Hacker News new | ask | show | jobs
EU hits X with €120M fine for breaching the Digital Services Act (dw.com)
83 points by vincvinc 197 days ago
11 comments

Why can a company be fined for not allowing "researchers" access to data? That seems bizarre to me.
What's bizarre about it? There's lots of legislation that requires companies to report on various data or to provide access to auditors. It's legally valid.

I think there's a compelling case to be made for requiring large social media platforms to provide data access to researchers, considering the platform's incredible ability to influence elections and society at-large.

Auditors != researchers.

Auditors are hired by the company being audited, have a very narrow and fixed mission justified by previous financial blowups that caused a lot of concrete damage to specific people, and there are strict standards defining what they are looking for and how. Audits don't tend to suck up personal data of customers.

"Researchers" here means self-selecting academics going on arbitrary fishing expeditions with full access to everyone's data. It's not narrowly defined, not justified by prior unambiguous harm to anyone, and given the maxed out ideological bias in academia is clearly just setting up universities to be an ideological police force on the general public.

It's not clear what "full access to everyone's data" actually means, isn't it limited to things that are already publicly available? So for example, I don't think researchers would get access to someone's Likes because that feature is now considered private, but they could access things like Posts and Retweets. My expectation is that researchers would be allowed to run queries against publicly available data as part of their research, but they wouldn't be allowed to do a huge download with a copy of everything posted during the last 5 years.

Facebook / Meta is compliant with these laws, and the way that they handle researcher access is by providing carefully controlled remote environments with sandboxed access to user data, which forms the basis for my understanding of how researchers are typically provided access to social media data.

It means what it says. A lot of these academics want to access people's IP addresses because they're trying to map out social networks and bot accounts, by which they mean any account they don't like the views of. So it means stripping people's anonymity under the guise of "research" and of course those academics can be trusted to immediately report everyone posting conservative views to the police, who will then arrest them and prosecute them.

> Facebook / Meta is compliant with these laws

They have a blue check system that works in the same way as X's does, so they aren't compliant. https://www.facebook.com/business/m/meta-verified-creators

But please understand that the EU is not a part of the world that has the rule of law. It has rule by law. Law in the EU is a vague thing, discovered as often as written, in which people who advance the EU's social plan are legal and people who oppose it are illegal. It's a system in which the EU Commission is judge, jury and executioner, and the courts are merely rubber stamps to which you can appeal if you feel like wasting money arguing in front of judges chosen for loyalty to the project over loyalty to high minded judicial principle.

> Auditors are hired by the company being audited

Not necessarily; regulatory bodies, particularly tax authorities, can and do impose auditors upon companies.

Because those researchers become a potential data leak. We all know that deanonymized data isn't actually anonymous. Do you, as the user, really want people poking around your private data "for research purposes"? Where there are basically no consequences if they mess up and leak your data?

I chose to give my data to the company. I didn't choose to give it to some unrelated third party.

I guess one point of confusion is exactly what data is shared, because I understood it to be general access to things that are already publicly available.

Furthermore, X offers paid access to the same data through their enterprise API program, so you're already giving access to unrelated third parties. Is there a significant distinction between the data that researchers could access and what's available through enterprise API?

There is a big difference between auditors and "researchers". Researchers are just academics whose incentives are to publish things and makes a name for themselves - possibly the worst group to give data access to.
It's stupid to force companies to accommodate researchers. If researchers want data then they can negotiate a paid license for it.
Not sure how much "It's stupid" adds to the conversation. GP made an argument.
Maybe it’s stupid in your perspective. nevertheless; nations have the right to put laws in place and enterprises willing to provide goods and services ought to follow those rules.
And this is why the EU is stagnant and unable to innovate. These nations can do whatever they want but let's be honest about what's going on here. The law is stupid because it's forcing US tech companies to subsidize research boondoggles. They're providing bullshit jobs to useless academics who are incapable of doing any real work, and the final output will be some long reports that no one ever reads.
It's because X is denying researchers access to public data. Data which can be used to detect scams and illegal advertising. It's really a consumer protection fine, but this article explains it better.

https://www.reuters.com/sustainability/boards-policy-regulat...

why? what seems bizarre to me is that platforms of such whitespread use and public interest can be bought and ruined by some random person
A lot of people seem to be forgetting that the Cambridge Analytica scandal started off with data that was supposed to be used for research projects at the University of Cambridge being exfiltrated for commercial political use [0].

