Newsletter

We know, this newsletter is already long – but for the sake of completeness, we will now give our best to provide you with a short recap of everything we’ve been up to, key developments regarding data access, DSA enforcement more generally, and different risks that were at the center of discussion during the last few months.

September

Everything Data Access

In September, only a month before the delegated act (DA) went into effect, we published a policy paper: In “Data Access for Researchers under the Digital Services Act: From Policy to Practice”, LK Seiling, Clara Iglesias Keller, Jakob Ohme, Ulrike Klinger, and Claes de Vresse outline the different data access options available to researchers and the challenges that keep the DSA’s framework from reaching its potential.

We also were represented at the 2025 CITR Summit in Berlin, where we coordinated with other researchers to bring about the DSA Data Access Task Force (already mentioned above). Shortly afterwards, we hosted the first DSA40 Data Access Days, welcoming around 100 researchers, regulators, and platform representatives. On the first day, we looked back on the experiences with access to public data – and forward to what the access to publicly available data may bring. Day two was reserved for researchers to start preparing data access applications for non-public data with the help of data protection & data engineering experts. If you want to know more, you can find a summary, including recordings of the expert talks on day one, on our website. 

Meanwhile, Meta and the Center for Open Science had quietly updated the information on their Instagram Data Access Pilot for Well-being research, announcing which research projects had passed stage 2 of the registration process. Conditioned on the users’ consent, the selected projects will get access to information about user accounts (like join date and follower counts), content production (like timestamps and content types), consumption behaviour (like session start and end times or content views), content interactions, and the use of safety and control features. Find out more on the project page.

DSA Addendum

September was also the month in which Google, in an act of malicious semi-compliance, erased 7 years of political advertising and messaging on YouTube, Google Search and for display ads in EU member states. The move followed Google’s decision to exit the EU political advertising market entirely ahead of the Transparency and Targeting of Political Advertising (TTPA) regulation. Still, this does not absolve platforms of their DSA obligations, including the duty to mitigate systemic risks to civic discourse. We’ve asked for transparency. We got: nothing.

In other news, the Seventh Chamber of the General Court ruled against Zalando, which had argued that its designation as a VLOP was incorrect and drew into question the European Commission’s methodology for determining recipients of the service. For more legal details and other cases, see the latest issue of Martin’s DSA Newsletter.

Key Harms and Risks

In September the European Commission issued an information request on financial scams to Apple, Booking.com, Google and Microsoft. Little did they know that only two months later, Jeff Horwitz at Reuters would write about internal documents at Meta, which showed that the platform projected that 10% of its 2024 revenue would come from ads for scams and banned goods. While complaints ensued in both the US and the EU, the Commission is yet to initiate proceedings.

October

Everything Data Access

On 29 October 2025, the delegated act (DA) finally went into effect, allowing researchers to submit access applications for non-public data via the DSA data access portal. The expectations were high, considering that CnaM had released the results of a researcher survey to “better understand the needs, challenges and expectations” a month prior. Out of the 116 respondents, 54% (~60) indicated that they planned to submit a data access application within the first 3 months after the delegated act came into force. Such a volume promised that the regulators’ capacities would be fully utilised, if not exceeded. But the flood of applications never materialised. After all, the data was collected before the DA was published or the Data Access Portal was live, which meant that back then researchers had no clear idea of the level of preparation or input required for an application. 

The DA also included another obligation for VLOPSEs to provide easily findable and accessible” data catalogues, describing their “data assets, their data structures and metadata” (Rec. 7 DA). Unfortunately, the initial offerings do not seem to meet these criteria. In fact, it was Alexander Hohlfeld who first tracked down all the catalogues, adding them to his DSA database (also a great resource for risk assessment and audit reports!), before the Commission dedicated a page to them on the data access portal in November. Stay tuned for more news on a more structured analysis coming soon!

But October was not only dedicated to non-public data access. In fact, at the end of the month, the European Commission announced that it had preliminarily found TikTok and Meta in breach of their transparency obligations under the DSA. Among the violations identified by the Commission were “burdensome procedures and tools”, which aligned well with researcher experiences, who had long complained about overly complex forms and limited access available through the platforms’ offerings (esp. regarding TikTok’s Virtual Computation Environment and Meta’s Content Library). LK, the Collaboratory’s coordinator, elaborated on these frustrations in this article for the Science magazine. 

