Europe Flexes Its Regulatory Muscle: Meta and TikTok Face Historic DSA Enforcement Action

Compliance Hub

28 Oct 2025 — 12 min read

Executive Summary: In a landmark enforcement move on October 24, 2025, the European Commission issued preliminary findings that Meta (Facebook and Instagram) and TikTok have breached core transparency and user protection obligations under the Digital Services Act. This represents one of the first major salvos of DSA enforcement against Very Large Online Platforms, with potential fines reaching up to 6% of global annual revenue—approximately $9.87 billion for Meta and $1.38 billion for TikTok. This enforcement action follows earlier indications that Brussels was preparing charges against Meta for content moderation failures.

The Big Picture: From Legislation to Enforcement

The story of 2025's EU regulatory landscape isn't about new laws being passed—it's about the enforcement of recently enacted ones. The Digital Services Act, which came into full force for Very Large Online Platforms (VLOPs) in August 2023, is now showing its teeth. After years of debate about whether the EU could effectively regulate Big Tech, we're seeing concrete action with substantial financial consequences on the table.

Breaking Down the October 24 Findings

What the Commission Found

The European Commission's preliminary findings, announced by Executive Vice-President Henna Virkkunen, identified multiple serious breaches across both platforms:

Shared Violation: Researcher Data Access Failures

Both Meta and TikTok were found in breach of their obligation to grant researchers adequate access to public data under Article 40 of the DSA. According to the Commission's investigation, the platforms have implemented burdensome procedures and tools that often leave researchers with partial or unreliable data. This directly impacts researchers' ability to study critical issues, such as whether users—including minors—are exposed to illegal or harmful content.

The Commission's findings suggest that both companies created unnecessarily complex application processes, with TikTok and Meta's platforms (Facebook and Instagram) imposing multiple procedural hurdles before researchers could access even public data. This effectively undermines the DSA's transparency requirements designed to enable independent scrutiny of platform operations.

Meta-Specific Violations: Dark Patterns and Ineffective Systems

Meta faces additional accusations beyond the data access issues, specifically related to its content moderation infrastructure on both Facebook and Instagram:

Dark Patterns in Content Reporting: The Commission found that Meta's "Notice and Action" mechanisms—designed to allow users to flag illegal content like child sexual abuse material or terrorist content—use deceptive interface designs. These dark patterns impose unnecessary steps and create confusion that dissuades users from completing their reports. Such practices may render Meta's mechanisms to flag and remove illegal content ineffective, the Commission stated.
Inadequate Appeals Process: Meta's system for appealing content moderation decisions was found to be deficient. Users cannot fully explain their position or provide supporting evidence when challenging Meta's decisions about removed content or suspended accounts. This limitation makes it difficult for EU users to exercise their rights to challenge platform decisions, effectively neutering the appeals mechanism.

The Companies Push Back

Both Meta and TikTok have vigorously disputed the preliminary findings:

Meta's Response: Spokesperson Ben Walters stated, "We disagree with any suggestion that we have breached the DSA, and we continue to negotiate with the European Commission on these matters. In the European Union, we have introduced changes to our content reporting options, appeals process, and data access tools since the DSA came into force and are confident that these solutions match what is required under the law in the EU."

TikTok's Response: TikTok emphasized that it has provided data access to nearly 1,000 research teams through its research tools. However, the company also highlighted a critical tension in EU regulation: "Requirements to ease data safeguards place the DSA and GDPR in direct tension. If it is not possible to fully comply with both, we urge regulators to provide clarity on how these obligations should be reconciled."

This GDPR-DSA tension represents a legitimate regulatory challenge. The DSA demands transparency through researcher access to data, while GDPR requires strict protection of personal data. Platforms must navigate these sometimes-conflicting requirements, though regulators argue that properly anonymized and aggregated data can satisfy both frameworks. For users concerned about their data on TikTok, our comprehensive TikTok privacy configuration guide provides detailed strategies for protecting personal information.

Understanding the Stakes: What 6% Really Means

The potential fines are staggering in absolute terms, even if they're calculated as percentages:

Meta: With 2024 global annual revenue of $164.5 billion, a 6% fine would amount to approximately $9.87 billion
TikTok: With estimated 2024 global revenue of $23 billion, a 6% fine could reach approximately $1.38 billion

To put Meta's potential fine in perspective, it exceeds the GDP of several small nations and represents more than Meta's entire Reality Labs division revenue. For TikTok, the potential penalty represents roughly 6% of its total annual revenue—a significant hit that could impact its valuation and growth trajectory.