That said, this is most likely a tit-for-tat by the EU against the Trump administration, because we live in a world where all countries (even the US) have now weaponized regulations for negotiating leverage.

Our red line in both the Biden admin as well as the current admin was the DSA. The EU's red line is not being included in any negotiation over the Russia-Ukraine Conflict. The US fights against the DSA by arguing about infringement on free speech. The EU then tries to fight back over market competition. And it goes on and on and on.

This is why a lot of businesses get antsy about trade wars.

[0] - https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana...

They could implement a similar system to what Facebook currently provides when doing research with platform data. I think they only allow access to carefully controlled data through a remote sandboxed environment.

I think Twitter is already providing access to this data through paid APIs too, so this is effectively subsidizing researcher access.

Probably, but as I mentioned before, the EU has been using the DSA as a negotiating tool against the US - just like we are using Free Speech absolutism and "censorship" as a tool against the EU in negotiations.

Unlike other major tech companies like Meta or Alphabet that fall under the DSA, X doesn't have a similar presence in the EU to give it a firewall. Alphabet has Poland on it's side [0], Meta has Ireland on it's side [1], Amazon has Luxembourg on it's side [2], and Microsoft has Czechia on it's side [7][8][9], and because of Musk's ties to the GOP, it becomes a useful political lever while not directly hurting individual EU states. If X somehow complies, some other issue will crop up against (eg.) Tesla despite the Gigafactory because Brandenburg is a lost cause if you aren't affilated with the AfD or BSW. It's the same reason why X doesn't push back when India passes a diktat because Indian law holds corporate leaders criminally liable and X has a significant India presence [10]

It's the same way how if you want to hold Germany by the balls you pressure Volkswagen [3] and if you want to pressure France [4] you target LVMH's cognac, scotch, and wine business [5].

This is a major reason why companies try to build GCCs abroad as well - being in the same room gives some leverage when negotiating regulations. Hence why Czechia, Finland, Luxembourg, and Greece pushed back against French attempts at cloud sovereignty [6] because OVHCloud only has a presence in France and Poland, but Amazon and Microsoft have large capital presences in the other 4.

[0] - https://www.gov.pl/web/primeminister/google-invests-billions...

[1] - https://www.euractiv.com/news/irish-privacy-regulator-picks-...

[2] - https://www.aboutamazon.eu/news/policy/amazon-leaders-meet-l...

[3] - https://www.ft.com/content/6ec91d4a-2f37-4a01-9132-6c7ae5b06...

[4] - https://videos.senat.fr/video.5409997_682ddabf64695.aides-au...

[5] - https://www.bloomberg.com/news/articles/2025-07-03/eu-fight-...

[6] - https://www.euractiv.com/news/eu-digital-ministers-push-agai...

[7] - https://nukib.gov.cz/en/infoservis-en/news/2276-nukib-and-mi...

[8] - https://news.microsoft.com/europe/2017/03/31/satya-nadella-v...

[9] - https://mpo.gov.cz/en/guidepost/for-the-media/press-releases...

[10] - https://www.glassdoor.com/Location/X-Bengaluru-Location-EI_I...

alephnerd, I have to flat out disagree with your grievances [0][1][2][3][4][5]. The more I read, the worse it gets. The fact that some people in a foreign country feel personally persecuted by the DSA and are willing to bully us around is not a good argument against it [1]. In fact, I think the American attitude of having "red lines" about this is quite frankly irrelevant to the bigger picture [2]. I think there are plenty of ego-syntonic justifications for why it's okay to take a different stance than us on our policies, but while there are plenty of sources, I don't think there is a lot of reasoned analysis [3]. I'm sure much of it is shaped by personal circumstances. But I admit, sweeping historical references can be interesting too [4]. As a Swede, I can tell you that not a single person I know cares about random companies in Czechia, Luxembourg, Germany or France getting pressured [5]. I'm not very familiar with it, but I'm sure Finland already regrets their previous stance on cloud-infra. Perceptions have fundamentally changed about the United States as an ally. As for GCAP and FCAS, they have different requirements and serve different purposes. What's your take on the next Gripen?

