Digital Regulation

The year Europe started enforcing its digital rulebook

For years Europe's digital regulation was dismissed as ambitious legislation nobody would enforce. In 2025 the Commission issued 3.77 billion euros of penalties across four companies and three separate legal instruments.

P J Laszkowicz

On 5 December 2025, the European Commission fined X, the platform formerly known as Twitter, 120 million euros for breaching the Digital Services Act, the law governing how large platforms moderate content and account for what they publish. The decision named three failures: X sold blue checkmarks that conferred "verified" status without verifying anybody's identity, its advertising transparency repository was inadequate, and it refused researchers the access to platform data the law requires. This was the first fine ever imposed under the Act—and against X's own finances it was not a token. The company's 2025 revenue is estimated at around $2.9 billion, which puts the fine close to the statutory ceiling of 6 per cent of global annual turnover that the Act allows.

The timing was deliberate. Three months earlier the Commission had fined Google 2.95 billion euros for abusing its dominant position in advertising technology. Five months before that, Apple and Meta had been fined a combined 700 million euros in the first enforcement actions under the Digital Markets Act, the law that imposes standing obligations on the largest platforms rather than punishing abuses after the fact. Four days after the X decision, the Commission opened a formal antitrust investigation into Google's use of web content for AI training, the first time European competition law had been applied to the question of whether scraping the open web to train models constitutes an abuse of dominance.1

Taken together, these actions represent the most consequential year of digital enforcement in European history. The financial penalties exceed 3.77 billion euros. Structural remedies, meaning divestiture, forced behavioural change, and market opening, were available for the first time. The instruments used were not legacy antitrust tools repurposed for digital markets but bespoke legislation designed for precisely this purpose. The question is no longer whether Europe will enforce its digital rulebook. It is whether enforcement changes behaviour.

The fines

The chronology of 2025 tells a story of escalation, in both the amounts imposed and the instruments used.

The year's largest penalty came in September, when the Commission fined Google 2.95 billion euros for abusing its dominant position in online advertising technology. The investigation, underway since 2021, found that Google had systematically favoured its own advertising exchange, AdX, over competitors when processing transactions through its publisher ad server and its programmatic buying tools. Those services together gave Google control over both sides of the market and the exchange in between.2 The Commission treated the conduct as part of a pattern rather than an isolated abuse, following the Google Shopping case, fined 2.42 billion euros in 2017, and the Android case, fined 4.34 billion euros in 2018.3

The significance of the advertising decision extends beyond the fine. The Commission has indicated its preliminary view that "only the divestment by Google of part of its services" can resolve the conflicts of interest at issue. Google was given sixty days to submit a compliance plan. Should the Commission ultimately require divestiture, it would be the first time a European competition authority has forced the structural break-up of a technology company's operations.

Five months earlier, in April 2025, the Commission imposed its first fines under the Digital Markets Act against companies it designates as "gatekeepers". Apple was fined 500 million euros for breaching its anti-steering obligation: while nominally permitting alternative app stores, it had imposed technical and commercial restrictions that stopped developers directing customers to cheaper options outside the App Store. Meta was fined 200 million euros for offering European users a binary "consent or pay" model on Facebook and Instagram between March and November 2024, requiring them either to accept full data processing for targeted advertising or to pay up to 12.99 euros per month for an advertisement-free experience, with no third option using less personal data.

These were not merely the first fines under the Act. They were the first test of whether penalties that can reach 10 per cent of global annual turnover for repeat breaches would be applied with the force the statute contemplates.

The X fine in December completed the arc. At 120 million euros it was the smallest of the year's major penalties, and the Commission published no breakdown across the three breaches, saying only that it weighed "the nature of these infringements, their gravity in terms of affected EU users, and their duration". X was given sixty working days to address the verification problem and ninety working days to submit action plans for the rest.