These aren't abstract numbers. The DSA's penalty structure is designed to make non-compliance economically irrational for even the largest tech companies. The message is clear: the cost of ignoring transparency obligations far exceeds the cost of compliance. Meta has faced significant privacy fines before, including a €405 million penalty for Instagram's handling of children's data, demonstrating that regulatory penalties are becoming a recurring cost of doing business for platforms that fail to prioritize compliance.

What Happens Next: The Enforcement Timeline

The October 24 announcement represents preliminary findings, not final determinations. Here's what comes next:

1. Right to Defense (Current Phase)

Both Meta and TikTok now have the opportunity to:

Examine all documents in the Commission's investigation file
Submit written responses challenging the findings
Propose commitments to address the Commission's concerns

2. European Board Consultation

The European Board for Digital Services will be consulted on the preliminary findings, ensuring coordination among national Digital Services Coordinators across the EU.

3. Final Decision

If the Commission's views are ultimately confirmed after reviewing the companies' responses, it will adopt a non-compliance decision. This can include:

Fines of up to 6% of total worldwide annual turnover
Mandatory corrective measures
Enhanced supervision periods to ensure compliance
Periodic penalty payments to compel ongoing compliance

4. Continuing Investigation

Importantly, these preliminary findings address only specific breaches. The Commission stated it "continues its investigation into other potential breaches that are part of these ongoing proceedings."

The Timing Isn't Coincidental: New Data Access Rules Take Effect

On October 29, 2025—just five days after the preliminary findings—a crucial piece of the DSA puzzle comes into force: the delegated act on researcher data access.

This delegated act, adopted by the Commission in July 2025 after extensive public consultation, creates a comprehensive framework for researchers to access non-public data from VLOPs and VLOSEs. Key elements include:

DSA Data Access Portal: A centralized platform where vetted researchers can submit data access requests
Vetting Process: Digital Services Coordinators will vet researchers to ensure they meet eligibility criteria
Data Catalogues: Platforms must provide detailed catalogues of available datasets, including structure and metadata
Mediation Mechanisms: Procedures for resolving disputes between researchers and platforms

The timing of the enforcement action immediately before these new rules take effect sends a clear signal: the Commission is establishing baseline compliance expectations before the regime becomes even more demanding. Platforms that haven't provided adequate access to public data will face even higher scrutiny when researchers begin requesting access to non-public data.

Context: Part of a Broader Enforcement Pattern

The Meta and TikTok findings aren't isolated incidents. They're part of an emerging pattern of aggressive DSA enforcement against major platforms:

X (Formerly Twitter) - July 2024

The Commission issued preliminary findings that X breached the DSA in three key areas:

Dark Patterns: The blue checkmark verification system was found to deceive users about account authenticity
Advertising Transparency: X's ad repository was deemed inadequate and difficult to access
Researcher Data Access: X prohibited independent data access and imposed prohibitively high API fees

X's case was notable as the first preliminary findings under the DSA. The enforcement action occurred against the backdrop of contentious exchanges between the Commission and X owner Elon Musk, who claimed the EU had offered a "secret deal" to avoid fines in exchange for quiet censorship—allegations the Commission firmly denied.

Other Ongoing Proceedings

Formal proceedings have been opened against:

AliExpress (March 2024): Investigating compliance with risk management, content moderation, and transparency requirements
LinkedIn (Following requests for information): Issues related to targeted advertising based on sensitive data

The Commission's Escalating Approach

With Henna Virkkunen now serving as Executive Vice-President for Tech Sovereignty, Security and Democracy, the Commission has signaled its commitment to vigorous enforcement. Virkkunen stated: "Our democracies depend on trust. That means platforms must empower users, respect their rights, and open their systems to scrutiny. The DSA makes this a duty, not a choice."

This represents a philosophical shift in EU tech regulation. Rather than relying on self-regulation or voluntary commitments, the DSA framework treats transparency and accountability as legal obligations with concrete enforcement mechanisms.