If you want to pressure Volkswagen, go ahead. Nobody cares. The fundamental flaw in your position is your implicit assumption about what we value or what motivates us. We're not Americans. I don't think America's "non-tariff barriers" are a valid concern. They are disingenuous rhetoric for domestic consumption. Heads would roll if there was ever an agreement with the US to lower our standards and open up local industries to competition from lower quality foreign importers due to geopolitical pressure. Pressure is not going to undo the DSA or the GDPR because they have broad support. As others have said, it is decades overdue. If Elon Musk is mad about having to follow the law, I'm sure he can find sympathy elsewhere. His sour grapes are not principled, they are about protecting his ego and finding others who do so for him.

Sorry for the bluntness, but I feel it is very much warranted.

[0] - https://news.ycombinator.com/item?id=46170027#46170683

[1] - https://news.ycombinator.com/item?id=46170027#46170823

[2] - ibid.

[3] - https://news.ycombinator.com/item?id=46170027#46171255

[4] - https://news.ycombinator.com/item?id=46170027#46174642

[5] - https://news.ycombinator.com/item?id=46170027#46175036

Of course no one cares about random companies in Czechia or France getting pressured; it's not meant to sway public opinion in Sweden, otherwise it would have been a waste of influence (money). I think alephnerd operates on a higher level of abstraction in his commentary, and you mistake this as him making specific validity claims about the policies. I think your grievances stem from this gap in abstraction.

For example, he might personally support DSA/GDPR, but he says that the US generally views these as “non-tariff barriers” to US service companies[0] and doesn’t bother evaluating the policies themselves. essentially saying for the purposes of predicting how the US will react, it's sufficient to analyze how the US views them and the actual policy details lose relevance in that context. He also shared a detail[0] about how the US placed their lobbyists as commissioners on GDPR, which is an interesting operational detail that argues against the broad support argument you’re making. Another question is whether there would still be broad support for some policy after it has been enacted and its adverse effects have been felt.

[0] - https://news.ycombinator.com/item?id=46170027#46174642

> Sorry for the bluntness, but I feel it is very much warranted

No worries. I think you misunderstood my post.

I used to work in the tech policy space, and I'm just bluntly explaining how we in the policymaking space view these discussions - especially with regards to negotiating with the EU.

> As a Swede, I can tell you that not a single person I know cares about random companies in Czechia, Luxembourg, Germany or France getting pressured

Well duh. You aren't the target for such an influence op. Leadership in (eg.) Czechia, Luxembourg, Germany or France are.

Much of the EU runs on unanimity, so all you need to do is pressure a single country and you have a veto.

This is what China has been doing with Sweden to a certain extent via Geely-owned Volvo Car Group and Polestar [0] and what we in the US have been doing with Ericcson [1][2][3]. Even the EU tries to use similar levers against the US [6].

To be brutally honest, this is how the game is played.

Most nations have now adopted the "elite-centric approach" to transnational negotiations [4], which makes it difficult for the EU, because the line between national soverignity and the EU with regards to foreign and economic affairs is not well defined. If you are not a veto player [5] your opinion does not matter.

Once you understand Political Science basics, a lot of stuff starts making sense. And I went to a college where heads of states would visit on a biweekly basis, and a large subset of European (and other regions) leaders attended or recruit from.

> What's your take on the next Gripen?

DoA if it depends on a GE power plant - the Volvo engine is a licensed version of the GE F404, so the US has final say on any Saab Gripen exports.

[0] - https://www.theguardian.com/business/2025/dec/02/china-volvo...

[1] - https://broadbandbreakfast.com/ericsson-ceo-calls-for-increa...

[2] - https://www.fierce-network.com/wireless/ericsson-ceo-home-si...

[3] - https://www.wsj.com/articles/ericsson-emerges-as-5g-leader-a...

[4] - https://academic.oup.com/book/12848/chapter-abstract/1631276...

[5] - https://www.jstor.org/stable/j.ctt7rvv7

[6] - https://www.nytimes.com/2018/06/21/business/economy/europe-t...

The DSA is decades overdue. It's absurd that there hasn't been one. There's also a dozen non-EU countries that have one, and that number has been growing rapidly.

To call it a "negotiation tool" is like calling literally any import tax or tariff - of which hundreds of thousands existed and were entirely accepted as squarely in the Overton Window long before Trump took office - purely a "negotiation tool". Just because it's new doesn't make it one any more so than such import taxes which have been around for ages.

