The European Union has warned X that its blue checkmark verification system violates rules under the bloc’s Digital Services Act (DSA), finding it to be deceptive for users and against established industry practices. Following its investigation into the platform, the EU also found that X is failing to comply with transparency obligations regarding advertising and providing public data to researchers.

It’s the first time a company has been formally accused of breaching the DSA under the EU’s so-called preliminary findings. X now has the opportunity to defend itself in response.

In its press release, the EU says that changes made to X’s blue check system — which allows any user to pay to be “verified” — prevent users from determining the authenticity of other accounts they interact with. There is also evidence that malicious actors are abusing the system to intentionally deceive users, according to the EU’s findings.

In her statement, EU competition chief Margrethe Vestager said:

If X fails to address the European Commission’s three grievances, the company could face formal action and fines of up to six percent of its global revenue. Since X is a private company — purchased by Elon Musk for $44 billion in October 2022 — it’s unclear how much it potentially stands to lose in financial penalties. X qualifies as a Very Large Online Platform (VLOP) under the DSA since it reaches more than 45 million monthly active users in the EU.

The Commission opened a multifaceted DSA investigation into X on December 18th, 2023. In addition to examining deceptive practices, advertising transparency, and data access for researchers — the subject of today’s findings — the investigation was also exploring the dissemination of illegal content on the platform and its moderation practices in the wake of the Israel-Hamas war. The Commission says that part of the investigation is still ongoing.

The crackdown on X comes as the EU ramps up enforcement of its strict rules for big tech companies. Separate DSA probes have been launched to assess whether Meta has done enough to moderate political, deceptive, or illegal content on Facebook and Instagram or safeguard children who use the platforms.