Why Researcher Access Matters: Beyond Academic Interest

The emphasis on researcher data access isn't merely about academic freedom—it's central to the DSA's entire regulatory architecture. Here's why:

1. Identifying Systemic Risks

The DSA requires VLOPs to identify and mitigate "systemic risks" including:

Dissemination of illegal content (hate speech, CSAM, terrorist content)
Threats to fundamental rights (freedom of expression, privacy, child protection)
Adverse effects on democratic discourse and electoral processes
Harms to public health and safety (addictive design, manipulation)

Without independent research access, we must rely on platform self-reporting about these risks—a clear conflict of interest.

2. Evaluating Mitigation Measures

Platforms regularly claim they're taking action to address harmful content. Researcher access allows independent verification of whether these measures actually work, at what scale, and with what side effects.

3. Detecting Emerging Threats

Academic researchers often identify new patterns of manipulation, coordination, or harm before platforms acknowledge them. Access to data enables early warning systems for democratic institutions.

4. Informing Policy

Evidence-based policymaking requires actual evidence. Researcher access creates the empirical foundation for future regulatory refinements.

While these enforcement actions focus on platform obligations, individual users also bear responsibility for protecting their privacy. Our complete guide to social media privacy protection offers comprehensive strategies for securing your digital life across Meta, TikTok, and other major platforms.

The Dark Patterns Problem: Interface Design as Compliance Issue

Meta's alleged use of dark patterns in content reporting represents a fascinating intersection of user experience design and regulatory compliance.

What Are Dark Patterns?

Dark patterns are user interface designs that manipulate users into taking actions they might not otherwise take, or make it difficult to do what they want to do. In the context of content reporting, examples might include:

Obstruction: Placing reporting options in hard-to-find locations
Misdirection: Using confusing language that makes users uncertain about what they're reporting
Friction: Requiring multiple clicks, form fields, or navigation steps to complete a report
Ambiguous Options: Offering reporting categories that don't clearly match the illegal content being reported

Why It Matters

When platforms make it difficult to report illegal content, they're not just creating poor user experience—they're undermining legal obligations. The DSA requires platforms to act "expeditiously" upon notification of illegal content. If users are dissuaded from notifying platforms through dark patterns, platforms may avoid their obligation to remove content they would otherwise be liable for.

Moreover, dark patterns in reporting systems disproportionately impact vulnerable users and trusted flaggers (NGOs and government entities that report illegal content at scale). If expert organizations find reporting systems too burdensome, illegal content remains online longer. These concerns align with broader privacy controversies surrounding Meta's AI integration across its platforms, where user control and transparency have been questioned.

Compliance Implications: What This Means for Your Organization

For Very Large Online Platforms

If your platform qualifies as a VLOP (45+ million monthly EU users), the message is clear:

Audit Your Researcher Access Systems: Are you truly providing adequate access to public data? Can you document that requests are processed fairly and without unnecessary barriers?
Review Interface Designs: Conduct dark pattern audits of reporting and appeals mechanisms. Can users easily find and complete these processes? Are there unnecessary friction points?
Document Everything: The Commission will request internal documents, policies, and metrics. Ensure you can demonstrate good-faith compliance efforts.
Prepare for Enhanced Scrutiny: Even if you're not currently under investigation, the Commission is establishing precedents that will apply to all VLOPs.

For Smaller Platforms

While these enforcement actions target VLOPs, the DSA applies to platforms of all sizes with scaled obligations:

Study VLOP Cases: The compliance expectations being established for large platforms will eventually become baseline expectations for the entire industry.
Build Compliance into Design: It's far easier to design transparent, user-friendly systems from the beginning than to retrofit them under regulatory pressure.
Monitor Your Growth: If you're approaching VLOP thresholds, start preparing for enhanced obligations well in advance.

For Businesses Using These Platforms

The enforcement actions have ripple effects:

Advertising Transparency: Expect changes to how platforms report advertising data and metrics as they adapt to transparency requirements.
Content Moderation: Changes to reporting and appeals systems may affect how quickly content issues are resolved.
Data Access: Enhanced researcher access may lead to more public scrutiny of platform practices, potentially affecting brand safety considerations.
User Security: As platforms adjust their systems to comply with DSA requirements, businesses should review their own social media security practices. Our Facebook security essentials guide provides comprehensive strategies for protecting business accounts across Meta's platforms.