> There's also a dozen non-EU countries that have one, and that number has been growing rapidly

Not really. Most of them offer significant carve-outs for American BigTech companies, or their implementation has been stayed, or significant capex subsidizes are provided to help reduce their impact for American BigTechs considering FDI in those countries.

It has been a DNC supported policy [0] as well to put pressure on countries that are even considering a digital services act. Heck the Biden admin began the process of making a legal example out of Canada [1] as a warning shot to other countries considering such options.

> To call it a "negotiation tool" is like calling literally any import tax or tariff ... purely a "negotiation tool".

That is what import taxes and tariffs are when not clubbed with subsidizes and formal sector specific industrial policy, because the act of giving MFN status to certain nations is itself a negotiating tactic. Canada's backing down on a digital service tax is a good example of that [2]

The whole point of (eg.) giving the UK preferential market access to the US over the EU, and giving Japan and South Korea preferential market access to the US over China is because it is a lever we can use when negotiating. Heck, France and Germany have both constantly tried leveraging tariffs and import taxes as a negotiating tactic against the US under the Biden admin [3][4] (and of course earlier).

As I mentioned above, this has been a slow-rolling negotiation between the US and EU since 2019. We in the US have bipartisan support to oppose the DSA and DSA-equivalents abroad. It was prominent stance in the Biden administration [0], and even Harris would have put a similar degree of pressure on the EU.

We have no obligation to give Europeans a red carpet, and you guys are not in a position to push back anyhow. The Chinese [5] and Russians have given similar ultimatums to the EU as well. What are you going to do? Sign an FTA with India and then face the same problem in 10 years with them?

You guys have fallen into the same trap that the Mughal and Qing Empires fell into in the 18th-19th century. Anyhow, we've unofficially signalled we are leaving the responsibility of Europe's defenses to Europe by 2027 [6] - meaning member states have no choice but to end up buying American gear or completely vacillate to Russia on Ukraine.

[0] - https://www.finance.senate.gov/chairmans-news/-wyden-and-cra...

[1] - https://ustr.gov/about-us/policy-offices/press-office/press-...

[2] - https://www.canada.ca/en/department-finance/news/2025/06/can...

[3] - https://www.politico.eu/article/france-and-germany-find-grou...

[4] - https://www.institutmontaigne.org/en/expressions/real-reason...

[5] - https://www.scmp.com/news/china/diplomacy/article/3316875/ch...

[6] - https://www.reuters.com/business/aerospace-defense/us-sets-2...

It's not "any company", it's exceptionally large platforms who can give insight into large societal questions and have enough influence to sway people's opinions. The data is technically public already, researchers could scrape it, but investigations has to be able to be done to ensure the platforms aren't used to intentionally steer people's opinion in a specific direction, since they're unable to self regulate that it seems.
But governments themselves can steer people's opinions just fine? Can I get access to my politicians' emails "for research purposes"?
> Can I get access to my politicians' emails "for research purposes"?

In the US that's called an FOIA. It could include their personal devices if they use them for work communication. It's not limited to research purposes.

No, they cannot. And yes, in some countries you can request that if you have a reason for it.
Are those emails already public?
They changed the blue check from an exclusive club of the rich and popular, to just Ive got a paying account. How is that misleading? Why does the EU have a say about design choices?
The blue check symbolised (symbolises) being verified, i.e. this account belongs to who it says it does. But it doesn't carry out any/sufficient checks to actually verify that.

See also: https://x.com/jesus/status/1590405986925543424

Twitter created that definition and now the EU has the divine right to not let them change it? Verified can and does mean many things.
They have the legal right, similar to the federal government in the USA. You can disagree with their judgement, but they clearly have the right to enforce it.
If every government in the world has a say on everything, nothing is permitted.
They do though within their borders?
Governments actually have the legal right to enact regulations on how companies operate within their jurisdiction.

If the company does not want to comply they can simply stop operating there.

The common meaning of language is important. If they want it to mean something other than 'verified' as commonly understood, they should rename it.
No divine right, just consumer protection.

USanians have been raised to believe that corporations are somehow above the law but that’s not true. Play stupid games, earn stupid fines a.k.a fuck with people and people will fuck back.

