Introduction

In recent months, digital media outlets have been reporting numerous news items featuring the European Commission, in which it investigates or even fines certain very large online platforms for failing to comply with Regulation (EU) 2022/2065 on Digital Services (hereinafter “DSA”), also known as the Digital Services Act.

To give a few examples, news regarding the Commission’s first procedure that resulted in a final sanction attracted significant attention: namely, the fine that the European authority imposed on X (formerly Twitter) on December 5, 2025, in the amount of 120 million euros. The reason for the fine was that the social network failed to meet certain transparency standards imposed by the DSA (Arts. 25, 39, and 40.12 DSA) (European Commission, 2025a; RTVE Agencias, 2025)¹.

Along with this, there are also other media publications that have enjoyed great notoriety, related to other sanctions by the Commission, or with investigative procedures initiated by it that are not yet concluded, in which it seeks to determine whether certain platforms should be sanctioned for violating obligations of the Regulation. Specifically, as examples of the first case, one can mention the procedure in which the Commission sanctioned Temu on May 28, 2026, for failing to properly evaluate the risks arising from illegal products sold on its platform (Art. 34 DSA) (European Commission, 2026a).

As an example of the second case, it is worth highlighting the procedure through which, on March 26, 2026, the Commission announced that PornHub, XVideos, XNXX, and Stripchat would likely be sanctioned² for allowing minors to consume pornography (Arts. 34 and 35 DSA) (Gómez, 2026). This investigation is still in a preliminary phase, given that the platforms in question still have the opportunity to exercise their right of defense and respond in writing to the preliminary findings of the Commission. Furthermore, the European Board for Digital Services must still be consulted, as required by Art. 63.1(d) DSA. Only when both steps are completed can the Commission issue a final decision, which, if it confirms the preliminary findings, will quantify the fine to be imposed on the infringing platforms.

In light of the broad media coverage given to the facts outlined, as well as many others led by the Commission³, the goal of this contribution is to analyze the role played by the European Commission in the sanctioning regime of the Digital Services Act. This is a particularly interesting question to the extent that conferring powers upon a European institution to supervise and enforce obligations under a European Union instrument constitutes a novel and extraordinary phenomenon. The reason is that, generally speaking, the enforcement regime of Union rules has traditionally relied on a decentralized structure, where national authorities, rather than the European Commission, have been tasked with executing those rules.

As will be seen, on this occasion, the fact that the Commission was given competencies to apply and enforce the DSA resulted from a decision made during the complex negotiations of the instrument, which aimed to avoid certain mistakes committed in the past regarding the enforcement system of the General Data Protection Regulation (hereinafter “GDPR”). However, although this argument can be reasonable and understandable, adopting this stance has been widely criticized and has generated significant debate, which is what is brought to light here.

Under these circumstances, and in order to understand the role of the European Commission in the public enforcement regime of the DSA and the controversial nature of its appointment, this contribution will follow the structure below.

First, the object and content of the regulation around which the entire research is structured—the Digital Services Act—will be addressed. In doing so, this section will explain the grounds that could justify a sanction by the European Commission. Second, the enforcement and implementation regime of the Regulation in question will be examined, aiming to analyze in depth the situations that the Commission can supervise, investigate, and, where appropriate, sanction.

Following both sections, it will be time to evaluate the debate surrounding the European Commission holding enforcement and sanctioning powers in the examined Regulation, thereby answering the research question posed earlier.

To accomplish all of the above, analytical, comparative, legal, exegetical, and teleological methods will be combined. In particular, the analytical method will allow examining the contents of the relevant European Regulations (primarily the Digital Services Act and the General Data Protection Regulation), while the comparative method will serve as a basis to compare their public enforcement regimes and the competent supervisory authorities in each case. In connection with this, exegetical and teleological methods will become essential to understand the rationale and reasons behind the European legislator’s shift in approach from one Regulation to another. Finally, the legal method will be useful to go beyond this theoretical connection and address more practical issues, such as the controversy surrounding the appointment of the Commission as a supervisory body in the enforcement of the Digital Services Act.

1. A brief overview of the content of the Digital Services Act

According to Art. 1.1 DSA, the Digital Services Act pursues a dual objective: on the one hand, it aims to achieve the proper functioning of the internal market in accordance with Art. 114 TFEU, which serves as the legal basis for the DSA. On the other hand, it strives to establish a safe and trustworthy online environment in which fundamental rights are protected, in line with European digital constitutionalism (De Gregorio, 2022, p. 4)⁴.

With the purpose of achieving this dual objective, the Regulation directs its provisions toward regulating the behavior of all intermediary service providers operating in the Union (Art. 2.1 DSA), including mere conduit, caching, and hosting services⁵. In particular, to this end, the DSA imposes a set of due diligence obligations on all such providers.

In fact, the entirety of Chapter III (Arts. 11 to 48 DSA), representing 40% of the Regulation’s articles, is dedicated to regulating these due diligence obligations. These are numerous and primarily relate to content moderation, transparency of the digital environment, recommender systems, advertising, and the systemic risks that very large online platforms and search engines pose to society.

However, it is worth noting that these mandates become more significant, both in quantity and quality, depending on the type, size, and nature of the intermediary service provider (Recital 41 DSA). As a result, large online platforms and search engines end up facing the most demanding obligations.

Due to space constraints, it is impossible to dwell on all the requirements of the DSA here⁶. Nevertheless, it is appropriate to mention a few of them, as they have truly transformed the way digital intermediaries operate, making them liable for their conduct for the first time.

In this regard, and by way of example, we present those obligations whose non-compliance by very large online platforms justified the actions of the European Commission in the three procedures mentioned in the introductory section of this research. Specifically, we refer to five obligations resulting from combining the obligations breached by X (Arts. 25, 39, and 40.12 DSA) and Temu (Art. 34 DSA), as well as those preliminarily infringed by PornHub, XVideos, XNXX, and Stripchat (Arts. 34 and 35 DSA).

a) First, Art. 25 DSA prohibits online platforms from using dark patterns, as its text reads: «Providers of online platforms shall not design, organize or operate their online interfaces in a way that deceives or manipulates the recipients of their service or in a way that otherwise materially distorts or impairs the ability of the recipients of their service to make free and informed decisions»⁷.

