It’s shaping up to be a terrible, no good, very bad month for the company formerly known as Twitter. Elon Musk’s X has been hit with its first wave of grievances from the European Union for suspected breaches of the Digital Services Act (DSA) — an online governance and content moderation rulebook with penalties of up to 6% of global annual turnover for confirmed violations.
But that’s not the only high-level decision going against Musk lately. TechCrunch has learned that earlier this month, X was found to have violated several provisions of both the DSA and the General Data Protection Regulation (GDPR), following legal challenges brought by an individual after X shadowbanned his account.
X has long been accused of arbitrary shadowbanning — a particularly egregious charge for a platform that claims to champion free speech.
The Case of Danny Mekić
PhD student Danny Mekić took action after discovering that X had applied visibility restrictions to his account in October last year. The company applied restrictions after he shared a news article about an area of law he was researching, related to the bloc’s proposal to scan citizens’ private messages for child sexual abuse material (CSAM). X did not notify him that it had shadowbanned his account — one of the key issues the litigation focused on.
Mekić only noticed his account had been restricted when third parties informed him they could no longer see his replies or find his account in search suggestions. After his attempts to contact X directly to rectify the issue proved fruitless, Mekić filed a series of legal claims against X in the Netherlands under the EU Small Claims process.
Legal Battles and Victories
Mekić alleged that the company had infringed key elements of the DSA, including failing to provide a point of contact (Article 12) to deal with his complaints and failing to provide a statement of reasons (Article 17) for the restrictions applied to his account. As a premium subscriber to X, he also sued for breach of contract.
Moreover, after realizing he had been shadowbanned, Mekić sought information from X about how it had processed his personal data, relying on the GDPR to make these data access requests. When X failed to provide the requested personal information, Mekić had grounds for a second case: filing claims for breach of the bloc’s data protection rules.
Court Rulings and Implications
In the DSA case, on July 5, the court found X’s Irish subsidiary (still legally called Twitter) in breach of contract and ordered it to pay compensation for the period Mekić was deprived of the service he had paid for (just $1.87 — but the principle is priceless). The court also ordered X to provide Mekić with a point of contact within two weeks or face a fine of €100 per day.
On the DSA Article 17 complaint, the court agreed X should have sent Mekić a statement of reasons when it shadowbanned his account. Instead, he had to take the company to court to learn that an automated system had restricted his account after he shared a news article.
“I’m happy about that,” Mekić told TechCrunch. “There was a huge debate in the courtroom. Twitter said the DSA is not proportional and that shadowbans of complete accounts do not fall under DSA obligations.”
As a further kicker, the court deemed X’s general terms and conditions to be in breach of the EU’s Unfair Terms in Consumer Contracts Directive.
GDPR Wins
In the GDPR case, ruled on July 4, Mekić chalked up another series of wins. This case concerned data access rights and Article 22 (automated decision making) — which states data subjects should not be subject to decisions based solely on automated processing where they have legal or significant effect.
The court agreed that the impact of X’s shadowban on Mekić was significant, affecting his professional visibility and potentially his employment prospects. The court ordered X to provide him with meaningful information about the automated decision-making process within one month, along with the other personal information X had so far withheld, which Mekić had requested under GDPR data access rights.
If X continues to violate these data protection rules, it faces fines of up to €4,000 per day. The court also ordered X to pay Mekić’s costs for both cases.
Wider Implications
While these rulings concern individual complaints, they could have wider implications for the enforcement of the DSA and GDPR against X. The former is just beginning, as X faces preliminary breach findings. Privacy campaigners have long warned that the GDPR is being under-enforced against major platforms. The strategic role of core data protections in driving platform accountability remains far weaker than it could and should be.
“Bringing the claims was a final attempt to clarify my unjustified shadowban and get it removed,” Mekić told TechCrunch. “And, of course, I hope Twitter’s compliance with legal transparency obligations and low-threshold contact will improve to make it even better.”
A Call for Regulatory Action
“The European Commission seems to be very busy with investigations under the DSA. So far, regarding Twitter, the Commission seems to focus mainly on stricter content moderation. My appeal to the Commission is also to be mindful of the flip side: platforms should not overreach in their non-transparent content moderation practices,” Mekić added.
“If you ask me, there is a simpler solution: curb algorithms on social media designed to maximize engagement and revenue and bring back the chronological timelines of the heyday of Twitter and other social media platforms as standard.”
Enforcement and Oversight
While the EU itself has a key role in enforcing the DSA’s rules on X, its compliance with the wider general rules falls to a European member state-level oversight body: Ireland’s media regulator, Coimisiún na Meán.
Enforcement of the EU’s flagship data protection regime on Twitter/X typically falls to another Irish body, the Data Protection Commission (DPC), which is often accused of dragging its feet on investigating complaints about Big Tech.
Asked for information about its enforcement of various long-standing GDPR complaints against X, a spokesperson for the DPC said it could not provide a response by the time of publication.
The Battle Continues
Individuals bringing small claims against major platforms to try to get them to abide by pan-EU law is clearly suboptimal; there’s supposed to be a whole system of regulatory supervision to ensure compliance.
“On a side note, I did experience how much time and effort it takes to litigate in court,” said Mekić. “Despite the fact that in principle it can be done without a lawyer. Even so, you spend almost a year on it while the other party can outsource it to a battery of lawyers with near-infinite budgets and just ignore it in the meantime: indeed, I have never had direct contact with anyone from Twitter; they only communicate with me through lawyers.”
Asked whether he’s hopeful the outcome of his two cases will bring an end to X’s arbitrary shadowbanning for all EU users, Mekić said he doesn’t think his success will be enough — regulatory enforcement is going to be needed for that.
“I hope so, but I’m afraid not,” he said. “There is little focus on the commercial motives behind shadowbans. If a user breaks a rule, you could temporarily block their account. That is transparent. But that also removes that user’s ad revenue for the platform. Shadowbans are a solution for that: the user is unaware of anything and continues to engage with and generate advertising revenue for the platform.”
“It would be a brave decision by social media platforms to stop applying shadowbans and only impose transparent, contestable restrictions on users. But that will presumably lead to a loss of revenue. I hope Twitter will set other platforms a good example and inform users transparently about account restrictions, as required by the DSA. To do so, platforms need to put their commercial intentions second,” said Mekić.
“It does surprise me that the Commission has not identified anything about the large-scale shadowbanning practices that users do not receive notifications about,” he added. “It happens daily on a large scale and is easier to prove than what they are focusing on now.”
X has been contacted for a response to the rulings.