There's no actual need for checks.
They call it 'verified', and, er, do not seem to do much in the way of verification. I mean, it's hard not to see it as misleading at the very least.
I left the EU years ago. Today, I feel way happier and freer. Once you're out, you realize how strongly they were influencing your ability to be free via rules, taxes, news, low salaries, and business start-up costs. Try it yourself if you get the chance.
I earn much more in my 'highly-taxed' Central European city than I'd earn in i. e. Switzerland after all costs are accounted for. Starting my company here cost almost nothing, and hourly rates start at €80. Cost of living is absurdly low compared with earnings - this all in a capital with one of the highest qualities of life on this planet. Schooling and university is completely free and of high quality.

How do people find so much to complain about?

Just take a look at their comment history, most comments are completely empty in content like this one, and I'm willing to bet that if this indeed a person, they've never lived in an European country. Nobody that actually lived in the EU says they've "left the EU", since each country is pretty different and it makes no sense to say it like that. This whole thread has bot-vibes.
Give us a vague breakdown of you finances, might do.
And where he left to.
> "Europe is taxing Americans to subsidize a continent held back by Europe’s own suffocating regulations," Carr said.

And America is taxing Americans via tariffs to subsidize a corrupt executive branch lining its own pockets. At least Europe is looking out for a whole continent. Not just a handful of grifters.

Europe does tax its people a lot more. So the argument doesn't make sense.
Taxes which are used wisely for the people’s benefit is not a wasteful thing. That was the point original commentator made.

Your reasoning is that taxation is always bad and the more you pay the worst, a very American view which I can understand given how badly US government spends money in this regard.

I made no such reasoning. The parent comment wrote about taxes like its something bad.
It didn't just say tax, it suggested what the taxes were for, and how they were levied.

If we're all going to be persnickety about things, let's use the whole context.

Still doesn't make sense. How are tariffs "subsidising" corruption? What does that even mean?
It's just a dog whistle. People hate tax, so calling things that are not tax "tax" triggers anger in people without deep critical thinking skills. Or people with skills but not enough energy or time to use them on this particular issue.
Actually the difference isn't that big when you consider that "taxes" (I'm using this to describe all (semi-)mandatory state money extraction from revenues, whether they're called tax, insurance, cotisation, etc) in European countries cover the majority of healthcare and retirement costs that Americans pay out of pocket. But still have to pay. So if the US had the same "tax" model as European countries do, the rate wouldn't be that off (VAT is usually higher than American sales taxes, income tax often has higher brackets, but Americans spend a lot more on healthcare and retirement).
> "Deceiving users with blue checkmarks, obscuring information on ads and shutting out researchers have no place online in the EU," said European Commission Vice President Henna Virkkunen.

I agree. Good EU!

> Pre-empting the announcement on Thursday night, United States Vice President JD Vance that "the EU should be supporting free speech not attacking American companies over garbage."

Sorry, but your garbage has influence outside the US. Keep it to yourself or clean up.

Deception and fraud aren't even protected by the 1st Amendment, and the blue checkmark scheme being pay-to-win is definitely leaning that way, if not just straight up there. Seems the EU thought is just is.

And if you care so much about free speech, maybe you should be more open about those ads of yours?

eurofounder and compliantvc having blue checks was probably the final straw.
I mean, is there really any reason to continue offering the service in Europe? I highly doubt the revenue is really worth the trouble.
It’s not for profit. Elon put 45 billion dollars into it as a vehicle to influence even more people of the world particularly politicians.

His open stance and clear support or rebuke of various political figures and parties around the world is a clear indication of this.

It’s an effective tool to influence less informed people. How else would they make Farage/Brexit/FN/VB/Orban/… things relevant in public discourse?
At this point, X is a propaganda tool for the radical right. I won't miss X in Europe if you decide to remove access to EU. Please, do it.

Mind you, 120M USD is peanuts for Musk. If it were me, I'd just fine X 1.000.000.000.000.000.000.000 USD just because I want to retaliate against Trump's silliness. If you wanna play hardball, expect it back. But, but... freedom of bullshit. You can keep that, we can perfectly use freedom of speech on solid platforms instead.

Elon Musk's completely reasonable response:

> The EU should be abolished and sovereignty returned to individual countries, so that governments can better represent their people

https://x.com/elonmusk/status/1997279325876367719

https://xcancel.com/elonmusk/status/1997279325876367719

Crazy.
The US could just adopt a law which automatically seizes assets from the EU to cover any such fines. Demonstrate where true power lies.

Define this type of action as "bureaucratic piracy". Any rule which preferentially targets US interests over domestic either in its creation or its enforcement. Apply some of that "disparate outcomes" logic.