In this sense, the European Commission considered in its decision of December 5, 2025, that X breached the obligation under Art. 25 DSA due to the “deceptive design” it created with its blue verification mark. Indeed, as is well known, the blue checkmark accompanying profile names on the social network was traditionally associated with identifying public, famous, and recognized figures. However, X altered this system into a paid service, meaning the blue checkmark was no longer reserved for famous individuals, but for anyone who paid for it.

Consequently, the European Commission determined that this action constitutes a dark pattern prohibited by Art. 25 DSA, insofar as it is capable of confusing digital users regarding identity and influencing their decisions in the online environment. That is, although Art. 25 DSA does not mandate user verification, it does prohibit platforms from presenting certain profiles as verified when they have not actually been verified as such. And this is the conduct for which the European Commission sanctioned X.

b) Second, the obligation under Art. 39 DSA requires very large online platforms to compile a public advertisement repository containing all advertisements published, for a period starting from display and lasting one year after the last display of each advertisement. Furthermore, they must identify certain minimum information for each advertisement, including details such as the content of the ad, who presented it, who paid for it, or how long it was visible on the platform.

Undoubtedly, the intention of this obligation is to guarantee public scrutiny and transparency of platforms, allowing disinformation to be combated through easier detection of manipulative strategies, as well as facilitating regulatory compliance monitoring (e.g., consumer protection rules).

Again, the European Commission considered that X breached the aforementioned mandate, given that although X did create the repository in question⁸, it does not allow easy or fast access to it, and failed to include all the mandatory minimum information for each advertisement, such as its content or the company paying for it. This conduct, which can hinder the scrutiny of advertising risks online, also led the Commission to sanction X.

c) Third, the third due diligence obligation of concern here is established in Art. 40.12 DSA. According to this provision, very large online platforms are required to grant access to their data, including real-time access, to vetted researchers such as non-profit organizations⁹, with the aim of enabling them to research the systemic risks that large platforms pose to society.

In this regard, the European Commission also sanctioned X for significantly hindering or unjustifiably denying data access to certain researchers based on this provision. In fact, the social network’s non-compliance was so blatant that a German NGO even filed legal proceedings against X for baseless denial of data access granted under Art. 40.12 DSA (LG Berlin II, May 13, 2025, Case No. 41 O 140/25 eV¹⁰).

d) Fourth, another due diligence obligation introduced by the DSA is in Art. 34 DSA. This risk management provision, which is increasingly common in European digital legislation (De Gregorio and Dunn, 2022, p. 477), requires very large online platforms to identify and assess annually «any systemic risks in the Union stemming from the design or functioning of their service and its related systems, including algorithmic systems, or from the use made of their services». In this way, large platforms are required to outline with reasoned arguments the systemic risks generated by their services.

In particular, the provision outlines several systemic risks that must be assessed, such as those related to the dissemination of illegal content, negative effects on civic discourse, public safety, public health protection, or the physical and mental well-being of individuals, among others.

In these circumstances, the European Commission considered that in at least two of the investigation and sanctioning procedures analyzed here, this obligation under Art. 34 DSA was breached. On one hand, it determined that the Chinese platform Temu had failed to properly evaluate the risks generated by the distribution of illegal products, such as baby toys or electronic devices (European Commission, 2026a).

On the other hand, in a parallel proceeding targeting Pornhub, Stripchat, XNXX, and XVideos, the Commission also preliminarily found that they failed to assess properly the risks stemming from minors having access to and exposure to pornographic content.

e) Finally, and related to the previous requirement, Art. 35 DSA mandates that platforms, after detecting and evaluating systemic risks under Art. 34 DSA, adopt measures to mitigate those risks, which must be reasonable, proportionate, and effective.

Among the mentioned measures, the provision lists adapting online interface design, general terms and conditions, content moderation processes, or advertising systems, providing more information to digital users, or adopting specific measures to protect children’s rights, including age verification tools¹¹.

Under this obligation, the Commission preliminarily found (pending a final decision) that the aforementioned adult content platforms were infringing the provision because they failed to adopt adequate measures to mitigate risks derived from exposing minors to pornographic content, such as age verification mechanisms (European Commission, 2026f). Although these platforms state in their terms and conditions that their services are for adults only, they allow access to minors through a simple checkbox confirming age over 18, without further verification.

In short, the five due diligence obligations mentioned illustrate part of the framework established by the Digital Services Act. They are highly relevant to our research because their violation provides the basis for the investigation and sanctioning procedures carried out by the European Commission.

2. The enforcement regime of the Digital Services Act and its hybrid nature

Aware of the significance of the Digital Services Act, which is set to substantially alter the modus operandi of the online environment (Cioffi, Kenney, and Zysman, 2022, p. 829), the European legislator focused on ensuring the instrument’s effectiveness. Consequently, significant efforts were devoted to designing a particularly robust implementation and enforcement system (Bartels, 2024, p. 157).

In this regard, the then European Commissioner for Internal Market, Thierry Breton, confirmed this focus in 2022 by forcefully asserting that for this instrument, «enforcement is the key» (European Commission, 2022a). Furthermore, the Political Guidelines issued by the Commission for the 2024–2029 term demonstrate that this is not merely a passing concern, labeling the proper application and enforcement of the DSA as one of the Union's primary objectives for the coming five years (Von der Leyen, 2024, p. 10).

Consistent with the above, at least two aspects of the Regulation demonstrate the substantial effort dedicated by the European legislator to designing the DSA’s enforcement regime.

