Notice-and-action, systemic-risk management, the "Blue check" deceptive design, the ad repository, and researcher data access. First-ever DSA formal proceedings.

• Art. 16
• Art. 25(1)
• Art. 34
• Art. 35
• Art. 39
• Art. 40(12)

1. October 12, 2023Request for information

   RFI on the spread of illegal content and disinformation around the Hamas attacks on Israel, and on the crisis-response protocol. Source ↗

2. December 18, 2023Formal proceedings opened

   The first-ever DSA formal proceedings — covering notice-and-action, risk management, deceptive design, ad transparency and data access. Source ↗

3. July 12, 2024Preliminary findings

   First-ever DSA preliminary findings: the Blue-checkmark design deceives users (Art. 25), the ad repository is not searchable/reliable (Art. 39) and researcher data access is obstructed (Art. 40). Source ↗

4. January 17, 2025Additional investigatory measures

   RFI on X’s recommender systems plus a retention order preserving documents on algorithm changes, and a request for access to X’s commercial API. Source ↗

5. December 5, 2025€120M fine

   First DSA non-compliance decision and fine, for the Art. 25(1), 39 and 40(12) breaches. X given 60/90 working days to remedy; further non-compliance can trigger periodic penalty payments. Source ↗

6. February 16, 2026X appeals to the EU General Court

   X challenged the €120M decision (X v Commission) — the first court challenge to a DSA fine. The 90-working-day remedy deadline for the ad repository and data access passed without a public outcome. Source ↗

7. July 16, 2026Commission accepts X’s action plan

   The Commission accepted X’s action plan to remedy the Art. 39 ad-repository and Art. 40(12) data-access breaches: X commits to add API access and more ad data to the repository and cut its response times, to give eligible researchers data free of charge with a streamlined application process, and to stop contractually barring the scraping of public data — with six months to implement and an independent audit to follow. The Board for Digital Services called the plan only “partially adequate” and the audit measures “insufficient to address the infringements.” Source ↗

First DSA non-compliance decision. Confirmed breaches of Art. 25(1) (Blue checkmark), Art. 39 (ad repository) and Art. 40(12) (researcher data access). The illegal-content and information-manipulation (Community Notes) strands remain open.

A new investigation into risks from deploying the Grok AI into X (incl. manipulated sexual imagery / possible CSAM, gender-based violence) and an extension of the 2023 case to X’s recommender systems.

• Art. 34
• Art. 35
• Art. 42(2)

1. September 19, 2025Request for information (Grok)

   RFI on Grok, including the antisemitic content generated by @grok in mid-2025. Source ↗

2. January 26, 2026New proceeding opened + 2023 case extended

   A new investigation into Grok’s deployment risks, and an extension of the December 2023 proceeding to X’s recommender systems (incl. the planned switch to a Grok-based recommender). Source ↗

Addictive "rabbit-hole" recommender effects, protection of minors, the advertising repository and researcher data access.

• Art. 28
• Art. 34
• Art. 35
• Art. 39
• Art. 40

1. February 19, 2024Formal proceedings opened

   Covering addictive design and the "rabbit hole" effect, minors’ safety and default settings, the ad repository and researcher data access. Source ↗

2. May 15, 2025Preliminary finding — ad repository

   TikTok’s ad repository preliminarily breaches Art. 39: missing content/targeting/funding data and not comprehensively searchable. Source ↗

3. October 24, 2025Preliminary finding — data access

   TikTok (alongside Meta) preliminarily in breach of Art. 40: burdensome procedures and tools for researcher access to public data. Source ↗

4. December 5, 2025Commitments accepted — ad transparency

   Binding Art. 71 commitments close the advertising-transparency strand: full ad content incl. URLs, ≤24h repository updates, targeting criteria and added search filters. Source ↗

5. February 6, 2026Preliminary finding — addictive design

   TikTok preliminarily in breach over addictive design (infinite scroll, autoplay, push notifications); the Commission says it must change the basic design, e.g. disable infinite scroll over time. Source ↗

The TikTok Lite rewards programme launched in France and Spain without a prior risk assessment — suspected addictive-design harm, especially to minors. The first DSA case ever closed.