The cumulative picture

The combined penalties for 2025, approximately 3.77 billion euros across four major actions, are historically significant without being record-setting in isolation. Google's 2018 Android fine of 4.34 billion euros remains the single largest European antitrust penalty. What distinguishes 2025 is breadth rather than size: four companies, three legal instruments, and actions spanning advertising technology, app store practices, data privacy, platform transparency, and AI training. Europe is no longer enforcing one competition rule against one company. It is enforcing a regulatory system.

Beyond the fine: structural remedies

The most consequential aspect of 2025 was not the money but the structural and behavioural remedies attached to it. Fines, even large ones, risk becoming an operating expense for companies with hundreds of billions in annual revenue. Google's combined European antitrust fines exceed nine billion euros across three cases, yet its advertising practices remain substantially unchanged. The Commission appears to have absorbed that lesson.

In the advertising case, the preliminary indication that only divestiture might resolve Google's conflicts of interest is a fundamental escalation. The logic is straightforward. When one company operates the tools publishers use to sell advertising space, the tools advertisers use to buy it, and the exchange matching the two, no behavioural remedy can remove the incentive to favour its own services at every stage.4 Only separating the conflicted businesses creates the conditions for competition. Whether the Commission will ultimately impose divestiture or accept something lesser remained open at year's end, but its willingness to raise structural separation is itself a departure.

In the Digital Markets Act cases, the Commission paired fines with compliance orders. Apple was ordered to remove the restrictions preventing developers from steering customers to external purchasing options.5 It responded incrementally, replacing its Core Technology Fee in June 2025 with a 5 per cent Core Technology Commission on digital goods and services transactions, and introducing new interfaces in subsequent iOS releases for installing alternative app marketplaces and sideloaded applications.6 Whether this constitutes genuine compliance or creative obstruction remains contested. Open Web Advocacy, a developer group, argues that Apple's browser engine restrictions continue to limit meaningful competition even after the Act's requirements took effect.

Meta's response was more substantive. After the Commission found its "consent or pay" model non-compliant, Meta committed to a third option: less personalised advertising drawn from contextual signals rather than comprehensive behavioural tracking, at no charge.7 The new options were to reach EU users from January 2026. The Commission called the revised approach "a very good step forward", though consumer organisations cautioned that the implementation had to be free of the dark patterns that characterised Meta's earlier consent interfaces.

Competition law reaches AI training data

On 9 December 2025, four days after the X fine, the Commission announced a formal antitrust investigation into Google's use of web content for artificial intelligence.8 It examines two practices: whether Google used publishers' content to generate the AI Overviews and AI Mode features on its search results pages without appropriate compensation, and without letting publishers refuse while remaining in Google Search; and whether it used material uploaded to YouTube to train generative models without compensating creators or offering them a way to opt out.9

The investigation is unprecedented in several respects. It is the first antitrust action by a major competition authority to treat AI training data as a competition question rather than solely a copyright one. It explicitly links Google's dominance in search and video hosting to its advantages in AI development, arguing that market power in one domain can be carried into another through proprietary data.10 And it applies existing competition law, specifically Article 102 of the Treaty on the Functioning of the European Union, without waiting for AI-specific legislation.

The implications extend well beyond Google. Every large language model developer operating in Europe relies to some degree on web content for training data. If the Commission establishes that using publishers' content without compensation constitutes an abuse of dominance, the precedent affects the economics of AI development across the industry. The case also raises the question of which body of law properly governs training data: market power analysis, intellectual property, or some combination.

At the announcement the Commission emphasised that the investigation was at an early stage and that no conclusions had been reached.11 The direction of travel is nonetheless clear. European competition enforcement is not confining itself to the digital economy as it currently exists.

The United Kingdom's parallel regime

While the Commission enforced its continental instruments, the United Kingdom built its own regime, different in structure and convergent in intent.