First, nearly half of the Regulation’s text is devoted exclusively to regulating its application and enforcement system. Indeed, Chapter IV, titled “Implementation, Cooperation, Sanctions and Enforcement,” addresses this issue across Arts. 49 to 88 DSA, constituting almost half of the 93 provisions in the entire instrument.

Second, another proof of the importance of the DSA enforcement framework is its hybrid nature, allowing the DSA to be executed through two parallel avenues: public enforcement and private enforcement. Specific reference to both arms of execution is particularly noteworthy, given that European legislation traditionally restricted enforcement to public law mechanisms (Jans, de Lange, Prechal, and Widdershoven, 2007, pp. 4, 13, and 202).

a) On one hand, public enforcement of the DSA allows administrative authorities to impose penalties on intermediaries that violate the Regulation. In line with the Union’s decentralized administrative system, supervising and executing the application of the instrument primarily falls to national authorities designated by each Member State, known as “Digital Services Coordinators” (Art. 49.1 DSA). They are responsible for ensuring compliance with the instrument by intermediary service providers established or represented in their Member State’s territory (Arts. 56.1 and 6 DSA), possessing powers to sanction them in cases of non-compliance (Art. 52 DSA).

However, national supervision faces a notable exception: the European Commission has powers to monitor DSA compliance regarding very large online platforms and search engines designated as such by the European Commission due to having an average monthly active user base exceeding 10% of the Union population (currently equivalent to 45 million users) (Art. 33 DSA). Specifically, the Commission’s competencies can be exclusive or preferential, depending on the case.

i) On one hand, the Commission holds exclusive authority to supervise compliance with obligations specifically addressed to very large online platforms and search engines, set out in Section 5 of Chapter III DSA (Arts. 33 to 43 DSA) (Art. 56.2 DSA). Digital Services Coordinators have no jurisdiction in this area.

ii) On the other hand, the Commission also holds powers to oversee compliance with other obligations imposed on very large online platforms and search engines, distributed across Arts. 11 to 32 DSA (Art. 56.3 DSA). However, these are preferential rather than exclusive powers, because if the Commission does not initiate an investigative proceeding, the Digital Services Coordinator of the Member State of establishment or representation—typically Ireland— retains jurisdiction to act instead (Art. 56.4 DSA)¹².

In either case, the Commission’s specific supervision and sanctioning powers are regulated in Section 4 of Chapter IV (Arts. 64 to 83). Beyond investigative authority, these powers allow imposing fines for non-compliance of up to 6% of the infringing provider’s total worldwide annual turnover in the preceding financial year (Art. 74.1 DSA)¹³. Additionally, if the Commission finds an infringement under Section 5 of Chapter III DSA, it will require the provider to formulate an action plan detailing measures to end the infringement, including independent audit requirements or joining a code of conduct (Art. 75 DSA).

b) On the other hand, alongside public enforcement, the DSA explicitly acknowledges private enforcement mechanisms in Arts. 54, 86, and 90 DSA. Given the concise nature of these provisions, understanding private legal remedies requires looking at the European private enforcement model. Under this model, digital users can seek judicial redress to claim compensation for damages caused by an intermediary’s breach of directly effective DSA obligations (Gallo, 2025, p. 37)¹⁴, which comprise the majority.

In other words, private enforcement means the DSA grants digital users rights that they can enforce against intermediary service providers before national courts. These rights derive directly from the directly effective due diligence obligations placed on providers under Arts. 11 to 48 DSA.

3. The controversy surrounding the Commission’s appointment

The previous section clarified that, as part of the DSA’s public enforcement mechanism, the European Commission holds specific powers to investigate, supervise, and sanction non-compliance with due diligence obligations by very large online platforms and search engines. For this exact reason, the Commission opened the aforementioned investigative proceedings into potential DSA violations by platforms such as X, Temu, and Pornhub.

Having established this, we must ask why the Commission was vested with supervisory and sanctioning powers under this instrument, considering that direct public enforcement of Union law by EU institutions has historically been exceptional. Public legal enforcement mechanisms have generally functioned in a decentralized manner, relying on national authorities (Jans, de Lange, Prechal, and Widdershoven, 2007, pp. 6–7; Scholten, 2017, p. 1349). Conversely, the Commission rarely carried out this role, with Competition Law under Directive 2014/104/EU standing as a key exception. This decentralization exists because the EU traditionally focused on harmonizing substantive law to consolidate the internal market while leaving enforcement regulation aside (Franck, 2019, p. 110)¹⁵.

As shown below, the rationale for assigning enforcement powers to the Commission under the DSA stems from prior experience with public enforcement of the General Data Protection Regulation (Buri and Van Hoboken, 2022, p. 3). The European legislator learned from the GDPR enforcement structure that, while parts should be replicated, it does not always function effectively and must be adjusted for future European digital legislation¹⁶ like the DSA. However, adopting this approach is not without criticism.

3.1. The country of origin principle in GDPR public enforcement and its impact on the DSA

Had the Commission not been granted investigative and sanctioning powers under the DSA, public enforcement would have fallen entirely to national authorities, tasked with supervising compliance by intermediary service providers established in their respective territories.

Consequently, for very large online platforms, the competent Digital Services Coordinator would mostly be Ireland’s (Coimisiún na Meán)¹⁷, given that many tech giants choose to establish their headquarters there primarily for fiscal reasons (e.g., X, Temu, Facebook).

This approach, commonly known as the country of origin principle or one-stop-shop mechanism (Buri and Van Hoboken, 2022, p. 11), is precisely the one governing the General Data Protection Regulation, where public enforcement relies exclusively on national authorities (Data Protection Authorities) rather than the Commission or supranational agencies. Specifically, each Member State’s Data Protection Authority oversees GDPR compliance for data controllers or processors established or operating within its territory (Art. 55 GDPR).

This delegation to national authorities under the GDPR was widely praised for preventing cross-border data processors or controllers from having to deal with 27 distinct national bodies. Nevertheless, this approach faced significant criticism concerning tech giants (Vergnolle, 2025, p. 103), including from the European Commission itself (European Commission, 2020, p. 7).