• Art. 34
• Art. 35

1. April 17, 2024Request for information (by decision)

   The Commission compelled TikTok to deliver the TikTok Lite risk assessment; TikTok failed to deliver by the deadline. Source ↗

2. April 22, 2024Proceedings opened + intent to suspend

   Second TikTok proceeding opened, with an announced intention to impose interim measures suspending the Lite rewards programme EU-wide. Source ↗

3. April 24, 2024 (approx.)TikTok suspends the rewards feature

   TikTok voluntarily suspended the TikTok Lite rewards feature in the EU, pre-empting a formal interim-measures decision.

4. August 5, 2024Commitments binding — case closed

   The Commission made binding TikTok’s commitment to permanently withdraw the Lite Rewards programme from the EU — the first DSA case ever closed (Case DSA.100121). Source ↗

TikTok’s management of systemic risks to election integrity and civic discourse, in the context of the annulled Romanian presidential election — recommender systems, coordinated inauthentic manipulation and political-ads policy.

• Art. 34
• Art. 35

1. November 29, 2024Request for information

   RFI to TikTok on election risks after the annulled Romanian presidential first round. Source ↗

2. December 5, 2024Retention order

   The Commission ordered TikTok to retain data relating to the Romanian elections. Source ↗

3. December 17, 2024Formal proceedings opened

   On TikTok’s management of election risks under the DSA. Source ↗

Deceptive/political advertising and disinformation, the lack of an effective real-time election-monitoring tool (CrowdTangle deprecation), notice-and-action, and researcher data access. Note: deceptive ads are charged as a systemic risk (Arts. 34/35) — Art. 39 (the Ad Library) is NOT in scope.

• Art. 14(1)
• Art. 16
• Art. 17(1)
• Art. 20
• Art. 24(5)
• Art. 25(1)
• Art. 34
• Art. 35
• Art. 40(12)

1. April 30, 2024Formal proceedings opened

   On Facebook & Instagram: deceptive advertising and political content, the CrowdTangle deprecation ahead of EU elections, notice-and-action and researcher data access. Source ↗

2. October 24, 2025Preliminary findings

   Meta preliminarily in breach of transparency obligations: inadequate researcher data access (Art. 40) and a notice-and-action/appeal mechanism using "dark patterns" (Art. 16). Announced jointly with the TikTok findings. Source ↗

Addictive "rabbit-hole" design exploiting minors, the effectiveness of age assurance, and prevention of under-13 access.

• Art. 28
• Art. 34
• Art. 35

1. May 16, 2024Formal proceedings opened

   Whether Meta assessed and mitigated risks from Facebook & Instagram interface design causing addictive behaviour, and the effectiveness of its age-verification tools. Source ↗

2. April 29, 2026Preliminary findings — under-13s

   Meta preliminarily in breach for failing to prevent under-13s from accessing the services: false birth dates accepted with no effective controls, and an ineffective reporting tool for minors’ accounts. Source ↗

3. July 10, 2026Preliminary finding — addictive design

   Meta preliminarily in breach over the addictive design of Facebook & Instagram (infinite scroll, autoplay, push notifications, engagement-driven recommenders): it did not adequately assess the risks to users’ physical and mental well-being, including minors and vulnerable adults. The Commission wants default changes such as disabling infinite scroll and autoplay. Source ↗

Illegal/non-compliant products and hidden links to them, complaint handling, trader traceability, ad and recommender transparency, and researcher data access. Split into a commitments track (closed) and an illegal-products track (fined).

