Digital Regulation

The Year Europe Started Enforcing: DSA, DMA, and the Price of Platform Power

For years, Europe's digital regulation was dismissed as ambitious legislation without teeth. In 2025, the teeth arrived — and they cost Big Tech billions.

P J Laszkowicz

On December 5, 2025, the European Commission imposed a fine of 120 million euros on X — the platform formerly known as Twitter — for violations of the Digital Services Act.1 The fine addressed three specific failures: X's use of paid blue checkmarks to confer "verified" status without meaningfully verifying the identity of account holders, the inadequacy of its advertising transparency repository, and its refusal to provide researchers with access to platform data as required by law.2 The amount was modest by the standards of European enforcement — roughly one-tenth of a per cent of X's estimated annual revenue. The significance lay not in the sum but in the precedent: this was the first fine ever imposed under the DSA, and it signalled that the enforcement era had begun.

The timing was deliberate. Three months earlier, the Commission had fined Google 2.95 billion euros for abusing its dominant position in advertising technology.3 Six months before that, Apple and Meta had been fined a combined 700 million euros in the first enforcement actions under the Digital Markets Act.4 And four days after the X decision, the Commission opened a formal antitrust investigation into Google's use of web content for AI training — the first time European competition law had been applied to the question of whether scraping the open web to train AI models constitutes an abuse of dominance.5

Taken together, these actions represented the most consequential year of digital enforcement in European history. The total financial penalties exceeded 3.77 billion euros. Structural remedies — divestiture, behavioural changes, market opening — were on the table for the first time. And the regulatory instruments were not legacy antitrust tools repurposed for digital markets but bespoke legislation designed for precisely this purpose. The question was no longer whether Europe would enforce its digital rulebook. It was whether enforcement would change behaviour.

The fines

The chronology of 2025 enforcement tells a story of escalation — in both the amounts imposed and the regulatory instruments used.

The year's largest penalty came in September, when the European Commission fined Google 2.95 billion euros for abusing its dominant position in the online advertising technology market.6 The investigation, which had been underway since 2021, found that Google had systematically favoured its own advertising exchange, AdX, over competitors when processing ad transactions through its publisher ad server and programmatic buying tools — services that together gave Google control over both sides of the market and the exchange in between.7 The fine included a sixty per cent increase for recidivism, reflecting the Commission's view that Google's adtech practices were part of a pattern that included the Google Shopping abuse (fined 2.42 billion euros in 2017) and the Android abuse (fined 4.34 billion euros in 2018).8

The significance of the adtech decision extended beyond the fine itself. The Commission indicated its preliminary position that only a structural remedy — specifically, the divestiture of parts of Google's advertising technology services — would effectively resolve the inherent conflicts of interest.9 Google was given sixty days to submit a compliance plan. If the Commission ultimately requires divestiture, it would be the first time a European competition authority has forced the structural break-up of a technology company's operations.

Six months earlier, in April 2025, the Commission had imposed its first fines under the Digital Markets Act — the legislation designed specifically to regulate large platform companies designated as "gatekeepers." Apple was fined 500 million euros for violating its anti-steering obligations: despite nominally allowing alternative app stores under the DMA, Apple had imposed technical and commercial restrictions that effectively prevented developers from directing users to cheaper purchasing options outside the App Store.10 Meta was fined 200 million euros for offering European users a binary "consent or pay" model for Facebook and Instagram — requiring them either to accept full personal data processing for targeted advertising or to pay up to 12.99 euros per month for an ad-free experience, without providing a third option that used less personal data.11

These were not just the first DMA fines. They were the first test of whether the legislation's penalties — which can reach up to ten per cent of global annual turnover for repeat offences — would be applied with the force the statute contemplated.

The X fine in December completed the enforcement arc. At 120 million euros, it was the smallest of the year's major penalties. The Commission broke it down with unusual specificity: 45 million euros for the deceptive blue checkmark system, 40 million euros for failing to provide researcher data access, and 35 million euros for the inadequacy of the advertising repository.12 X was given sixty working days to address the verification issue and ninety working days to submit action plans for the remaining violations.

The cumulative picture

The combined financial penalties for 2025 — approximately 3.77 billion euros across four major enforcement actions — were historically significant but not record-setting in isolation. Google's 2018 Android fine of 4.34 billion euros remains the single largest European antitrust penalty. What distinguished 2025 was not the size of individual fines but their breadth: four different companies, three different legal instruments (antitrust, DSA, DMA), and enforcement actions that spanned advertising technology, app store practices, data privacy, platform transparency, and AI training. Europe was no longer enforcing a single competition rule against a single company. It was enforcing a regulatory ecosystem.