The Geopolitical Dimension: Tech Regulation and Trade Tensions

These enforcement actions don't occur in a vacuum. They're happening against a backdrop of transatlantic tension over tech regulation.

The Trump administration has criticized the DSA and other EU digital regulations as discriminatory against American companies. With both Meta and TikTok under scrutiny—alongside X's ongoing case—U.S. technology companies bear the brunt of initial DSA enforcement.

However, the Commission has consistently maintained that the DSA is content-neutral and applies equally to all platforms operating in the EU, regardless of ownership. The fact that AliExpress (Chinese-owned) is also under investigation supports this claim.

The fundamental tension remains: the EU views platform regulation as essential to protecting fundamental rights and democratic institutions, while critics argue these regulations could become protectionist measures or tools for censorship.

Looking Ahead: What to Watch

Short Term (Next 3-6 Months)

Meta and TikTok Responses: How will the companies address the preliminary findings? Will they offer commitments, or contest the findings entirely?
Delegated Act Implementation: As researcher data access begins under the new framework, will we see increased transparency or new conflicts?
X Final Decision: The Commission may issue a final non-compliance decision on X's case, setting the first precedent for DSA fines.

Medium Term (6-18 Months)

First DSA Fines: If preliminary findings are confirmed, we'll see the first major financial penalties levied under the DSA.
Platform Adaptations: Expect significant changes to content reporting systems, researcher access portals, and transparency reporting.
Additional Enforcement Actions: The Commission has indicated that investigations into Meta and TikTok extend beyond the issues in these preliminary findings.

Long Term (18+ Months)

Legal Challenges: Major fines will likely be appealed to EU courts, testing the DSA's legal foundations.
Regulatory Evolution: Expect delegated acts, guidelines, and interpretive decisions that clarify DSA obligations.
Global Influence: Other jurisdictions are watching EU enforcement closely. The DSA may become a template for platform regulation worldwide, similar to GDPR's influence on privacy law.

Key Takeaways for Compliance Professionals

The DSA Has Teeth: Preliminary findings against major platforms demonstrate that the Commission is willing to pursue enforcement aggressively, not just threaten it.
Transparency Is Non-Negotiable: Both Meta and TikTok's primary violation involves transparency—specifically, providing researchers with data access. This isn't a peripheral issue; it's central to the DSA's regulatory model.
Interface Design Is Compliance: Dark patterns in reporting mechanisms show that user experience design decisions have regulatory implications. Compliance extends to how systems are designed, not just whether they technically exist.
Procedural Rights Matter: The appeals process violations demonstrate EU focus on ensuring users can meaningfully exercise their rights, not just that platforms offer nominal compliance mechanisms.
Cross-Regulation Complexity: TikTok's point about DSA-GDPR tension is legitimate. Navigating multiple EU regulations requires sophisticated compliance strategies that address potential conflicts.
Financial Consequences Are Real: With potential fines reaching nearly $10 billion for Meta, the DSA's penalty structure makes non-compliance economically untenable for even the largest platforms.
Ongoing Process: These preliminary findings are part of broader investigations. Companies should expect continued scrutiny, information requests, and potential additional findings.

Conclusion: A New Era of Platform Accountability

The October 24, 2025 preliminary findings against Meta and TikTok mark a watershed moment in digital regulation. After years of debate about whether democratic governments could effectively regulate powerful technology platforms, we're seeing enforcement with real teeth.

The message from Brussels is clear: platform power comes with platform responsibility. Transparency isn't optional. User rights aren't negotiable. And non-compliance carries consequences that even the largest companies must take seriously.

For compliance professionals, the path forward requires understanding that the DSA represents more than a regulatory checkbox. It's a comprehensive framework that touches interface design, data governance, content moderation, transparency reporting, and more. Organizations that treat it as a mere legal obligation rather than a fundamental shift in platform operations do so at their peril.

The question is no longer whether the EU will enforce the DSA—it's how broadly and how aggressively. Based on these preliminary findings, the answer appears to be: very broadly, and very aggressively indeed.

Editor's Note: This article discusses preliminary findings that have not been finalized. The companies mentioned have the right to respond and contest these findings before any final determination or penalties are imposed.

Related Resources: