The European Commission (EC) has fined X €120m ($139.7m) for violating transparency obligations set out in the Digital Services Act (DSA).

The penalty addresses practices involving X’s blue checkmark for verified accounts, the transparency of its advertising repository, and its provision of access to public data for researchers.

According to the EC, X’s blue checkmark system allows anyone to pay for verification status without meaningful identity checks, making it difficult for users to determine the authenticity of accounts.

This was found to expose users to scams and impersonation frauds by malicious actors.

The DSA does not require platforms to verify user identities but prohibits them from falsely suggesting users have been verified when they have not.

In addition, the EC found that X’s advertising repository does not meet DSA requirements for transparency and accessibility.

It cited issues such as delays in processing, missing information on ad content and topics, and a lack of details about the legal entity funding advertisements.

These shortcomings hinder researchers’ and the public’s ability to scrutinise potential risks linked to online advertising.

The decision also noted that X restricts researchers’ access to public data by prohibiting certain methods, including scraping, and by imposing barriers that undermine research into systemic risks within the European Union.

The €120m fine was determined based on the nature, gravity, and duration of these breaches affecting EU users. This marks the first non-compliance decision under the DSA.

X must now inform the Commission within 60 working days about measures it plans to adopt regarding the deceptive use of blue checkmarks.

The company has 90 working days to submit an action plan addressing issues with its advertising repository and researcher data access.

The Board of Digital Services will have one month to review X’s action plan before the Commission issues a final decision and sets an implementation period.

If X fails to comply, further periodic penalty payments may be imposed.

Formal proceedings began on 18 December 2023, covering X’s use of deceptive design, ad transparency issues, and data access for researchers.

The EC released its preliminary findings on 12 July 2024 before issuing this non-compliance decision.

EC tech sovereignty, security and democracy executive vice-president Henna Virkkunen said: “Deceiving users with blue checkmarks, obscuring information on ads and shutting out researchers have no place online in the EU. 

“The DSA protects users. The DSA gives researchers the way to uncover potential threats. The DSA restores trust in the online environment. With the DSA’s first non-compliance decision, we are holding X responsible for undermining users’ rights and evading accountability.”