Until late 2025, the Digital Services Act had not produced a single fine. In December 2025, the European Commission fined X 120 million euros, the first fine under the law. Since then it has fined Temu 200 million euros and AliExpress 550 million euros, and opened or advanced cases against Meta, TikTok, and others.
For organizations that get attacked online, this is good news. It is also easy to misread.
What enforcement looks like in practice
Take the X case. The Commission's preliminary findings came in July 2024. The fine came in December 2025, for three breaches: blue check marks that mislead users, a weak advertising repository, and poor data access for researchers. In July 2026 the Commission accepted X's fixes for the advertising and data-access issues. According to EU law professor Steve Peers, those fixes do not address the blue check marks. X has also taken the decision to the EU General Court, where the case is pending.
That is about two years from first findings to partial fixes, on a case about transparency, not about any single post.
The Commission's investigation into Meta that covers deceptive advertising, political data, and misinformation is still open.
The rules that exist don't always hold
Meta stopped selling political ads in the EU in October 2025, when new political advertising rules came into force. A study by the Romanian groups BROD and Funky Citizens looked at 568 paid ads from 26 Facebook pages in 2025 and 2026. It found that 437 had political content. Only 21 were labeled as political. Meta removed or blocked 90.
Rules move the baseline. They don't stop the next post.
What this means for your team
- Report, and then keep going. Use the official reporting routes, and keep a record of what you report and when. That record feeds the systemic cases regulators build. It won't take the post down this afternoon.
- Don't wait for a platform to fix your evening. When a false claim about your organization starts to travel, the response window is the first hour or two. No regulator works on that clock.
- Your reach is your members now. With paid political ads gone in the EU, the people who already trust you are the main way your message travels. A nurse, a teacher, or a local volunteer posting in their own words is more convincing than any official account.
- Don't fight with mass reporting. Asking supporters to flood a platform with reports looks like the coordinated behavior the rules are meant to catch, and it hands your opponents a story.
Where Ostracon fits
Ostracon is built for the part regulators can't do: the next hour. It helps a coordinator decide whether to answer at all, and if the answer is yes, sends a clear, time-boxed mission to supporters who chose to receive them. Every mission stays in a permanent archive, so your organization can show exactly what it asked people to do. Ostracon will not run mass-reporting missions.
Sources
- Digital Services Act: summary and links, Steve Peers, EU Law Analysis, last updated October 2026
- 120 million euros later: the DSA enters the enforcement phase, MediaLaws, December 23, 2025
- Brazil, Serbia, Israel: election-related disinformation, EDMO weekly pulse, October 30, 2026 (BROD and Funky Citizens study)