For its first two years, the Digital Services Act was mostly a promise. Brussels had the powers, published the rules, and designated the platforms that would have to follow them. What it did not have was a single fine to show for it. That changed in December 2025, and the nine months since have turned the DSA into the most consequential piece of platform regulation on the planet, and a fresh front in the trade fight between the European Union and the United States.
The law itself is simple enough to state. Very large online platforms, meaning those with more than 45 million EU users, have to assess the systemic risks their services pose, demonstrate they are managing them, open their advertising and data to external scrutiny, and stop using deceptive design to manipulate users. Fail, and the Commission can levy fines of up to 6% of global annual revenue.
X Pays €120 Million and Becomes the DSA’s First Casualty
The opening shot landed on Elon Musk. On December 5, 2025, the Commission fined X €120 million, the first non-compliance decision ever issued under the law. The regulator found three breaches including the paid “blue checkmark” misled users about who was actually verified, the platform’s advertising repository was too opaque for researchers to scrutinize, and X blocked outside access to public data that the DSA requires to be available.
The blue check sat at the center. Before Musk bought the company, the badge signaled that a public figure had passed an identity check. Afterward, anyone could buy the badge for a monthly fee with no meaningful identity check, which the Commission argued exposed users to impersonation scams while the account was still labeled “verified.” Musk’s response was characteristically loud, calling for the EU to be abolished, and X executives briefly suspended the Commission’s advertising account in protest.
The louder story is what happened next. On July 15, 2026, the Commission accepted X’s action plan on the ad repository and researcher data access: two of the three breaches, not all three. The blue-check fix sat on a separate track. The European Board for Digital Services called the proposed changes “partially adequate,” but deemed the audit measures and, “as a result, the overall action plan insufficient to address the infringements.” The Commission accepted it anyway, with tighter conditions. X has six months to deliver, then an independent audit. X is also contesting the fine at the EU General Court, though the appeal does not pause compliance.
Temu’s €200 Million Fine Raises the Stakes
If X proved the DSA had teeth, Temu proved they were getting sharper. On May 28, 2026, the Commission fined the Chinese marketplace €200 million, which at the time was the largest DSA penalty and only the second non-compliance decision on record. The charge was different from X’s. Temu was not accused of deceptive design but of failing to assess whether EU consumers were likely to encounter illegal and unsafe goods.
A mystery-shopping exercise conducted during the investigation found that a very high share of chargers purchased on the platform failed basic safety tests, and many baby toys posed choking hazards or contained chemicals above legal limits. The Commission’s core finding was that Temu’s risk assessment relied on generic e-commerce data rather than testing its own service. As Henna Virkkunen put it, risk assessments are the backbone of the DSA, not a box-ticking exercise.
Temu’s estimated 2025 turnover was around €53 billion, implying a 6% maximum of roughly €2.8 billion. The Commission took a fraction of that, leaving itself enormous room to escalate. The plan was due 28 August 2026. The Board then has a month to opine; the Commission has a further month to set a deadline. Miss it, and periodic penalty payments start. Temu is separately fighting the decision itself, having lodged an appeal in mid August, 2026; the challenge does not suspend the action-plan process.
The case also underscores a point MRKT3.0 has closely tracked: a fine does not make 75 million designated monthly users disappear. Temu called the penalty disproportionate and kept operating. Enforcement changes the rules platforms play by; it does not, on its own, change the market.
AliExpress Takes the Record at €550 Million
Barely two months after Temu, the ceiling moved again. On July 20, 2026, the Commission fined AliExpress €550 million, the largest DSA penalty to date and the third non-compliance decision under the law. The charge fell within the same family as Temu’s: the Alibaba-owned marketplace failed to properly assess and mitigate the risk of illegal, unsafe, or counterfeit goods reaching EU shoppers. AliExpress must submit an action plan by October 20, 2026, and has said it will appeal, calling the fine disproportionate. The pattern is now unmistakable: three fines in nine months, each larger than the last.
The Enforcement Net Widens
None of these cases is the endpoint. The Commission has an open DSA case against Shein over illegal products, addictive design, and recommender-system transparency, and is conducting an active investigation into Meta. Brussels has now fined a US platform and two Chinese marketplaces, established that both content design and product safety fall under the law, and is now working outward from there.
That widening net is what makes the DSA a durable feature of European tech rather than a one-off. Platforms that once treated the risk-assessment requirement as paperwork are learning that the Commission will test their homework against real-world evidence.
Washington Reads This as a Trade War
The enforcement wave collides with a US administration that sees it as economic aggression. The flashpoint came on July 23, 2026, when the Commission fined Google €890 million under the separate Digital Markets Act (€460 million for self-preferencing in Search and €430 million for anti-steering on Google Play). The next day, President Trump announced a Section 301 trade investigation, the same tool his administration has used to justify tariffs elsewhere, accusing Brussels of “robbing” American companies and threatening a substantial tariff on EU goods.
The DSA and the DMA are different laws, but Washington does not draw that line. From the US view, the €120 million X fine and the €890 million Google fine are the same story: European regulators disproportionately targeting American firms. American commentators have gone further, calling for retaliation and framing the fines as discriminatory taxation. That argument is weaker on the DSA ledger, where the biggest fine so far is AliExpress.
There is a hard limit to the threat. A Section 301 probe carries no legal authority over EU regulatory decisions; a Commission fine can only be overturned by EU courts or the Commission itself. What the pressure does buy is leverage over a fragile US-EU trade truce. The X action plan, accepted days before the Google fine, shows Brussels will take a compliance deal. The AliExpress penalty, issued three days before that fine, shows it will still escalate when it wants to. Whether the mix is strategy or caution under American pressure is the question that will define the DSA’s next year.
Author: Ayanfe Fakunle
See Also:
Temu’s 115M EU Users: Brussels Is Losing the Fight
