What X's Corrected Action Under the DSA Fixes on Data Access, and What's Left Open

In mid-July, the European Commission accepted X's corrective action plan to terminate its breaches of the Digital Services Act (DSA), including the failures on researcher data access under Article 40(12) that accounted for €40 million of the €120 million fine issued in December 2025.

In an earlier analysis for Tech Policy Press, Oliver Marsh and LK Seiling unpacked what the December fine decision revealed about the Commission's interpretation of Article 40. That decision identified four failures: an overly restrictive interpretation of researcher eligibility, deficient application review processes, limited quotas and access duration, and contractual prohibitions on independent data collection.

X's accepted commitments respond almost point by point: X will revise its screening process so that eligible researchers are not excluded in error, provide access free of charge, ensure timely access "including to the appropriate volumes of data" with significantly reduced application processing times, and update its terms to state explicitly that eligible researchers are not contractually prohibited from scraping publicly available data. X has six months to implement the plan, will be subject to an external independent audit, and remains under enhanced supervision.

Notably, the European Board for Digital Services considered X's action plan "overall inadequate to address the infringement," and the Commission accepted it only after clarifying key implementation requirements.

The measures however address only half the problem: Researchers may now get through the door, but what they can find once inside is a different question. Our recent audit of the two most mature Article 40(12) implementations, Meta's Content Library and TikTok's Research API, suggests this is the question that will decide whether X's compliance is meaningful.

Access granted does not paint the full picture

Our recent research comparing platform APIs with the information actually shown to users suggests that gaining access is only half the challenge. Using controlled sockpuppet accounts during the 2024 US presidential and 2025 German federal elections, we reconstructed the complete public information environment (PIE)— which we define as every post and every piece of metadata delivered to a user's device on Instagram's Explore and TikTok's For You feeds — and then queried the Meta Content Library and the TikTok Research API for exactly that content.

Compared to what users see and can retrieve on Instagram and TikTok, we show that platforms' Research APIs apply access restriction mechanisms that function as overlapping filters on the granularity and quality of the data researchers can access. We call these mechanisms (1) scope narrowing, (2) metadata stripping, and (3) operational restrictions.

Scope narrowing determines which posts can be retrieved through the API at all. Follower thresholds encode platforms' definition of which accounts are "big enough" for their content to count as publicly accessible. On Instagram, that alone excluded 49.35% of the posts users actually saw during the elections. Because the APIs ingest content with default delays of up to four days, ephemeral formats like Stories and live streams, which disappear after 24 hours, are never made available to researchers at all. Further, within weeks, between 17.7 and 23.3% of TikTok posts became inaccessible, often because of terms of service violations. This rate roughly doubled for political content. Some of these posts had however reached millions of views before disappearing and researchers cannot retrieve them anymore; this is problematic because these are precisely the posts needed to study the systemic risks the DSA targets, from the dissemination of illegal content (Article 34(1)(a)) to negative effects on civic discourse and electoral processes (Article 34(1)(c)).

Metadata stripping determines what researchers can access about the posts that remain. TikTok's Research API exposes 32 of the 186 parameters the Web client transmits (~83% loss); for a single Instagram post, the platform sends 236 parameters in the browser but only 100 are available through the API. The stripped fields are largely the platforms' own governance signals stemming from their design and architecture: moderation labels, downranking and sharing-friction flags as also AI-labels.

Operational restrictions determine how much of the remaining data is practically retrievable: at 1,000 queries per rolling week, retrieving the comments of a handful of viral posts would be enough to exhaust Meta's entire weekly quota.

Because each mechanism filters a different slice of the PIE, their effects compound. What survives is a dataset characterized by survivorship bias: content that was removed, downranked, or short-lived, precisely what is important to systemic risk research, is least likely to be in it. And because the governance signals are stripped out, researchers are left mainly with data about how platforms are used, not about how they function and are designed. This is the same recurring narrative found in platforms' own systemic risk reports, which locate risk in user behavior far more readily than in platform design. None of this concerns application procedures: a platform could approve every eligible researcher, charge nothing, and respond within days — and still deliver exactly such a dataset.

The X commitments

X's commitments constrain none of these mechanisms. The phrase "appropriate volumes of data" is the only language hinting toward quantity, and it remains undefined. Appropriate relative to what? The full public information environment users see, or whatever subset X unilaterally classifies as such? The DSA does not define what counts as "publicly accessible data," and so far, platforms have used that discretion liberally: Meta alone changed its definition of what counts as publicly available three times since the launch of their Research API. There is no reason to expect X's implementation to be free of equivalent filters unless the Commission's supervision explicitly reaches them.

The scraping commitment is the exception, and it matters more than it may appear. This, however, must be read carefully: X commits only to stating in its terms that eligible researchers are not contractually prohibited from scraping publicly available data. That is not an affirmative right: it means scraping will no longer be contractually forbidden, but neither will it be contractually permitted. What this is worth in practice will depend on whether X refrains from technical countermeasures against vetted researchers' collection efforts.

Independent collection is the only way researchers can construct a ground truth against which to verify what official channels omit. Our audit was only possible because we scraped the PIE baseline ourselves via sockpuppets. Recent work demonstrates that such advanced methods of scraping can be conducted on publicly accessible data alone, so that the method can operate within Article 40(12)'s scope as well as GDPR safeguards, while directly serving its systemic risk objectives.

The questions left open

Beyond implementation, the acceptance of the commitments leaves harder questions unresolved. First, "publicly accessible" still lacks a definition — and, as legal scholars like Daphne Keller have argued, it must be defined broadly and safeguarded against platforms shrinking it unilaterally, whether through technical barriers like login walls or through their own classification choices. Our findings show what is at stake in that definition: everything we measured was public in the ordinary sense — users saw it, and their devices received it, as they scrolled — yet up to half of it never reached researchers. If the content a platform itself pushes into millions of feeds does not count as "publicly accessible," the term has lost its meaning.

The privacy objection platforms raise against a broad definition of “publicly accessible” is, on closer inspection, part of the same definitional question. X's confidentiality arguments collapse on the facts because it sold equivalent access commercially: data offered to anyone paying $5,000 per month for the Pro API tier cannot plausibly be too sensitive for vetted researchers. And the pattern generalizes: an entire commercial monitoring market sells corporations the very social media data researchers are denied. What remains are narrower sub-questions:what safeguards apply when anonymization or pseudonymization would make the research impossible, and what protective measures should govern residual confidentiality concerns under Article 40(12)? These deserve answers, but they are questions about how to grant access safely, not about whether the data is public.

Our findings therefore support a broad definition: the full user PIE, which includes any content actively recommended by the platform to users, together with the complete metadata transmitted to their devices. Further, privacy tensions should be managed through access safeguards rather than through exclusion from scope.

Second, what will the audit measure? X has committed to an independent audit of its implementation. If the auditor merely verifies that procedures exist — an application portal, a fee waiver, a revised contract — the audit risks becoming procedurally satisfied but substantively hollow. We see this currently with the DSA's external systemic risk audits, where auditors have largely confined themselves to procedural checks (and where X, after receiving the first cycle's only critical audit report, simply switched to a different auditor). If, instead, the audit benchmarks what the API delivers against what users actually see, it becomes a genuine test of completeness. Our methodology shows this comparison is feasible.

Looking forward

The corrective measures dismantle the barriers at the door, and that is a win for the research community. But Article 40(12) also exists to produce evidence for scrutinizing systemic risks beyond formalizing access.

Whether X's implementation serves that purpose depends on the restriction mechanisms it employs behind the door — in scope, in metadata, in operations. Six months from now, that should be the standard against which compliance is established.