story that mattered was the third charge: X had spent years refusing to let qualified researchers see the platform's public data, in violation of Article 40 of the Digital Services Act. The Commission's July 15, 2026 acceptance of X's remediation plan, after X's appeal, reportedly filed February 20, 2026, is what turns that fine from a penalty into a mechanism.

Article 40 of the DSA, the EU's content-moderation rulebook for the largest online platforms, gives vetted researchers a right to platform public data so they can study systemic risks: election interference, health misinformation, illegal content, and exposure to minors. The Commission made X a "Very Large Online Platform" in April 2023 and opened a formal DSA investigation in December 2023, but the platform's contractual terms continued to ban independent data collection, and researcher applications sat unanswered. The fine changed the calculation.

The EU Commission press release documenting the fine

The Commission's digital-strategy announcement of the €120 million penalty

The remediation plan X submitted, and the Commission accepted, is the deliverable. It commits X to faster vetting of qualified researchers, free access to public platform data, revisions to the terms of service that had prohibited independent data collection, and a six-month compliance deadline subject to an external independent audit. The corrective-measures release names each of those pieces and the date they take effect.

Before December 2025, the law existed; the data did not. After July 2026, the data exists, and the Commission has a tested template for extracting it from any Very Large Online Platform that tries the same delay.

The case that proves why the template matters is from November 2024. Romania's presidential election featured an obscure candidate, Călin Georgescu, who had polled in single digits and then received roughly 120 million views in the days before the vote. He finished round one with about 23% of the ballots. Accounts that had posted only nail art and fashion content suddenly pivoted to boosting his candidacy.

Maastricht University researcher Adriana Iamnitchi was studying the election in real time and asked TikTok for the data she was legally entitled to under DSA Article 40. The platform declined. Her account of the denial, and the broader pattern of European researchers being locked out of platform data, was reported by Wired.

The TikTok refusal is not an X story, but it is the same story. The Commission did not fine TikTok in December 2025; it fined X. The Romania example shows what the absence of researcher data costs: an election that nobody outside the platforms could audit, with the audit window closing before the data ever opened. The Article 40 mechanism exists to make that audit possible. Until the X fine, the mechanism was theoretical.

Article 40 is one of three grounds in the Commission's December 2025 decision. The Commission also cited X's deceptive blue-checkmark design and the opaque ad-repository that prevented verification of who paid for which political messages. The first two are familiar Big Tech enforcement territory. The third is the new line, and Tech Policy Press's December 2025 Article 40 explainer walks through how the regulator built the case.

The Commission's enforcement template is now on the record. It applies to every Very Large Online Platform: Meta, TikTok, Google, and any platform the Commission designates in the future. The Information Technology and Innovation Foundation, a US-based tech-policy think tank, argued in December 2025 that fines of this kind risk becoming a regulatory tax rather than a behavior change. The Commission's own answer is the remediation plan: a fine that produces a specific, dated, auditable change in the platform's behavior, with the Commission reviewing whether the platform actually delivered.

X's appeal posture is part of the record too. The company argued the investigation was incomplete and violated its rights of defense; the appeal was filed February 20, 2026, according to reporting, and the Commission accepted the corrective-measures package in July 2026, according to reporting. The delay between fine and remediation is itself part of the precedent. It shows what the Commission's first DSA enforcement action cost in calendar time, and it sets the benchmark against which future VLOP enforcement will be measured.

The next test is whether the data actually flows. The six-month compliance window in the X plan is the clock. If vetted researchers can request X data in August 2026, receive it on the platform's own timeline, and publish independent findings before the next European election cycle, the template is working. If the audit finds X is still blocking, the Commission has shown it will issue a fine. The next fine will not be the first.