EU fines X $140 million over deceptive blue checkmarks

Recorded: Dec. 5, 2025, 9:13 p.m.

Original

News

Featured
Latest

Critical React, Next.js flaw lets hackers execute code on servers

North Korea lures engineers to rent identities in fake IT worker scheme

CISA warns of Chinese "BrickStorm" malware attacks on VMware servers

Marquis data breach impacts over 74 US banks, credit unions

Barts Health NHS discloses data breach after Oracle zero-day hack

FBI warns of virtual kidnapping scams using altered social media photos

A Practical Guide to Continuous Attack Surface Visibility

EU fines X $140 million over deceptive blue checkmarks

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityEU fines X $140 million over deceptive blue checkmarks

EU fines X $140 million over deceptive blue checkmarks

By Sergiu Gatlan

December 5, 2025
09:41 AM
4

The European Commission has fined X €120 million ($140 million) for violating transparency obligations under the Digital Services Act (DSA).
This is the first non-compliance ruling under the DSA, a set of rules adopted in 2022 that requires platforms to remove harmful content and protect users across the European Union.
The fine was issued following a two-year investigation into the platform formerly known as Twitter to determine whether the social network violated the DSA regarding the effectiveness of measures to combat information manipulation and the dissemination of illegal content. The commission's preliminary findings were shared with X in July 2024.
Regulators found that X had breached transparency requirements through its misleading 'blue checkmark' system for 'verified accounts,' its opaque advertising database, and its blocking of researchers' access to public data.
The commission said that X's checkmark misleads users because accounts can purchase the badge without meaningful identity verification. This deceptive design also makes it challenging to assess account authenticity, increasing exposure to fraud and manipulation.
"This deception exposes users to scams, including impersonation frauds, as well as other forms of manipulation by malicious actors," the commission noted. "While the DSA does not mandate user verification, it clearly prohibits online platforms from falsely claiming that users have been verified, when no such verification took place."
X also failed to maintain a transparent advertising repository, as the platform's ad database lacks the accessibility features mandated by the DSA and imposes excessive processing delays that hinder efforts to detect scams, false advertising, and coordinated influence campaigns. It also set up unnecessary barriers that block researchers from accessing public platform data needed to study systemic risks facing European users.
"Deceiving users with blue checkmarks, obscuring information on ads and shutting out researchers have no place online in the EU. The DSA protects users. The DSA gives researchers the way to uncover potential threats," said Henna Virkkunen, the bloc's executive vice president for tech sovereignty.
"The DSA restores trust in the online environment. With the DSA's first non-compliance decision, we are holding X responsible for undermining users' rights and evading accountability."
The commission said that X now has 60 working days to address the blue checkmark violations and 90 days to submit action plans for fixing the research access and advertising issues, and added that failure to comply could trigger additional periodic penalties.
X was designated as a Very Large Online Platform (VLOP) under the EU's DSA on 25 April 2023, following its announcement that it had reached over 45 million monthly active users in the EU.

Break down IAM silos like Bitpanda, KnowBe4, and PathAI
Broken IAM isn't just an IT problem - the impact ripples across your whole business.
This practical guide covers why traditional IAM practices fail to keep up with modern demands, examples of what "good" IAM looks like, and a simple checklist for building a scalable strategy.
Get the guide

Related Articles:
Windows zero-day actively exploited to spy on European diplomatsComcast to pay $1.5M fine for vendor breach affecting 270K customersPolice arrests suspects linked to €600 million crypto fraud ringX: Re-enroll 2FA security keys by November 10 or get locked outNorth Korean Lazarus hackers targeted European defense companies

Digital Services Act
EU
Europe
European Commission
Fine
Twitter

Sergiu Gatlan
Sergiu is a news reporter who has covered the latest cybersecurity and technology developments for over a decade. Email or Twitter DMs for tips.

Previous Article
Next Article

Comments

fromFirefoxToVivaldi - 6 hours ago

Twitter should just leave the EU for some time in protest with an appropriate notice shown for EU IPs.

EdAtWork - 4 hours ago

$140m over a blue checkmark? That's just ridiculously stupid. How many other sites have worse questionable marketing methods? The EU needs to be consistent and reasonable instead of basically committing extortion on companies with deep pockets.

doncoyote - 4 hours ago

"It's a tax!"

NoneRain - 4 hours ago

Dafuq is EU smoking?

Popular Stories

ChatGPT is down worldwide, conversations disappeared for users

Cloudflare down, websites offline with 500 Internal Server Error

Marquis data breach impacts over 74 US banks, credit unions

Sponsor Posts

Empowering IT teams with intelligence driven cyber threat research.

Hackers love the holidays! Share FREE Security Awareness Training to keep family & friends cyber-safe!

What you’re overlooking to protect your business

AI is a data-breach time bomb: Read the new report

Overdue a password health-check? Audit your Active Directory for free

Upcoming Webinar

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Username

Password

Remember Me

Not a member yet? Register Now

Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

The European Commission has levied a €120 million ($140 million) fine against X (formerly Twitter) due to violations of the Digital Services Act (DSA). This marks the first non-compliance ruling under the DSA, enacted in 2022, which aims to regulate online platforms and ensure transparency and accountability across the European Union. The investigation, spanning two years, centered on X’s practices surrounding its ‘blue checkmark’ verification system, its advertising database, and restrictions on researcher access to platform data.

Specifically, the Commission found that X’s use of the blue checkmark system was deceptive. The system allows accounts to purchase the badge without genuine identity verification, making it challenging to assess account authenticity and exposing users to scams, including impersonation fraud. Henna Virkkunen, the European Commission’s executive vice president for tech sovereignty, emphasized that the DSA protects users by preventing platforms from falsely claiming verification.

Furthermore, X failed to maintain a transparent advertising repository. The platform’s ad database exhibited accessibility issues and excessive processing delays, hindering efforts to detect scams, false advertising, and coordinated influence campaigns. This failure to provide accessible and transparent data also restricted researchers’ ability to study systemic risks facing European users.

The Commission highlighted that X’s deceptive practices – the blue checkmark system and restricted data access – undermine user rights and accountability. The DSA’s primary objective is to restore trust in the online environment. Following this first non-compliance decision, X is given 60 working days to address the blue checkmark violations and 90 days to submit action plans for fixing the research access and advertising issues. Failure to comply could trigger additional periodic penalties. The decision underscores the DSA’s commitment to holding large online platforms accountable for their operations within the EU.