Blog

Elon Musk’s social media platform, X, has been fined €120m (£105m) after it was found in breach of new EU digital laws, in a ruling likely to put the European Commission on a collision course with the US billionaire and potentially Donald Trump.

The breaches, under consideration for two years, included what the EU said was a “deceptive” blue tick verification badge given to users and the lack of transparency of the platform’s advertising.

The commission rules require tech companies to provide a public list of advertisers to ensure the company’s structures guard against illegal scams, fake advertisements and coordinated campaigns in the context of political elections.

In a third breach, the EU also concluded that X had failed to provide the required access to public data available to researchers, who typically keep tabs on contentious issues such as political content.

The ruling by the European Commission brings to a close part of an investigation that started two years ago.

The commission said on Friday it had found X in breach of transparency obligations under the Digital Services Act (DSA), in the first ruling against the company since the laws regulating the content of social media and large tech platforms came into force in 2023.

In December 2023, the commission opened formal proceedings to assess whether X may have breached the DSA in areas linked to the dissemination of illegal content and the effectiveness of the measures taken to combat information manipulation, for which the investigation continues.

Under the DSA, X can be fined up to 6% of its worldwide revenue, which was estimated to be between $2.5bn (£1.9bn) and $2.7bn in 2024.

Three other investigations remain, two of which relate to the content and the algorithms promoting content that changed after Musk bought Twitter in October 2022 and rebranded it X.

The commission continues to investigate whether there have been breaches of laws prohibiting incitement to violence or terrorism.

It is also looking into the mechanism for users to flag and report what they believe is illegal content.

Senior officials said the fine broke down into three sections: €45m for introducing a “verification” blue tick that users could buy, leaving others unable to determine the authenticity of account holders; €35m for breaches of ad regulations; and €40m for data access breaches in relation to research.

Before Musk took over Twitter, blue ticks were only awarded to verifiable account holders, including politicians, celebrities, public bodies and verified journalists in mainstream media and established new media, such as bloggers and YouTubers. After the takeover, users who subscribed to X Premium were then eligible for blue tick status.

Henna Virkkunen, who is the executive vice-president at the European Commission responsible for tech regulation, said: “With the DSA’s first non-compliance decision, we are holding X responsible for undermining users’ rights and evading accountability.

“Deceiving users with blue checkmarks, obscuring information on ads and shutting out researchers have no place online in the EU.”

The ruling risks enraging Trump’s administration. Last week the US commerce secretary, Howard Lutnick, said the EU must consider its tech regulations in order to get 50% tariffs on steel reduced.

skip past newsletter promotion

after newsletter promotion

His threats were branded “blackmail” by Teresa Ribera, the EU commissioner in charge of Europe’s green transition and antitrust enforcement.

Senior EU officials said the ruling was independent of any pleadings by the US delegation in Brussels last week to meet trade ministers. They said the EU retained its “sovereign right” to regulate US tech companies, with 25 businesses including non-US companies such as TikTok coming under the DSA.

Musk – who is on a path to become the world’s first trillionaire – has 90 days to come up with an “action plan” to respond to the fine but ultimately he is also free to appeal against any EU ruling, as others, such as Apple, have done in the past, taking their case to the European court of justice.

At the same time, the EU has announced it has secured commitments from TikTok to provide advertising repositories to address the commission concerns raised in May about transparency.

The DSA requires platforms to maintain an accessible and searchable repository of the ads running on their services to allow researchers and representatives of civil society “to detect scams, advertisements for illegal or age-inappropriate”.

Senior officials said the phenomenon of fake political adverts or ads with fake celebrities cannot be studied unless the social media companies stick to the rules.

X has been approached for comment. The EU said the company had been informed of the decision.

Getting safety ‘right’ before automated vehicles (AVs), and their operating systems, are approved for road use and ensuring ongoing in-use safety are key goals in defining the necessary regulatory framework for AV deployment.