Beyond the fine: structural remedies

The most consequential aspect of 2025 enforcement was not the financial penalties but the structural and behavioural remedies that accompanied them. Fines, even large ones, risked becoming a cost of doing business for companies with hundreds of billions in annual revenue. Google's combined European antitrust fines exceeded 8 billion euros across three cases, yet its advertising practices remained substantially unchanged. The Commission appeared to have absorbed this lesson.

In the adtech case, the Commission's preliminary indication that only divestiture might resolve Google's conflicts of interest represented a fundamental escalation. The logic was straightforward: when a company simultaneously operates the tools that publishers use to sell advertising space, the tools that advertisers use to buy it, and the exchange that matches buyers and sellers, no behavioural remedy can eliminate the incentive to favour its own services at every stage of the transaction.13 Only separating the conflicted businesses would create the conditions for genuine competition. Whether the Commission would ultimately impose divestiture or accept a lesser remedy from Google remained an open question at year's end, but the willingness to put structural separation on the table was itself a departure.

In the DMA cases, the Commission paired fines with compliance orders. Apple was ordered to remove the technical and commercial restrictions that prevented developers from effectively steering users to external purchasing options.14 Apple responded incrementally: in June 2025, it replaced its Core Technology Fee with a five per cent Core Technology Commission on all digital goods and services transactions, and in subsequent iOS updates it introduced new interfaces for installing alternative app marketplaces and sideloaded applications.15 Whether these changes constituted genuine compliance or creative obstruction remained contested — Open Web Advocacy, a developer advocacy group, argued that Apple's browser engine restrictions continued to limit meaningful competition even after the DMA's requirements took effect.16

Meta's response was more substantive. After the Commission found its "consent or pay" model non-compliant, Meta committed to offering European users a third option: a less personalised advertising experience based on contextual signals rather than comprehensive behavioural tracking, available at no charge.17 The new options were to be presented to EU users beginning in January 2026. The Commission described Meta's revised approach as "a very good step forward," though consumer organisations cautioned that the implementation needed to be free of the dark patterns that had characterised Meta's previous consent interfaces.18

The antitrust investigation no one expected

On December 9, 2025 — four days after the X fine — the European Commission announced a formal antitrust investigation into Google's use of web content for artificial intelligence purposes.19 The investigation examined two distinct practices: whether Google used web publishers' content to generate AI Overviews and AI Mode features on its search results pages without appropriate compensation and without giving publishers the option to refuse without losing access to Google Search; and whether Google used content uploaded to YouTube to train its generative AI models without compensating creators or offering them the ability to opt out.20

The investigation was unprecedented in several respects. It was the first antitrust action by a major competition authority to frame AI training data as a competition issue rather than solely a copyright question. It explicitly linked Google's dominance in search and video hosting to its advantages in AI development, arguing that a company's market power in one domain could be leveraged into dominance in another through the use of proprietary data.21 And it applied existing competition law — Article 102 of the Treaty on the Functioning of the European Union — to AI, without waiting for AI-specific legislation to address the issue.

The implications extended well beyond Google. Every large language model developer operating in Europe relied, to varying degrees, on web content for training data. If the Commission established that using publishers' content for AI training without compensation constituted an abuse of dominance, the precedent would affect the economics of AI development across the industry. The investigation also raised questions about the relationship between competition law and copyright law in the AI context — whether the right framework for addressing AI training data was market power analysis, intellectual property rights, or some combination of the two.

At the announcement, the Commission emphasised that the investigation was at an early stage and that no conclusions had been reached.22 But the signal was unmistakable: European competition enforcement was not confining itself to the digital economy as it existed. It was following the technology into AI.

The UK's parallel track

While the European Commission enforced its continental instruments, the United Kingdom was building its own parallel regime — different in structure but convergent in intent.

On October 22, 2025, the Competition and Markets Authority designated both Apple and Google as having "strategic market status" in their mobile platforms — the first such designations under the Digital Markets, Competition and Consumers Act, which had received Royal Assent in May 2024.23 The designations, which followed nine-month investigations involving evidence from both companies, more than one hundred market participants, and forty-one consultation responses, covered operating systems, app stores, browsers, and browser engines.24 Each designation lasted five years and opened the door to conduct requirements that the CMA could impose without the need for fresh legislation.

The UK regime differed from the DMA in important respects. Where the DMA applied uniform obligations to all designated gatekeepers — interoperability, anti-steering prohibitions, data portability — the UK's DMCCA gave the CMA flexibility to impose tailored conduct requirements on individual companies based on the specific competition concerns identified in each market.25 This company-specific approach allowed for more targeted intervention but required greater institutional capacity and raised questions about consistency and predictability.

