ChatGPT Under the EU Digital Services Act: Where Do Other Investigations Stand?

ChatGPT, a “very large online search engine”?

The European Commission has just given it this label under the Digital Services Act (DSA). It is thus subject to specific rules. OpenAI has four months – until January 2027 – to bring itself into compliance.

To designate the major online platforms, Brussels relies in particular on a quantitative threshold set at 45 million monthly active users in the EU. ChatGPT far exceeds it (159.1 million on average, according to OpenAI). Reddit (57.2 million) and Roblox (46.6 million) also meet it. They thus join the list of services subject to the DSA. There are now 28 in total.

Three “DSA fines” imposed so far

For now, the European Commission has fined AliExpress, Temu and X.

€550 million for AliExpress, largely for illegal products…

Opened officially in March 2024, the AliExpress inquiry covered a broad spectrum. Brussels was particularly concerned about the inefficacy of measures against illicit content, the deliberate manipulation using “hidden links,” and the risks linked to promoting hazardous products by affiliates in its program. Concerns also touched on mechanisms for reporting illicit content, the advertising transparency and recommendation systems, and access to public data for researchers.

In June 2025, the European Commission accepted a set of commitments on detecting and reporting illicit products, processing complaints, advertising transparency and researchers’ access to public data. At the same time, it issued preliminary conclusions on the risk assessment/mitigation related to dissemination of illicit products. Its assessment: beyond systemic moderation failures and limited resources devoted to proactive content moderation, AliExpress did not enforce its sanctions policy adequately against merchants.

In July 2026, the sanction was issued: €550 million in fines. Many of the deficiencies identified a year earlier persisted. AliExpress had, among other things, not adequately evaluated how its recommendation and advertising systems amplified the dissemination of illegal products. Moreover, compliance checks proved easy to bypass, with products misclassified into the wrong category.

AliExpress has until October 20, 2026 to present an action plan to the European Commission.

… and €200 million for Temu on the same grounds

Opened in October 2024, the Temu inquiry covered actions against the sale of non-compliant products, the addictive design of the service (including loyalty programs resembling games), the transparency of recommendation systems and researchers’ access to public data.

Brussels published its preliminary findings in July 2025. The broad verdict: inadequate risk assessment of the diffusion of illicit products – notably, baby toys and small electronic devices.

This inadequate assessment persisted and culminated in a €200 million fine for Temu. It was found to have based its conclusions on broad, sector-wide information rather than specific evidence. In parallel, it did not properly assess how the service’s design could amplify the risks of illegal product dissemination.

Temu has until August 28 to present an action plan.

From the “blue check” to ad transparency, €120 million for X… which proposed corrective measures

Opened in December 2023, the inquiry into X spanned broad grounds. The European Commission focused on the detection and reporting of illicit content, information manipulation, and related policies aimed at mitigating risks to civic discourse and electoral processes. It also examined advertising transparency, researchers’ access to public data and the design of the user interface. On the latter, the “blue check” was singled out as potentially misleading regarding the authenticity of accounts that bore it.

The preliminary conclusions of July 2024 confirmed that the blue check misled users. Brussels also found that the advertising registry was “not accessible or reliable.” Another reproach: the prohibition on independent access by researchers to its public data, paired with a prohibitive API access (unreasonably high fees).

In December 2025, X was fined €120 million for these grounds. On advertising transparency, the sanction covered both excessive delays in processing and the lack of essential information (content and theme of ads, paying legal entity for dissemination).

X presented an action plan that the European Commission accepted in mid-July. Since then, it has six months to implement the proposed measures, which will then be evaluated by an independent external audit. On one side, measures intended to facilitate researchers’ access to public data (expedited review of requests, free access for eligible researchers, no contractual ban on data harvesting). On the other, measures addressing advertising transparency:

• Additional search filters based on ad content and targeting criteria
• Providing search results directly on the public registry interface rather than in Excel files
• Shortening response times to the technically feasible minimum (200 seconds)
• Publishing additional information (full ad content + redirect URL)

Ongoing investigations

Meta flagged for child protection, addictive design and illicit-content reporting

The European Commission is also examining Meta’s case in parallel. The first inquiry opened in April 2024. Topics: misleading advertising and disinformation, visibility of political content, reporting of illicit content and real-time monitoring of civic discourse and elections (Meta was then in the process of winding down its CrowdTangle tool).