• Art. 16
• Art. 20
• Art. 26
• Art. 27
• Art. 30
• Art. 34
• Art. 35
• Art. 40

1. March 14, 2024Formal proceedings opened

   On illegal products, hidden links, complaint handling, trader traceability, ad/recommender transparency and researcher data access. Source ↗

2. June 18, 2025Commitments binding + preliminary findings

   The Commission made binding AliExpress’s commitments on ad/recommender transparency, data access and trader traceability (with an independent Monitoring Trustee) — while separately issuing preliminary findings that it breaches Art. 34–35 on illegal products. That track continues. Source ↗

3. July 20, 2026€550M fine

   Non-compliance decision and fine for the Art. 34–35 risk-assessment and mitigation failures on illegal, unsafe and counterfeit products — the largest DSA fine to date. AliExpress must submit an action plan by 20 Oct 2026. Source ↗

The largest DSA fine to date, for failing to diligently assess and mitigate the risk of illegal, unsafe and counterfeit products (Art. 34–35) — understaffed moderation, ineffective detection/brand-authorisation systems, and products easily mis-categorised to dodge compliance checks. AliExpress must submit an action plan by 20 Oct 2026.

Systems to limit the sale of illegal products (incl. content that could constitute CSAM, e.g. child-like sex dolls), addictive design (engagement points/rewards) and recommender-system transparency.

• Art. 27
• Art. 34
• Art. 35

1. June 28, 2024Request for information

   RFI on notice-and-takedown, illegal content/products and protection of minors. Source ↗

2. February 6, 2025Request for information

   RFI on compliance with the DSA (illegal products and the recommender system). Source ↗

3. November 26, 2025Request for information

   Further RFI on illegal products and the recommender system. Source ↗

4. February 17, 2026Formal proceedings opened

   On illegal products (incl. potential CSAM), addictive design and recommender-system transparency incl. a non-profiling option. Source ↗

Systemic-risk assessment of illegal products, addictive design, recommender-system transparency and researcher data access.

• Art. 27
• Art. 34
• Art. 38
• Art. 40

1. May 31, 2024 (approx.)Designated a VLOP

   Temu designated a Very Large Online Platform (>45M EU monthly users).

2. June 28, 2024Request for information

   First formal RFI.

3. October 11, 2024Request for information

   Second formal RFI.

4. October 31, 2024Formal proceedings opened

   Four strands: illegal products, addictive design, recommender systems and researcher data access. Source ↗

5. July 29, 2025Preliminary findings

   Temu preliminarily in breach of Art. 34 — an inadequate risk assessment of illegal products that relied on generic e-commerce information rather than Temu-specific evidence. Source ↗

6. May 28, 2026€200M fine

   Non-compliance decision and fine for the Art. 34 illegal-products risk-assessment breach. Other strands remain under investigation. Source ↗

For the Art. 34 risk-assessment breach on illegal products (evidence incl. unsafe chargers and hazardous baby toys). Temu must submit an action plan by 28 Aug 2026. The addictive-design, recommender and data-access strands remain open.

A coordinated proceeding against four adult platforms over failure to protect minors — deficient risk assessment and reliance on self-declaration ("I am 18") with no effective age verification.

• Art. 28
• Art. 34
• Art. 35

1. December 20, 2023VLOP designations

   Pornhub, Stripchat and XVideos designated VLOPs (the second set). Source ↗

2. July 10, 2024XNXX designated a VLOP

   XNXX designated a VLOP, with compliance required by mid-November 2024. Source ↗

3. May 27, 2025Formal proceedings opened

   Against all four platforms over minors’ protection and the absence of effective age verification; Member States concurrently coordinate action against smaller sites. Source ↗

4. March 26, 2026Preliminary findings

   All four preliminarily in breach — deficient (business-centric) risk assessment and reliance on a single self-declaration click; blurring and content warnings deemed ineffective. Source ↗

Child safety, privacy and security: age assurance via self-declaration, default minor-account settings, and content moderation against illegal-goods signposting (drugs, vapes, alcohol). Run jointly with the Dutch DSC (ACM).

• Art. 28
• Art. 34
• Art. 35

1. March 26, 2026Formal proceedings opened

   On age assurance, default minor-account settings and content moderation — opened the same day as the adult-platform preliminary findings, jointly with the Dutch DSC. Source ↗