The blue check stopped meaning verified. The EU fined the design.

On 5 December 2025, the European Commission fined X €120 million in the first non-compliance decision under the Digital Services Act. The first breach was the blue checkmark: the Commission found that anyone can pay for “verified” status without X meaningfully verifying who is behind the account, which deceives users and exposes them to impersonation, fraud and manipulation.

The Commission also found X’s advertising repository fell short. It lacked key information such as ad content and who paid, and used design features and access barriers, including long processing delays, that stop researchers detecting scams and coordinated campaigns. Third, X barred researchers from independently accessing public data and put unnecessary barriers in the way of research into risks in the EU.

When a subscription borrows a trust signal

The checkmark once told readers an account belonged to who it claimed. Turning it into a paid subscription perk kept the familiar badge while removing what it promised, which is exactly why the Commission treated it as deceptive design rather than a pricing decision. The ad and research findings matter for the same reason: transparency tools that are too slow or incomplete to use are transparency in name only.

What to do

Treat a blue check on X as a sign of a subscription, not of identity. Before trusting an account that claims to be a company, public body or public figure, find it from the organisation’s own website, and be most wary of accounts offering refunds, support or investments. Report impersonation through the platform and, in the EU, to your national Digital Services Coordinator.