A few weeks later, a second inquiry was opened. It would focus on child protection (age-verification tools, default privacy settings, potentially addictive design).

Brussels issued its initial preliminary conclusions in October 2025. Meta was called out for the absence of a readily accessible mechanism to report illicit content. It was also criticized for failing to provide researchers with adequate access to public data. Additionally, there were concerns about its content-moderation appeal processes (users could not explain their disagreement in detail).

The preliminary conclusions related to the second inquiry came in April 2026. They were not favorable to Meta, accusing the company of not preventing younger users from accessing Facebook and Instagram. Self-declaration for birth dates is not an effective check, the Commission explained. And the age-verification tool was “difficult to use” and “ineffective.” Meta’s risk assessment was incomplete and arbitrary, seemingly ignoring easily available scientific evidence concerning young users’ vulnerabilities.

Since then, Brussels issued a third wave of preliminary findings (July 2026). According to it, Meta did not properly assess the risks posed by addictive design. It failed to consider features such as infinite scrolling, autoplay and highly personalized recommendations. Moreover, attenuation measures proved ineffective. It is easy to circumvent time-management tools, and parental controls are only effective if parents have sufficient technical know-how.

TikTok has made commitments twice, but remains in the crosshairs

The first DSA investigation against TikTok (February 2024) concerned child protection (age verification, mitigation of behavioral dependencies, default privacy settings), ad transparency, researchers’ access to public data and risk management for harmful content.

A second inquiry was opened in April 2024. It targeted the TikTok Lite Rewards program, newly launched in France and Spain… without a risk assessment beforehand and without effective mitigation measures.
A few months later (August 2024), the European Commission ended this procedure, TikTok having agreed to permanently withdraw the program in the EU.

In December 2025, Brussels had accepted TikTok’s commitments on ad transparency. Among them:

• Provide the full content as it appears in users’ feeds
• Make the information available within a maximum of 24 hours
• Disclose the targeting criteria chosen by advertisers
• Integrate additional search options and filters

In February 2026, the preliminary conclusions on addictive design were issued. They highlighted inadequate risk assessment, neglecting key drivers of compulsive use such as how often users open the app and how much time young people spend on it at night. They also noted ineffective mitigation measures (time-management tools that are easy to bypass, parental controls requiring technical proficiency).

The preliminary conclusions on child protection were released in July 2026. Brussels overall found that minors are overly exposed to risky interactions. Among other issues, accounts could be configured to be public, and it was easy to locate private accounts using others’ “following” and “followers” lists.

Snapchat, deemed non-compliant on child protection

No preliminary findings yet on Snapchat. An inquiry has been ongoing since March 2026. Topic: child protection. The Commission doubts that self-declaration of age is, as with Facebook and Instagram, a sufficient method to verify age. It also questions the default settings, particularly given that minors’ accounts are recommended to other users via the Find Friends mechanism. Other concerns: ineffective moderation of illicit product sales and difficulties in accessing mechanisms to report illicit content.

Shein scrutinized on three major axes

An investigation against Shein has been open since February 2026. Main axes:

• Addictive design
• Lack of transparency in recommendation systems
• Sale of illegal products, including materials depicting child sexual abuse

Three X sites under the lens

PornHub, XNXX and XVideos have been under investigation since May 2025.
In March 2026, the European Commission issued preliminary findings that were not favorable to these sites. None had implemented effective measures to prevent minors from accessing their services (merely declaring that users were over 18). The same went for mitigation measures such as page obfuscation, content warnings and “adult-only” labels: they failed to stop minors from accessing harmful content.

PornHub, XNXX and XVideos did not otherwise conduct a proper risk assessment, lacking objective and rigorous methods. They focused too much on commercial considerations rather than societal risks. XNXX and XVideos additionally presented information inaccurately or ignored contributions obtained from civil society organizations specializing in children’s rights.

* The DMA (Digital Markets Act) can also apply to search engines. ChatGPT is not automatically bound by it, given a quantitative threshold: at least 10,000 business users in the EU.