On 22 October 2025 the Competition and Markets Authority designated Apple and Google as holding "strategic market status" in their mobile platforms, covering operating systems, app stores, browsers, and browser engines.12 These were the first designations covering mobile platforms under the Digital Markets, Competition and Consumers Act, which received Royal Assent in May 2024, and they followed the designation of Google in search and search advertising twelve days earlier. The mobile designations came after nine-month investigations drawing on evidence from both companies, more than one hundred market participants, and forty-one consultation responses.13 Each lasts five years and makes conduct requirements available to the Authority without fresh legislation.

The UK regime differs from the European one in an important respect. Where the Digital Markets Act applies uniform obligations to every designated gatekeeper, covering interoperability, anti-steering, and data portability, the UK statute lets the Authority impose tailored conduct requirements on individual companies according to the concerns identified in each market.14 That allows more targeted intervention, but it demands greater institutional capacity and raises questions about consistency and predictability.

The Authority moved quickly. Within months of the designations it secured commitments from both companies to improve fairness in app store processes and to enhance interoperability on iOS.15 Open Web Advocacy argued that the designation created an opportunity to address Apple's restriction of third-party browser engines, a restriction the European legislation had nominally addressed but which Apple had implemented in ways that limited meaningful browser competition.

The result is that major technology companies now face parallel regimes on both sides of the English Channel. A change made to satisfy Brussels may not satisfy London, and the reverse. The compliance burden is significant, and so is the regulatory pressure: no company can now satisfy European requirements with a single set of changes and treat the matter as settled.

What enforcement changes

The fundamental question of 2025 is whether enforcement changed corporate behaviour or merely taxed it.

The evidence is mixed. Several concrete changes are attributable to regulatory pressure. Meta's commitment to offer less personalised advertising in Europe, a departure from its entire business model, would not have happened without the enforcement action. Apple's introduction of alternative app marketplaces and sideloading, however reluctantly implemented, responded directly to its obligations. Google's submission of a compliance plan for its advertising operations reflects a credible threat of forced divestiture.16

Against that, compliance moved far more slowly than enforcement. Apple's has been a process of incremental concession, each iteration generating fresh complaints from developers about restrictive terms, excessive fees, or technical barriers that satisfy the letter of the legislation while undermining its purpose.17 Google has faced European antitrust enforcement for nearly a decade, with combined fines exceeding nine billion euros, yet its search dominance and advertising market share in Europe have barely shifted. The X fine, imposed on a company whose owner has publicly expressed contempt for European regulators, seems unlikely to produce fundamental change without further escalation.

The structural question is whether fines can ever be sufficient. A company earning hundreds of billions annually can absorb even multi-billion-euro penalties as a cost of operating. The Commission appears to recognise this, which is why structural remedies appear in the advertising case and behavioural orders in the others. But structural remedies take years to implement and are open to legal challenge at every stage. The gap between announcing enforcement and realising competitive change is still measured in years.

The enforcement gap

In November 2025, two weeks before the X fine, the Commission published its Digital Omnibus proposal, a simplification package intended to reduce duplication and compliance burden across the EU's digital framework.18 The Commission projects six billion euros in administrative savings for businesses and public administrations by 2029. The proposal would repeal the Platform-to-Business Regulation, consolidate fragmented data reuse rules into the Data Act, and streamline incident reporting across several instruments.19

The Commission presents the Omnibus as simplification rather than deregulation. Its timing, arriving during the most active enforcement year in the history of European digital regulation, sends an ambiguous signal. Industry has argued for years that the cumulative weight of the Digital Services Act, the Digital Markets Act, the AI Act, the Data Act, the General Data Protection Regulation, the network and information security directive known as NIS2, the financial sector's operational resilience regulation, and other instruments creates overlapping obligations that are expensive to implement and hard to interpret. The Omnibus is partly a response to that argument. Whether it represents the refinement of a maturing system or the beginning of a retreat depends on how it evolves through the European Parliament and the Council.

