X cuts European Commission ad account after DSA fine — what’s next?

In a dramatic escalation following a roughly $140 million fine under the EU’s Digital Services Act, X has disabled the European Commission’s advertising account after accusing the Commission of exploiting a flaw in X’s Ad Composer to artificially boost reach. X says the exploit has been patched and revoked the Commission’s ability to buy and track ads on the platform.

The European Commission, which levied the fine as part of enforcement under the DSA, must still submit specific remedial measures and an action plan. X’s product lead alleged the Commission “logged into [their] dormant ad account to take advantage of an exploit” and posted a link that mimicked a video to inflate engagement.

Timeline and key actions

• Regulatory action: The EU issued a DSA fine and required X to take corrective measures.
• Platform response: X says the Commission used an exploit in Ad Composer; the bug was patched and the EC’s ad privileges were suspended.
• Next steps: The Commission must submit an action plan addressing the regulator’s concerns; negotiations and disclosures are ongoing.

Why this matters

The incident raises novel questions about how platforms, regulators and public institutions interact. It also spotlights the complex balance between enforcement (penalizing platforms for DSA breaches) and platform governance (how a private company responds when a regulator appears to misuse features).

Points of contention

• Exploit vs. legitimate use: X framed the Commission’s action as abuse of a platform bug; the Commission asserts its enforcement role and the right to publicize regulatory actions.
• Transparency and accountability: Suspending a regulator’s ad account is an unprecedented move that could prompt scrutiny of platform moderation policies and the DSA enforcement process.
• Political optics: The exchange — including an expletive reaction by X’s owner — highlights how tensions between tech platforms and regulators can quickly become public and political.

What to watch next

• Details of the exploit, any official confirmations, and whether the suspension is temporary or permanent.
• How the European Commission responds, including whether it will pursue remedies, public statements, or legal action.
• Broader DSA enforcement implications and whether regulators will alter how they publicize enforcement actions on private platforms.

For more on the Digital Services Act and EU enforcement, see the EU’s overview: Digital Services Act package.

Discussion: Was X justified in suspending the European Commission’s ad privileges after alleging misuse of an ad‑composer bug — or does this set a worrying precedent when platforms police regulators? What rules should govern how public institutions use private platforms?