The main issue regarding these tech giants—which persists today—was that GDPR compliance had to be supervised by the national authority where they were established, which, as established, usually meant Ireland. However, the Irish Data Protection Commission has historically faced accusations of being overly lenient in enforcing the GDPR to prevent corporate flight (Genç-Gelgeç, 2022, p. 56)¹⁸, provoking frustration among national authorities in Member States like France, Germany, or Denmark, which even requested powers to intervene directly (Vergnolle, 2025, p. 104; Husovec, 2024, p. 421).

Despite these complaints, jurisdictional allocation under the GDPR remains unchanged. However, those protests heavily influenced negotiations and the resulting division of powers in the enforcement design of subsequent regulations like the DSA, as analyzed below.

3.2. A reinterpretation of the country of origin principle in DSA public enforcement

To prevent lax GDPR enforcement over tech giants from repeating under the Digital Services Act, stakeholders during DSA negotiations emphasized avoiding a direct copy of the country of origin principle. Centralizing the entire enforcement regime within the Commission was considered as an alternative. However, while centralizing oversight in the Commission could ensure more effective and consistent DSA enforcement, it proved controversial for two reasons.

i) First, the Commission proposes EU legislation, so granting it direct supervisory and enforcement powers over the DSA could jeopardize the separation of powers within the Union, effectively allowing it to enforce laws it authored (Vergnolle, 2025, p. 107; Genç-Gelgeç, 2022, p. 57).

ii) Second, doubts emerged over whether the Commission—a politico-administrative body with indirect democratic legitimacy—could supervise DSA compliance independently and without political influence (Bartels, 2024, pp. 152–153).

These concerns led several Member States to reject giving the Commission supervisory authority under the DSA.

Ultimately, a compromise was reached: the Commission would not oversee all intermediary service providers, but only the largest entities—very large online platforms and search engines—leaving remaining providers (the vast majority) to national authorities (Centre for Future Generations, 2025). This compromise was justified by reinterpreting the country of origin principle, arguing that tech giants are so vast that their “country of origin” effectively encompasses the entire Union rather than a single Member State, as confirmed by Irene Roche Laguna, head of the Commission’s DSA enforcement unit (DG Connect), in an April 2023 interview (Interface, 2023).

Therefore, this rationale confirms that a reinterpreted country of origin principle served as the foundation for granting the Commission specific supervisory and sanctioning powers in public DSA enforcement. This outcome was codified in Arts. 56.2 and 56.3 DSA, granting the Commission exclusive authority over very large online platforms and search engines.

3.3. Potential symbolism behind the Commission’s actions

Theoretically, the previous sections suggest that appointing the Commission as the DSA supervisory authority was a sound decision given the GDPR’s enforcement history. However, assessing whether this was truly the right choice requires practical analysis—examining the Commission’s actions to evaluate whether it is deploying effective enforcement measures.

From August 25, 2023¹⁹ to date, the European Commission opened 16 formal investigations against designated very large online platforms or search engines under Art. 33 DSA. It also issued 75 formal requests for information under Art. 67 DSA regarding suspected violations²⁰. Considering that 23 online platforms and 2 search engines have been designated as very large (European Commission, 2026b), these figures reflect significant activity, averaging 0.64 formal investigations per designated entity²¹ and 3 requests for information each.

These figures suggest that the EU authority has dedicated substantial effort to launching the DSA penalty framework. The Commission itself affirmed that effective DSA enforcement remains a key priority for 2024–2029 (Von der Leyen, 2024, p. 10). Additionally, the Commission expanded human resources within its enforcement department, DG Connect, hiring over 50 specialists on temporary contracts (European Commission, 2025d)²².

However, this preliminary conclusion changes when these facts are contextualized. Of the 16 formal investigations opened, only three have concluded with sanctions²³. Two others closed provisionally following binding commitments offered by platforms to ensure compliance²⁴, though the Commission retains power to reopen investigations if commitments are breached (Art. 71 DSA). The remaining investigations remain open.

Given the low number of concluded proceedings, legal scholars suggest the Commission may be intentionally dragging out investigations (Centre for Future Generations, 2025²⁵). Furthermore, critics argue that Brussels focuses primarily on minor or superficial infractions, avoiding complex or controversial structural issues that would require costly changes for platforms (Keller, 2025)²⁶.

Consequently, the EU authority’s actions may carry substantial “symbolism.” Experts note that as a political body, the Commission operates within geopolitical constraints, including threats from US President Donald Trump, whose stance on digital regulation is influential (Centre for Future Generations, 2025).

Indeed, the US President expressed concerns to European Commissioners regarding the DSA (Centre for Future Generations, 2025), calling it an “attack” on the United States (Jagtap, 2025). Moreover, he directed US diplomats in Europe to campaign against the DSA, threatening potential sanctions against EU officials implementing digital laws (Pamuk, 2025).

These geopolitical pressures appear to have cautious influence over the Commission, leading it to exercise restraint in enforcement to avoid retaliation from the US, where major platforms powering Europe’s tech ecosystem originate.

Another indication of symbolic and politically influenced action involves Commission members acting outside formal DSA supervisory mechanisms simply to project an image of robust enforcement.

Specifically, in 2023 and 2024, former Internal Market Commissioner Thierry Breton sent letters reminding large platforms of their DSA duties²⁷, notably sending one to Elon Musk hours before he interviewed US presidential candidate Donald Trump live on X.

Critics contend that Breton acted politically to project strong commitment to enforcement. However, his actions exceeded the formal powers granted by the DSA framework and occasionally referenced obligations not present in the text (Access Now, ARTICLE 19, and EFF, 2024; Jackson and Malaret, 2023).

In summary, the public enforcement regime led by the European Commission risks operating as symbolic compliance, constrained by broader diplomatic and geopolitical pressures. This dynamic threatens the DSA’s core goal: deterring non-compliance by major digital actors in the internal market.

Conclusions

This study has explored the rationale behind vesting the European Commission with supervisory and sanctioning powers over very large online platforms under the DSA, such as X, Temu, PornHub, Facebook, Wikipedia, or LinkedIn. This logic extends to other digital regulations like the Digital Markets Act, where enforcement powers sit centrally with the Commission regarding gatekeepers.

Avoiding the GDPR’s pitfall—where oversight fell primarily on a single lenient national authority (the Irish Data Protection Commission)—prompted the decision to grant the European Commission direct enforcement powers over very large platforms under the DSA.

While sensible in intent, assigning these responsibilities to a political body creates new challenges. Currently, the Commission’s actions appear constrained by geopolitical pressures, particularly from the United States, limiting aggressive enforcement.

If this cautious posture persists, enforcement efficiency may decline, raising the question of whether an independent supranational agency—similar to the European Securities and Markets Authority—should replace the Commission to ensure European digital laws retain practical effectiveness.

References

Access Now, ARTICLE 19, and EFF (2024). Joint statement, https://www.eff.org/document/joint-statement-access-now-article-19-and-eff-regarding-breton-letter.

Bartels, M. (2024). Enforcement. En T. Kraul (Ed.), New Digital Services Act. A practitioner’s guide (pp. 132-158). Nomos.

Bertrand, B. (Ed.) (2024). Règlement DSA 2022/2065 relatif à un marché unique des services numériques: commentaire article par article. Bruylant.

Buri, I. y Van Hoboken, J. (Junio de 2022). The DSA supervision and enforcement architecture. DSA Observatory, 1-15, https://dare.uva.nl/search?identifier=78d7315a-7bb2-4f79-86d1-8d85f381bca0.

Castelló Pastor, J. J. (Dir.) (2025a). Análisis del Reglamento (UE) de servicios digitales y su interrelación con otras normas de la Unión Europea. Aranzadi.

Castelló Pastor, J. J. (2025b). Inteligencia artificial aplicada por las plataformas en línea y motores de búsqueda de muy gran tamaño para mitigar los riesgos sistémicos en línea. Cuadernos de Derecho Transnacional, 17(1), 308-328. https://doi.org/10.20318/cdt.2025.9331.

Centre for Future Generations (2025). Enforcement spotlight – Spring 2025: tracking the EU’s digital rulebook in practice, https://cfg.eu/enforcement-spotlight-spring-2025/.

Cioffi, J., Kenney, M. F., y Zysman, J. (2022). Platform power and regulatory politics: Polanyi for the twenty-first century. New Political Economy, 27(5), 820-836. https://doi.org/10.1080/13563467.2022.2027355.

European Commission (2020). Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition - two years of application of the General Data Protection Regulation, COM(2020) 264 final.

European Commission (2022a, July 5). Sneak peek: how the Commission will enforce the DSA & DMA - Blog of Commissioner Thierry Breton. Press Corner European Commission, https://ec.europa.eu/commission/presscorner/detail/en/statement_22_4327.

European Commission (2022b). Annex to the communication to the Commission a New Human Resources Strategy for the Commission, C(2022) 2229 final.

European Commission (2024a, December 17). Commission opens formal proceedings against TikTok on election risks under the Digital Services Act. Press Corner European Commission, https://digital-strategy.ec.europa.eu/en/news/commission-opens-formal-proceedings-against-tiktok-election-risks-under-digital-services-act.

European Commission (2024b, May 16). Commission opens formal proceedings against Meta under the Digital Services Act related to the protection of minors on Facebook and Instagram. Press Corner European Commission, https://ec.europa.eu/commission/presscorner/detail/en/ip_24_2664.

European Commission (2024c, August 5). TikTok commits to permanently withdraw TikTok Lite Rewards programme from the EU to comply with the Digital Services Act. Press Corner European Commission, https://ec.europa.eu/commission/presscorner/detail/en/ip_24_4161.

European Commission (2025a, December 5). Commission fines X €120 million under the Digital Services Act. Press Corner European Commission, https://digital-strategy.ec.europa.eu/en/news/commission-fines-x-eu120-million-under-digital-services-act.

European Commission (2025b, June 18). Commission accepts commitments offered by AliExpress under the Digital Services Act and takes further action on illegal products. Press Corner European Commission, https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1551.

European Commission (2025c, December 5). Commission accepts TikTok’s commitments on advertising transparency under the Digital Services Act. Press Corner European Commission, https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2940.

European Commission (2025d, April 11). Join the Digital Services Act enforcement team. Official EU Web, https://digital-strategy.ec.europa.eu/en/news/join-digital-services-act-enforcement-team.

European Commission (2026a, May 28). Commission fines Temu €200 million for breaching the Digital Services Act. Press Corner European Commission, https://digital-strategy.ec.europa.eu/en/news/commission-fines-temu-eu200-million-breaching-digital-services-act.

European Commission (2026b, July 20). Supervision of the designated very large online platforms and search engines under DSA. European Commission, https://digital-strategy.ec.europa.eu/en/policies/list-designated-vlops-and-vloses.

European Commission (2026c, March 26). Commission investigates Snapchat’s compliance with child protection rules under the Digital Services Act. Press Corner European Commission, https://ec.europa.eu/commission/presscorner/detail/en/ip_26_723.

European Commission (2026d, January 26). Commission investigates Grok and X’s recommender systems under the Digital Services Act. Press Corner European Commission, https://digital-strategy.ec.europa.eu/en/news/commission-investigates-grok-and-xs-recommender-systems-under-digital-services-act.

European Commission (2026e, July 20). Commission fines AliExpress €550 million for breaching the Digital Services Act. Press Corner European Commission, https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1654.

European Commission (2026f, March 26). Commission preliminarily finds PornHub, Stripchat, XNXX and XVideos in breach of the Digital Services Act for allowing minors to access their services. Press corner European Commission, https://ec.europa.eu/commission/presscorner/detail/en/ip_26_722.

European Commission (2026g, n.d.). Working at the Commission – conditions and environment. Official EU Web, https://commission.europa.eu/about/service-standards-and-principles/modernising-european-commission/working-european-commission/working-commission-conditions-and-environment_en. Retrieved: July 21, 2026.

Corberá Martínez, J. (2025). Diseño y organización de interfaces en línea en el Reglamento (UE) de servicios digitales. En J.J. Castelló Pastor (Dir.), Análisis del Reglamento (UE) de servicios digitales y su interrelación con otras normas de la Unión Europea (pp. 193-196), Aranzadi.

De Gregorio, G. (2022). Digital constitutionalism in Europe. Reframing rights and powers in the algorithmic society. Cambridge University Press.

De Gregorio, G. y Dunn, P. (2022). The European risk-based approaches: connecting constitutional dots in the digital age. Common Market Law Review, 59(2), 473-500. http://dx.doi.org/10.2139/ssrn.4071437.

Franck, J. (2019). Private enforcement versus public enforcement. En F. Hofmann y F. Kurz (Eds.), Law of remedies. A European perspective (pp. 108-131). Intersentia.

Gallo, D. (2025). Direct effect in EU law. Oxford University Press.

Gascón Marcén, A. (2021). The General Data Protection Regulation as a model for recent European digital legislation proposals. Cuadernos de Derecho Transnacional, 13(2), 209-232. https://doi.org/10.20318/cdt.2021.6256.

Genç-Gelgeç, B. (2022). Regulating digital Platforms: will the DSA correct its predecessor’s deficiencies? CYELP, 18, 25-60. https://doi.org/10.3935/cyelp.18.2022.485.

Gómez, M. V. (2026, March 26). Brussels accuses Pornhub and three other platforms of violating the law “by allowing minors” to consume pornographic content, El País, https://elpais.com/tecnologia/2026-03-26/bruselas-acusa-a-pornhub-y-otras-tres-plataformas-de-incumplir-la-ley-al-permitir-que-los-menores-consuman-contenido-pornografico.html.

Hendrix, J. (2025, 7 de diciembre). Unpacking the politics of the EU’s €120M fine of Musk’s X. Tech policy press, https://www.techpolicy.press/unpacking-the-politics-of-the-eus-120m-fine-of-musks-x/.

Husovec, M. (2024). Principles of the Digital Services Act. Oxford University Press.

Interface (2023, 1 de abril). Background briefing: enforcing the DSA – Online talk with Irene Roche Laguna, Interface, https://www.interface-eu.org/events/background-briefing-enforcing-the-dsa-online-talk-with-irene-roche-laguna.

Irish Data Protection Commission. (2021). Annual Report 2020. https://www.dataprotection.ie/sites/default/files/uploads/2021-02/DPC%202020%20Annual%20Report%20%28English%29.pdf

Jackson, R. y Malaret, J. (2023, 26 de octubre). As Israel and Hamas go to war, the Digital Services Act faces its major test, DFRLab, https://dfrlab.org/2023/10/26/as-israel-and-hamas-go-to-war-the-digital-services-act-faces-its-first-major-test/.

Jagtap, V. (2025, 5 de diciembre). Marco Rubio calificó la multa de la Unión Europea a la red social X como un “ataque” a Estados Unidos. Infobae, https://www.infobae.com/estados-unidos/2025/12/05/marco-rubio-califico-la-multa-de-la-union-europa-a-la-red-social-x-como-un-ataque-a-estados-unidos/.

Jans, J. H., de Lange, R., Prechal, A., y Widdershoven, R.J.G.M. (2007). Europeanisation of public law. Europa Law Publishing.

Keller, D. (2025, 5 de diciembre). The EU’s fine against X is not about speech or “censorship”. Tech policy press, https://www.techpolicy.press/the-eus-fine-against-x-is-not-about-speech-or-censorship/.

López-Tarruella Martínez, A. (2023). The future Artificial Intelligence Act and relations with third States. Revista Electrónica de Estudios Internacionales, 45, 1-29. https://doi.org/10.17103/reei.45.04.

Mast, T., Kettemann, M.C., Dreyer, S. y Schulz, W. (eds.) (2024). DSA / DMA. Kommentar. C.H. Beck.

Palao Moreno, G. (2024). Enforcement orders against illegal content in the new European Digital Services Act. In J. J. Castelló Pastor (Dir.), Analysis of the Regulation (EU) on digital services and its interaction with other EU norms (pp. 109-134). Aranzadi.

Pamuk, H. (2025, 26 de agosto). Trump administration weighs sanctions on officials implementing EU tech law, sources say. Reuters, https://www.reuters.com/world/us/trump-administration-weighs-sanctions-officials-implementing-eu-tech-law-sources-2025-08-26/.

Raue, B. (2025). Dark Patterns on online platforms and the interplay between the Digital Services Act and the Unfair Commercial Practices Directive. Journal of European Consumer and Market Law, 14(3), 109-111.

RTVE Agencias (2025, December 5). European Commission fines X 120 million euros for lack of transparency. RTVE noticias, https://www.rtve.es/noticias/20251205/comision-europea-multa-x-con-120-millones-euros-por-falta-transparencia/16846621.shtml.

Scholten, M. (2017). Mind the trend! Enforcement of EU law has been moving to “Brussels”. Journal of European Public Policy, 24(9), 1348-1366. https://doi.org/10.1080/13501763.2017.1314538.

Vergnolle, S. (2025). To break up or regulate big tech? Avenues to constrain private power in the DSA/DMA package. En H. Richter, M. Straub, y E. Tuchfeldt (Eds.), Enforcement of the DSA and the DMA – What did we learn from the GDPR? (pp. 103-110). Max Planck Institute for Innovation and Competition Research Paper.

Von der Leyen, U. (2024). La decisión de Europa. Orientaciones políticas para la próxima Comisión Europea 2024-2029, European Commission, 1-39, https://commission.europa.eu/priorities-2024-2029_es.