Fittingly, Mozilla also published their report on Fairer Terms for Data Access under Art. 40(12) DSA. If you could never be bothered to actually read the platform’s terms, this report is for you. Written by AWO, it goes through all the platforms’ terms, identifies and groups problematic passages and concludes that platforms are restricting researchers by, among others, imposing overly strict qualification criteria and management obligations, rate/quota limits, publication-related obligations, indemnity and liability clauses, and limiting access methods (incl. scraping). And, to top it off, they also included a model data sharing agreement, which unfortunately has not been adopted yet. Never lose hope, they say.

We also started a little experiment in October that we had been quietly preparing alongside Mozilla and AlgorithmWatch for months: On the birthday of the Digital Services Act, we coordinated a group of over 20 researchers and institutions to send out requests for public data to multiple social media platforms, asking for access to their Top 1000 most viral posts for each day. Platform responses differed but eventually we were rejected by all. So, we returned to our drawing boards, to refine our request. No matter the outcome, if you agree that the most viewed content should be disclosed by platforms, you can sign this petition. Given that YouTube ended its Trending Page, mid 2025, researchers from the University of Illinois, published a dataset documenting the trending videos with for snapshots per day for 2022-2025 – a great basis for analysis while we attempt to make the current trends available to the public again. Also, TikTok added two parameters to their API documentation that should allow researchers to filter the videos returned by the API by view and comment count. Not quite what we asked for but better than nothing – assuming the functionality actually does what it’s supposed to, which it currently doesn’t.

With the DSA’s data access framework slowly taking shape, Columbia World Projects and the Hertie School for Digital Governance released the “Building Capacity for Data Access, Analysis + Accountability” report, distilling a set of convenings of the Columbia-Hertie Working Group. It identifies current gaps in social media data access and lays out where public and private funders can meet these opportunities to support democratic institutions and norms worldwide. Given that the funding landscape of research data access has not significantly improved since, it’s still a highly relevant read.

DSA Addendum

In related news, the Open Terms Archive also started to track the DSA Systemic Risk Assessment Reports after a successful Hackathon at the Conservatoire National des Arts et Métiers in October. This somewhat machine readable dataset can now be used by anyone who wants to start some engineering around or analysis of the reports. We are already excited for the outcome.

November

Everything Data Access

In November, we joined the Mozilla Festival in Barcelona for the latest installment of the community meetup and to support the launch of the Better Access: Data for the Common Good report, which LK co-authored as part of an expert group. The report, which was led and published by Peter Chapman and Leticia Bode at the Knight Georgetown Institute, outlines different information environments, high-influence public platform data within those environments, and three complementary mechanisms that platforms should enable for meaningful data access. If you have not read it yet, we highly recommend you do! The release of the report was also accompanied by a series on Tech Policy Press, for which LK and Mark Scott wondered “How To Stabilize Researcher Data Access?”. LK also showed up in the Tech Policy Press Podcast alongside Peter Chapman and Brandi Guerkink to discuss why independent researchers need better access to platform data.

November also saw the first report on the most prominent and recurrent systemic risks as well as mitigation measures by the European Board for Digital Services, made up of the national DSCs and the Commission. It combines the platforms’ risk assessments inputs by CSOs and academic literature and is a great starting point to get an idea of all the different topics data access-enabled research could contribute to. 

Still, while the report lists a whole set of examples, it’s still far from clear what is (and what isn’t) a systemic risk. The Court of Justice of the European Union provided some clarification in its ruling against Amazon, which was recently analysed on the DSA Observatory’s blog. Amazon had put forth a very narrow idea of systemic risk, limited to the sort of risk posed by highly interconnected financial institutions, and based on this claimed that “marketplaces do not give rise to systemic risks since they are not part of a ‘system’, unlike financial institutions”. The court did not buy this and instead clarified with reference to Rec. 76 that it’s the platforms’ reach (distributing information to a significant share of the EU population) which lies at the heart of their due diligence obligations as it “may cause societal risks, different in scope and impact from those caused by smaller platforms”. What commentators have missed so far is that Amazon also challenged researcher data access: the e-commerce giant, supported by the German registered association for e-commerce and mail order businesses (bevh), had claimed that researcher data access would infringe on the rights to the protection of confidential information and personal data enshrined in Article 7 and 8 of the EU Charter of Fundamental Rights respectively. But the CJEU made clear: Article 40(4) and (12) DSA do “not constitute a disproportionate interference” with these rights.