The CMA wasted no time. Within months of the designations, it secured commitments from both Apple and Google to improve fairness in app store processes and enhance iOS interoperability.26 Open Web Advocacy published a detailed analysis arguing that the SMS designation created an opportunity to address Apple's restriction of third-party browser engines on iOS — a restriction that the DMA had nominally addressed but that, in practice, Apple had implemented in ways that limited meaningful browser competition in Europe.27

The result was that major technology companies now faced parallel regulatory regimes on both sides of the English Channel. A change made to comply with the DMA might not satisfy the CMA, and vice versa. The cumulative compliance burden was significant, but so was the regulatory pressure: companies could no longer satisfy European requirements with a single set of changes and declare the matter settled.

What enforcement changes

The fundamental question of 2025 enforcement was whether it changed corporate behaviour or merely imposed a tax on it.

The evidence was mixed. On the positive side, several concrete changes were attributable to regulatory pressure. Meta's commitment to offer less personalised advertising in Europe — a departure from its entire business model — would not have occurred absent the DMA enforcement action. Apple's introduction of alternative app marketplaces and sideloading on iOS, however reluctantly implemented, was a direct response to DMA obligations. Google's submission of a compliance plan for its advertising technology operations reflected the credible threat of forced divestiture.28

On the other hand, the pace of compliance was glacial relative to the pace of enforcement. Apple's DMA compliance had been a process of incremental concession, with each iteration generating new complaints from developers about restrictive terms, excessive fees, or technical barriers that undermined the spirit of the legislation while nominally satisfying its letter.29 Google had been the subject of European antitrust enforcement for nearly a decade, with combined fines exceeding eight billion euros, yet its search dominance and advertising market share in Europe had barely shifted. The X fine, at 120 million euros against a company whose owner had publicly expressed contempt for European regulators, seemed unlikely to produce fundamental change absent further escalation.

The structural question was whether fines could ever be sufficient. A company earning hundreds of billions in annual revenue could absorb even multi-billion-euro penalties as an operating cost. The Commission appeared to recognise this — hence the move toward structural remedies in the adtech case and behavioural orders in the DMA cases. But structural remedies took years to implement and were vulnerable to legal challenge at every stage. The gap between the announcement of enforcement and the realisation of competitive change remained measured in years, not months.

The enforcement gap

In November 2025, two weeks before the X fine, the European Commission published its Digital Omnibus proposal — a legislative simplification package that sought to reduce duplication and compliance burden across the EU's digital regulatory framework.30 The Commission projected six billion euros in administrative savings for businesses and public administrations by 2029.31 The proposal would repeal the Platform-to-Business Regulation, consolidate fragmented data reuse rules into the Data Act, and streamline incident reporting obligations across multiple instruments.32

The Commission presented the Omnibus as simplification, not deregulation. But its timing — published during the most active enforcement year in European digital regulation history — sent an ambiguous signal. Industry had argued for years that the cumulative burden of the DSA, DMA, AI Act, Data Act, GDPR, NIS2, DORA, and other instruments created overlapping obligations that were expensive to implement and difficult to interpret. The Omnibus was, in part, a response to that argument. Whether it represented the refinement of a maturing regulatory system or the beginning of a retreat would depend on how the proposal evolved through the European Parliament and Council.

The deeper challenge was institutional capacity. Enforcing the DSA, DMA, and antitrust rules simultaneously across the world's largest technology companies required legal expertise, technical knowledge, and political will sustained over years. The Commission's enforcement directorate was responsible for monitoring compliance by dozens of designated gatekeepers and very large online platforms, while simultaneously conducting antitrust investigations that each consumed years of institutional attention. The X investigation alone had taken more than a year from formal proceedings to decision.33

European enforcement in 2025 demonstrated that the regulatory instruments worked — that the DSA, DMA, and competition rules could be applied to impose meaningful consequences on the world's most powerful technology companies. It demonstrated that structural remedies were on the table. And it demonstrated that enforcement could, under the right conditions, change corporate behaviour, however incrementally. What it did not yet demonstrate was that enforcement at this pace and scale was sustainable — that the political will and institutional capacity existed to maintain the pressure year after year, across administrations and economic cycles, against companies with the resources to contest every decision through every available legal avenue.

The teeth arrived in 2025. Whether they hold is the question for 2026.