Both are at the heart of the latest development from the government, this being a call for evidence issued on 4 December 2025 and open for responses until 5 March 2026. The new document is divided into two chapters covering each of these key goals and a series of associated technical matters summarised (non-exhaustively) below.

All are significant and important issues. The description, at a recent motor insurance market meeting, of the call for evidence as a “mega-consultation” is far from an understatement.  This “mega-consultation” label is reinforced by the government’s document running to 79 pages and asking 125 questions.

Chapter 1: “Getting AVs on the Road”

• Type Approval: AVs will be required to meet technical and safety standards aligned with international (UNECE) regulations.

• Authorisation requirements: These will ensure AVs can operate safely and legally without a driver. Each AV must be backed by an Authorised Self-Driving Entity (ASDE) responsible for safety and regulatory compliance throughout its lifecycle. ASDEs will be subject to authorisation requirements.

• User-in-Charge (UIC): This refers to the ‘disengaged driver’ while the AV is driving itself. The requirements here will define the UIC’s responsibilities, including transition demands and training requirements.
• No-User-in-Charge (NUIC) Licensing: Conditions will regulate operators running passenger services using vehicles without onboard safety ‘drivers’. Fully autonomous buses and smaller pod-style vehicles are typical use cases.
• Insurance and data access: Existing legislation requires motor insurers to cover both conventional and automated driving. The call for evidence focuses on key questions around access to data stored in the vehicle’s Automated Driving System (ADS)  to enable claims adjusting and subrogated actions by motor insurers.

Chapter 2: “Once AVs Are on the Road”

• In-Use Regulatory Scheme (IURS): Requirements here will provide ongoing oversight and compliance monitoring – in respect of the ADS, with the keeper remaining responsible for general roadworthiness – and allow for enforcement via civil and regulatory sanctions.

• Incident Investigation: Independent statutory inspectors will investigate AV-related incidents under a no-blame framework to improve road safety. This activity could be closely modelled on that of the existing rail and maritime investigation branches.

• Cyber Security: Requirements will be developed to align with UN Regulations 155 and 156, addressing risks from connectivity and remote operations. Given that thousands of connected vehicles are already on the roads – although they are all conventional vehicles – it follows that some of the potentially systemic cyber risks arising from vehicle connectivity are already present in the current driving eco-system. Whether these are fully understood / evaluated is another matter.
• Accessibility & Environment: Seeks evidence on inclusive design and environmental impacts, including end-of-life considerations.

What happens next?

The call for evidence runs (following consultations in the summer as analysed here) until 5 March 2026, inviting responses from industry stakeholders – which will of course include insurers and vehicle manufacturers – academics, road users, and accessibility groups. The responses received will inform future regulations to ensure the regulatory regime legal governing AV deployment is safe, equitable, and sustainable.

The government has already referred to the necessary secondary regulations on matters set out in chapters 1 & 2 as the “main regs” for automated driving. All these “main regs” will be made under powers set out in the Automated Vehicle Act 2024.

An AV timetable released by government earlier in the year envisaged the call for evidence on these “main regs” concluding by the end of 2025, with the next step towards implementing the “main regs” being a consultation on draft provisions in the second half of next year. This still feels like a realistic timetable despite the call for evidence emerging perhaps later than initially planned.

Initial concluding thoughts

The issues covered here are important for insurers interested in the development of AVs. That is not just all motor insurers – because cover for automated driving will be compulsory – but also casualty carriers offering product liability and cyber-related policies to manufacturers and software developers who will potentially be the ASDEs in the new regulatory framework.

The approach to access to data by insurers could be among the most controversial points. The way forward, whether mandatory or otherwise, will require a careful balance of the interests of insurers and the importance to manufacturers of commercial confidentiality as well as respecting data protection principles.

The purpose of this article is only to provide a high-level summary and we propose to address the detail of the chapters in further articles and events. Please contact any of the authors or your usual Clyde & Co contacts if you would like further information.