But November was also the month of the Digital Omnibus Proposal, which suggested substantial revisions to GDPR and AI Act under the banner of “simplification.” The response was mixed to say the least, with critics highlighting the extent to which the proposal represented US big tech lobbying positions. And while its broad implications for research were discussed on Tech Policy, it was Natali Helber at University of Amsterdam, who raised a more specific concern: the proposed amendment to Article 12(5) GDPR would allow controllers to refuse or charge fees for data access requests deemed an “abuse” of data rights — directly threatening individual data access and thus research methods that rely on voluntary data donations. We responded by coordinating an open letter, signed by over 230 researchers from 25 countries and nearly 100 institutions, urging EU policymakers to reject the amendment as contradicting existing EU commitments to evidence-based policymaking and independent research. As it turns out, we are not the only ones: joint opinion by the European Data Protection Board and the European Data Protection Supervisor also mentions “clarifying what qualifies as an abuse of rights is welcome, but it should not be linked to the exercise of the right to access for purposes other than data protection.” In a draft of the first compromise text from February 2026, the Council had stepped back from the most egregious changes suggested by the European Commission (like changing the definition of personal data) but the supposed change to Art. 12(5) remained. While the limitation to only data protection-related purposes was dropped, and suggested a more narrow specification that data controllers could make use of the existing options for refusal or fees “also where an abusive intention on the part of the data subject submitting those requests can be demonstrated by the controller.” Still, with discussions in parliament only starting in May and Ireland taking over the Council’s presidency in July, this discussion is far from over. We’ll keep you in the loop on further developments.

DSA Addendum

Also in November, the European Commission launched its long-anticipated Democracy Shield alongside an EU Strategy for Civil Society, designed to protect EU democratic processes from foreign interference and disinformation. The initiative drew criticism, including from the parliament, for centering coordination and voluntary measures over enforcement — reaffirming the voluntary Code of Conduct on Disinformation as the main forum for developing a DSA incidents and crisis protocol as one of the most actionable planned outcomes.

Key Harms and Risks

After pressure from both France and Germany on the European Commission following the sale of child-like sex dolls and banned weapons on Shein, the Commission sent an information request to Shein, suspecting the platform of the sale of illegal goods in November 2025. Four months later (February 2026) it launched an investigation into the e-commerce platform, alleging that Shein was not only selling illegal products but also were in breach of the DSA in terms of addictive design and lacking transparency of the recommender systems.

December

Everything Data Access

The dominant topic in December was the 120 million € fine the European Commission imposed on Elon Musk’s X for non-compliance with the DSA – the first big DSA enforcement action against a US company. In its communications the European Commission highlighted three points: the deceptive design of X’s ‘blue checkmark’, the lack of transparency regarding X’s ads repository, and X’s obstructive behaviour against researchers requesting access to data. 

The clash between Europe’s “digital rulebook” and US geopolitical and geoeconomic interests was highlighted by the fine’s coincidence with the release of the US National Security Strategy, which pledged to resist European “national and transnational regulations that undermine creativity and industriousness,” criticized “censorship of free speech and the suppression of political opposition”, and encouraged action against “hostile economic practices.” And although, experts quickly pointed out that the fine was “not about speech or ‘censorship’”, it took only two months until the Republican members of the House Judiciary Committee to publish a report claiming exactly that (it marked the second Republican-led attempt to attach the ‘censorship’ label to the DSA – we discussed the first one, published in July 2025, briefly in our last newsletter). While the first report had leaked information about the Commission’s stakeholder workshop, this report published at the end of January leaked a redacted version of the X decision, alongside a whole set of documents and emails, drastically misreading it to fit the ‘censorship’ frame.

But the leaked decision also provided some helpful clarifications about the Commission’s understanding of researcher data access, which Oliver Marsh from AlgorithmWatch and our Collaboratory’s own LK Seiling summarised for Tech Policy Press:

1. Researchers that meet the requirements in Art. 40(8b-e) must be allowed to scrape
2. ‘Systemic risks’ should be interpreted broadly, and can be covered by large array of research fields and methodologies
3. Access to publicly accessible data under Art. 40(12) should be free of charge
4. Platforms should not impose restrictive quotas for access to the requested data
5. Researchers do not need an affiliation to request and receive data
6. Researchers do not need to be located in the EU or affiliated to an EU organisation to receive access

As was to be expected, X, X.AI Holdings, and Musk personally challenged the fine in front of the EU General Court in February. All cases raise objections regarding the procedural fairness underlying the fine – and claim that the Commission “misinterprets and misapplies Article 40(12) DSA” and fails to provide enough evidence that X was and is in infringement of the data access provision. It’s unclear how strong X’s defense is in the non-procedural aspects of the case, given that only one month after opposing the Commission with regard to the design of its service’s interface, X submitted remedies relating to the blue checkmark. In any case, we’ll keep you updated on any further developments! 