Footnotes

  1. European Commission, "Commission Fines X €120 Million under the Digital Services Act," 5 December 2025. ↩

  2. Goodwin Procter LLP, "EC Issues First Non-Compliance Fine under the DSA: X Fined €120 Million for Dark Patterns and Transparency Failures," December 2025. ↩

  3. European Commission, "Commission Fines Google €2.95 Billion over Abusive Practices in Online Advertising Technology," 5 September 2025. ↩

  4. European Commission, "Commission Finds Apple and Meta in Breach of the Digital Markets Act," 23 April 2025. ↩

  5. European Commission, "Commission Opens Investigation into Possible Anticompetitive Conduct by Google in the Use of Online Content for AI Purposes," 9 December 2025. ↩

  6. Loyens & Loeff, "European Commission Fines Google EUR 2.95 Billion over Abusive Practices in Online Advertising Technology," September 2025. ↩

  7. McDermott Will & Emery, "The Saga Continues: European Commission Fines Google €2.95 Billion for Self-Preferencing Conflicts of Interests in the Adtech Market," September 2025. ↩

  8. European Commission, "Antitrust: Commission Fines Google €2.42 Billion for Abusing Dominance as Search Engine," 27 June 2017; European Commission, "Antitrust: Commission Fines Google €4.34 Billion for Illegal Practices regarding Android," 18 July 2018. ↩

  9. Pearl Cohen, "EU Commission Issues Hefty Fine against Google and Threatens Divestment," September 2025. ↩

  10. Hunton Andrews Kurth LLP, "European Commission Fines Apple and Meta for Non-Compliance with the DMA," April 2025. ↩

  11. Noerr LLP, "European Commission Imposes First Fines under the DMA against Apple and Meta," April 2025. ↩

  12. Euronews, "European Commission Hits Elon Musk's Social Network X with €120 Million Fine," 5 December 2025. ↩

  13. Kluwer Competition Law Blog, "Impact of the EC Decision on Google's AdTech — Stakeholder Analysis and Remedies," September 2025. ↩

  14. European Commission, "Commission Finds Apple and Meta in Breach of the Digital Markets Act," 23 April 2025. ↩

  15. MacRumors, "Apple Again Changes EU App Store Rules and Fees to Comply with DMA," 26 June 2025. ↩

  16. Open Web Advocacy, "What Apple's UK Strategic Market Status Designation Means for Browsers and Web Apps," October 2025. ↩

  17. European Commission, Digital Markets Act, "Meta Commits to Give EU Users Choice on Personalised Ads under DMA," 8 December 2025. ↩

  18. BEUC, "Meta Changes to 'Pay-or-Consent' User Flow Must Remove All Dark Patterns and Provide Less Personalised Choice Upfront," December 2025. ↩

  19. European Commission, "Commission Opens Investigation into Possible Anticompetitive Conduct by Google in the Use of Online Content for AI Purposes," 9 December 2025. ↩

  20. CNBC, "Google Hit with EU Antitrust Investigation over Use of Online Content for AI," 9 December 2025. ↩

  21. TechCrunch, "EU Launches Antitrust Probe into Google's AI Search Tools," 9 December 2025. ↩

  22. European Commission, "Commission Opens Investigation into Possible Anticompetitive Conduct by Google in the Use of Online Content for AI Purposes," 9 December 2025. ↩

  23. CMA, "CMA Confirms Apple and Google Have Strategic Market Status in Mobile Platforms," 22 October 2025. ↩

  24. Steptoe LLP, "CMA Completes Its Initial Designations in Mobile Ecosystems and Search," October 2025. ↩

  25. Macfarlanes, "Key Takeaways from the CMA's First Round of SMS Designations," October 2025. ↩

  26. CMA, "CMA Secures Commitments from Apple and Google to Improve Fairness in App Store Processes and Enhance iOS Interoperability," 2025. ↩

  27. Open Web Advocacy, "What Apple's UK Strategic Market Status Designation Means for Browsers and Web Apps," October 2025. ↩

  28. Pearl Cohen, "EU Commission Issues Hefty Fine against Google and Threatens Divestment," September 2025. ↩

  29. Apple, "The Digital Markets Act's Impacts on EU Users," September 2025. ↩

  30. Skadden Arps Slate Meagher & Flom LLP, "Commission Proposes Significant Changes to EU Digital Rules — First Impressions," November 2025. ↩

  31. Kennedys Law, "The 2025 European Commission EU Digital Omnibus Package: A Practical Guide and Explainer," 2026. ↩

  32. CMS, "The EU's Digital Omnibus: Simplification, Consolidation, and a Sharper Edge on Compliance," November 2025. ↩

  33. MediaLaws, "€120 Million Later: The DSA Enters the Enforcement Phase," December 2025. ↩