Wilman, F., Kaläda, S. L., y Loewenthal, P. (2024). The EU Digital Services Act. Oxford University Press.

Cited legislation, case law, and instruments

Directive 2014/104/EU of the European Parliament and of the Council of 26 November 2014 on certain rules governing actions for damages under national law for infringements of the competition law provisions of the Member States and of the European Union. OJ L 349, 5.12.2014.

LG Berlin II, 13 de mayo de 2025, en el asunto núm. 41 O 140/25 eV, ap. 28, versión en línea accesible en https://openjur.de/u/2526186.html.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). OJ L 119, 4.5.2016.

Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act). OJ L 265, 12.10.2022.

Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act). OJ L 277, 27.10.2022.

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act). OJ L 2024/1689, 12.7.2024.

STJUE de 5 de febrero de 1963, en el asunto 26/62, Van Gend en Loos (ECLI:EU:C:1963:1).

Funding: The research received no public, commercial, or non-profit funding.

Conflict of interest: The author declares no conflict of interest in the preparation of this article.

Declaration of contributions based on CRediT taxonomy: The author declares their contributions to this research article using the CRediT taxonomy: Conceptualization: (100%); Formal analysis: (100%); Investigation: (100%); Writing - original draft: (100%); Writing - review & editing: (100%).

AI usage: The author declares that no artificial intelligence tools were used at any stage of the manuscript preparation.

Notes

¹The link to this news item, as well as all the other links provided throughout this contribution, was last accessed on July 21, 2026.

²It should be noted that, since May 27, 2025, Stripchat is no longer considered by the Commission to be a very large online platform within the meaning of the Digital Services Act. This is because its average number of monthly active recipients of the service in the Union fell below 45 million, which is a requirement for designation as a very large online platform under Art. 33.1 DSA. Consequently, the obligations that the DSA lays down for very large online platforms ceased to apply to Stripchat four months after that date, that is, on September 27, 2025. Even so, the platform will remain liable for the DSA obligations for the period during which it was indeed considered a platform of that size, which runs from its designation (December 20, 2023) until the termination of that designation (September 27, 2025). For this reason, the aforementioned investigation, whose preliminary findings date from March 26, 2026, remains open (European Commission, 2026b).

³The Commission has also made a significant number of headlines for having opened many other investigation proceedings, not yet concluded, against other Big Tech companies for having likely infringed certain DSA provisions. This is the case of the proceedings against platforms such as Snapchat, opened on March 26, 2026 (European Commission, 2026c), Grok and X, opened on January 26, 2026 (European Commission, 2026d), TikTok, opened on December 17, 2024 (European Commission, 2024a), and Meta, opened on May 16, 2024 (European Commission, 2024b). In addition, it should be noted that, at the time of writing, the Commission has just fined AliExpress, on July 20, 2026, for failing to assess accurately the extent to which its recommender and advertising systems may exacerbate the promotion of illegal products, as well as for failing to detect the illegal products it sells and to adequately sanction the sellers of such products, among other issues (European Commission, 2026e).

⁴European digital constitutionalism consists in making the protection of democracy, values and the fundamental rights of digital users one of the main objectives of European legislation. This concept, which illustrates the way in which the Union defends its constitutional and democratic system against the power acquired by large platforms, is reflected not only in the objectives of the DSA but also in those of other European digital laws, such as Regulation (EU) 2022/1925 on Digital Markets or Regulation (EU) 2024/1689 on Artificial Intelligence.

⁵As set out in Art. 3(i) DSA, online platforms are a subtype of hosting services that not only store information at the request of a recipient—like any other hosting service—but are also characterised by disseminating that information to the public.

⁶For further information on the Regulation and its content, see Bertrand (2024), Castelló Pastor (2025a), Husovec (2024), Mast, Kettemann, Dreyer and Schulz (2024), and Wilman, Kaläda and Loewenthal (2024).

⁷It is true that the use of dark patterns is also a practice prohibited by European rules other than the DSA, such as Directive 2005/29/EC on unfair commercial practices, among many others. For more on the difficult coordination between the prohibition in Art. 25 DSA and other European rules which, like the Directive, prohibit this type of practice, see Raue (2025) and Corberá Martínez (2025).

⁸It can be consulted directly via the following link: https://business.x.com/en/help/ads-policies/product-policies/ads-transparency.

⁹Specifically, the researchers who must be granted access to data under Art. 40.12 DSA are those who meet the conditions laid down in Art. 40.8(b) to (e) DSA. This means that they must be independent and free from commercial interests, must disclose how their research is funded, must comply with the security and confidentiality requirements for personal data and set out the measures taken to that end, and must demonstrate that the access to data and the time frames requested are necessary for, and proportionate to, the purposes of their research.

¹⁰Admittedly, on that occasion the judgment in question merely revoked the interim measures and did not rule on the merits, so it did not decide whether the refusal of access to the data had in fact been unlawful. Even so, the very existence of this lawsuit perfectly illustrates that X is not facilitating access to its data.

¹¹For further detail on the mitigation of systemic risks, see Castelló Pastor (2025b).

¹²The distinction between the two types of powers that the DSA confers on the Commission is clearly reflected in the aforementioned proceedings in which the Commission fined X in December 2025. In particular, as shown in this contribution, the fine was imposed for X’s breach of the obligations under Arts. 25, 39 and 40.12 DSA. Whereas supervision of compliance with the obligations under Arts. 39 and 40.12 DSA could only be carried out by the European Commission (these obligations fall within Section 5 of Chapter III DSA), the investigation concerning the obligation under Art. 25 DSA could have been conducted by the competent Digital Services Coordinator (the Irish one), had the Commission not opened investigation proceedings on the matter.