The deeper challenge is institutional capacity. Enforcing three regimes simultaneously against the world's largest technology companies requires legal expertise, technical knowledge, and political will sustained across years. The Commission's enforcement directorate monitors compliance by dozens of designated gatekeepers and very large online platforms while conducting antitrust investigations that each consume years of institutional attention. The X investigation alone took more than a year from formal proceedings to decision.20

European enforcement in 2025 demonstrated that the instruments work, that the Digital Services Act, the Digital Markets Act, and competition rules can impose meaningful consequences on the most powerful technology companies in the world. It demonstrated that structural remedies are genuinely available. And it demonstrated that enforcement can, under the right conditions, change corporate behaviour—however incrementally. What it did not demonstrate is that enforcement at this pace is sustainable, that the political will and institutional capacity exist to maintain the pressure year after year, across administrations and economic cycles, against companies with the resources to contest every decision through every available avenue.

Europe enforced in 2025. Whether it keeps enforcing is the question for 2026.

Footnotes

  1. European Commission, "Commission Opens Investigation into Possible Anticompetitive Conduct by Google in the Use of Online Content for AI Purposes," 9 December 2025. The Commission's own announcement could not be retrieved directly for this piece; the description here follows contemporaneous reporting. ↩

  2. Loyens & Loeff, "European Commission Fines Google EUR 2.95 Billion over Abusive Practices in Online Advertising Technology," September 2025. ↩

  3. European Commission, "Antitrust: Commission Fines Google €2.42 Billion for Abusing Dominance as Search Engine," 27 June 2017; European Commission, "Antitrust: Commission Fines Google €4.34 Billion for Illegal Practices regarding Android," 18 July 2018. ↩

  4. Kluwer Competition Law Blog, "Impact of the EC Decision on Google's AdTech—Stakeholder Analysis and Remedies," September 2025. ↩

  5. European Commission, "Commission Finds Apple and Meta in Breach of the Digital Markets Act," 23 April 2025. ↩

  6. MacRumors, "Apple Again Changes EU App Store Rules and Fees to Comply with DMA," 26 June 2025. The fee change is well documented; the characterisation of the subsequent interface changes is not independently verified here. ↩

  7. European Commission, Digital Markets Act, "Meta Commits to Give EU Users Choice on Personalised Ads under DMA," 8 December 2025. ↩

  8. European Commission, "Commission Opens Investigation into Possible Anticompetitive Conduct by Google in the Use of Online Content for AI Purposes," 9 December 2025. ↩

  9. CNBC, "Google Hit with EU Antitrust Investigation over Use of Online Content for AI," 9 December 2025. ↩

  10. TechCrunch, "EU Launches Antitrust Probe into Google's AI Search Tools," 9 December 2025. ↩

  11. European Commission, "Commission Opens Investigation into Possible Anticompetitive Conduct by Google in the Use of Online Content for AI Purposes," 9 December 2025. ↩

  12. CMA, "CMA Confirms Apple and Google Have Strategic Market Status in Mobile Platforms," 22 October 2025. ↩

  13. Steptoe LLP, "CMA Completes Its Initial Designations in Mobile Ecosystems and Search," October 2025. The procedural figures given here follow that summary and are not confirmed against the Authority's own decision documents. ↩

  14. Macfarlanes, "Key Takeaways from the CMA's First Round of SMS Designations," October 2025. ↩

  15. CMA, "CMA Secures Commitments from Apple and Google to Improve Fairness in App Store Processes and Enhance iOS Interoperability," 2025. ↩

  16. Pearl Cohen, "EU Commission Issues Hefty Fine against Google and Threatens Divestment," September 2025. ↩

  17. Apple, "The Digital Markets Act's Impacts on EU Users," September 2025. ↩

  18. Skadden Arps Slate Meagher & Flom LLP, "Commission Proposes Significant Changes to EU Digital Rules—First Impressions," November 2025. ↩

  19. CMS, "The EU's Digital Omnibus: Simplification, Consolidation, and a Sharper Edge on Compliance," November 2025. ↩

  20. MediaLaws, "€120 Million Later: The DSA Enters the Enforcement Phase," December 2025. ↩