¹³In fact, the Commission may only impose a fine within the meaning of Art. 74 DSA if it identifies an actual infringement by the provider. Conversely, if the proceedings opened by the Commission identify a potential, but not actual, infringement, they will end with commitments, whereby the Commission agrees with the provider of the very large online platform or search engine concerned that the latter will undertake commitments ensuring compliance with the DSA obligations (Art. 71 DSA). Indeed, this possibility has already materialised in decisions in which the Commission identified potential infringements and agreed binding commitments with platforms such as AliExpress (European Commission, 2025b) and TikTok (European Commission, 2025c).

¹⁴In order to have “direct effect” and be directly invoked before national courts, the obligations in question must meet the requirements of clarity, precision and unconditionality established by the judgment of the Court of Justice of February 5, 1963, Case 26/62, Van Gend en Loos (ECLI:EU:C:1963:1), section II.B, pp. 340-341.

¹⁵The designation of the Commission as the supervisory institution in the DSA and in other European digital laws, such as the Digital Markets Act, represents a centralising route for the system of application and enforcement of Union law, which increasingly relies on the European institutional apparatus to the detriment of national supervisory authorities. In this regard, it should be noted that, alongside this route, the European Union has recently also strengthened the enforcement of its rules through other centralising channels, such as the creation of certain independent, supranational regulatory supervisory agencies (Scholten, 2017, pp. 1348-1366). Both situations are novel and exceptional compared with the traditional course of the regime for the application and enforcement of Union law, which was entrusted exclusively to national authorities. However, this contribution focuses exclusively on the first of these scenarios, given that, for the time being, there are no European administrative agencies performing this function in the European digital sphere, precisely because it has been conferred on the European Commission.

¹⁶The expression European digital laws is mainly used to refer to those Regulations adopted by the Union that form part of digital regulation and share certain common features. According to the scholarship that coined the term, it would encompass the GDPR, the DSA, the Digital Markets Act, the Data Act, the Data Governance Act and the Artificial Intelligence Act. This label, initially used by Gascón Marcén (2021) and López-Tarruella Martínez (2023), has been widely adopted in the literature, notably by authors such as Palao Moreno (2024).

¹⁷Coimisiún na Meán, official website: https://www.cnam.ie/general-public/online-safety/.

¹⁸Moreover, the 2020 annual report issued by the Irish Data Protection Authority states that, since the GDPR became applicable in 2018, this body had imposed only ten fines up to that date (Irish Data Protection Commission, 2021).

¹⁹This date marked the start of the application of the DSA to online platforms and search engines designated as very large under Art. 33 DSA. This is because the first batch of online platforms and search engines designated as very large was designated on April 25, 2023 and, pursuant to Art. 92 DSA, the Regulation began to apply to those platforms four months later, that is, on August 25, 2023, even though the date of application of the DSA for the rest of the Regulation was, as a general rule, February 17, 2024 (Art. 93.2 DSA).

²⁰The figures counted, namely 16 proceedings and 75 requests for information, refer to the investigation proceedings opened by the European Commission and the requests for information it has issued—before or after opening investigation proceedings—against all very large online platforms and search engines designated as such up to the present date, July 21, 2026. Information on all investigation proceedings and requests for information, sorted by very large online platform or search engine, can be found at: https://digital-strategy.ec.europa.eu/en/policies/list-designated-vlops-and-vloses.

²¹It should be borne in mind that this is merely an arithmetic average and that the actual distribution is not uniform.

²²Against this argument, it could be contended that, beyond these 50 staff members, who are contract agents, the European Commission’s staff are usually officials who have passed a generalist open competition and who rotate between the Commission’s different departments (European Commission, 2026g, and European Commission, 2022b), so that they would not be as specialised as the staff of other national supervisory bodies, such as, in the field of data protection, the Spanish Data Protection Authority. However, this criticism is not as well founded as it may seem. Although the Commission encourages internal mobility, its officials may choose to work in a single team, and even when they change teams, they frequently specialise within a specific sector, such as European digital law. In addition, positions of responsibility in the various units into which the Commission is divided usually require highly specific knowledge of the relevant subject matter. Moreover, the recruitment requirements for those 50 staff members (who become contract agents of the Union) also call for specialised knowledge and/or knowledge related to digital services, so their profile would not be as political as one might think.

²³This is the case of the aforementioned proceedings brought against Temu (European Commission, 2026a), X (European Commission, 2025a) and AliExpress (European Commission, 2026e)

²⁴Specifically, TikTok withdrew its TikTok Lite Rewards programme for being contrary to the requirements of the DSA (European Commission, 2024c), and AliExpress committed to improving its systems for detecting and removing illegal products (European Commission, 2025b).

²⁵In particular, this study cites as an example the investigation and sanctioning proceedings conducted by the European Commission against X, which, although opened in December 2023, did not conclude until two years later, in December 2025. If one adds to this the view expressed by some experts (see the following footnote), according to which investigations are only opened into the most “flagrant” infringements of the DSA, it seems clear that the two-year time frame is excessive.

²⁶The author of this statement, Daphne Keller—one of the foremost experts on the DSA—states that “It [the EU] went after X for violating much more basic, straightforward provisions of the DSA. Those violations were flagrant enough that it would be weird if the EU hadn’t issued a fine” (2nd paragraph). Along the same lines, other authors have argued that there are obligations, such as those under Arts. 34 and 35, that are not being investigated as thoroughly as they could be. This is the case of Joris van Hoboken, director of the DSA Observatory at the University of Amsterdam, who made these remarks in an interview he gave in December 2025 (Hendrix, 2025).

²⁷E.g., the letter to TikTok sent to its CEO, Shou Zi Chew, on October 12, 2023 (tweeted by Breton on his X profile, available at: https://x.com/ThierryBreton/status/1712472108222329056), the letter to Mark Zuckerberg, founder and CEO of Meta, on October 11, 2023 (again tweeted by Breton: https://x.com/ThierryBreton/status/1712126600873931150), or the letter to YouTube on October 13, 2023 (https://x.com/ThierryBreton/status/1712866215591379259).