Also, on 22 May 2026, 113 days after the initial press release, the European Commission quietly uploaded their version of the fine to their supervision and enforcement overview, which included some passages that X had previously redacted. Most notably the amount of requests X had received by 8 May 2024: 276 out of which it had made a decision for 255 applications, 12 of which (4.7%) were accepted.

Another piece of news that broke on 5 December, the day of the X decision, was that the European Commission accepted TikTok’s commitments on advertising transparency. In the recently published full document, TikTok has, for the next five years, committed to simplifying researcher access (reducing required fields), expanding searchable ad data and targeting information, improving search functionality, and reducing update delays (data should be provided with a maximum delay of one day), with implementation phased over 2–12 months.

As of 8 December 2025, SOMAR, the Social Media Archive at University of Michigan, which used to handle all data access requests to Meta, stopped handling access requests announcing that “all applications for Meta Content Library and API access are now managed via Meta’s own application portal,” the Research Tools Manager. This also resulted in a change of the information researchers needed to provide, finally removing researchers’ birthdates and mobile number from the form. The provided information is now independently reviewed by CASD, a French consortium for secure research data access. If researchers also choose to access the requested data via Meta’s API, they now have the choice between Meta’s own Secure Research Environment and SOMAR’s Virtual Data Enclave, the latter of which charges a $1,000 setup and onboarding fee plus a monthly fee of $371 for each researcher. See the official platform comparison page for a full comparison.

The Collaboratory’s year came to an end with a presentation that LK gave together with David Wegman at DATALAB in Aarhus University on the last day of the 39th Chaos Communication Congress. They spoke about the different ways researchers can access data from platforms and how it can be used to surface new insights, drawing on data collected from 1064 Danes as a case study. 

DSA Addendum

2025 experienced another lowlight on Christmas Eve when the Trump administration imposed visa bans on 5 Europeans associated with the development, enforcement, or use of the DSA:

• Thierry Breton, former European Commissioner for Internal Market
• Anna-Lena von Hodenberg and Josephine Ballon of the German NGO and trusted flagger HateAid
• Imran Ahmed, the British CEO of the US-based Center for Countering Digital Hate
• Clare ​Melford, co-founder of the Global Disinformation Index 

The move followed threats by the U.S. Secretary of State Marco Rubio in May 2025 to ban foreign nationals the US deemed to be censoring Americans. The bans were strongly criticised by European leaders of government as well as the European Parliament. Thus far, the bans have not been reversed. 

January

Everything Data Access

Probably the biggest news item relating directly to data access in January was Whatsapp’s designation as a VLOP, which opened the platform up for researcher data access under the DSA. The Meta Content Library now allows qualified researchers to access updates from the last 30 days in WhatsApp channels that are verified or have a minimum of 100 followers.

DSA Addendum

Also in January, Poland’s President Karol Nawrocki vetoed the DSA’s national implementation bill, echoing American talking points of “administrative censorship,” effectively skirting the Polish parliament. This makes Poland one of six EU member states facing ongoing infringement proceedings by the European Commission for failing to designate and/or fully empower their DSC. Currently the Urząd Komunikacji Elektronicznej, the Polish Office of Electronic Communications, is only temporarily appointed and partially empowered to fulfil the functions of Poland’s DSC following a resolution of the Council of Ministers in May 2025. 

Unrelated to the DSA but still relevant for platform regulation: TikTok’s US operation was restructured into a TikTok USDS Joint Venture LLC, a new legal entity with a majority stake of American investors, many of which have close ties to Trump, in order to comply with an executive order requiring divestiture from Chinese ownership concerns. While the new owners are overseeing data protection, algorithm security, content moderation, and software assurance within the United States, the recommendation algorithm seems to be subject to oversight and assurance mechanisms that may include auditing, licensing, and retraining arrangements.

Key Harms and Risks

While there was some reporting on “sexually suggestive, AI-generated children” on TikTok mid December, the topic became the dominant risk discussed throughout January, as grok was used for the mass generation of non-consensual intimate imagery (discussed in our first newsletter) on Elon Musk’s X platform. In 2025, the platform had already been identified as a key distribution platform for synthetic intimate image abuse and there had already been reports of grok users attempting to generate CSAM. According to its 2024 systemic risk report, X has an incident response protocol for such events, which it previously activated when synthetic intimate images of Taylor Swift were spread on the platform in January 2024. However, this time protocol was not activated. Instead, the platform’s owner further popularised, and later tried to monetise the functionality before seemingly shutting it down after an overwhelming international response, including the European Commission launching a formal investigation into X’s risk assessment and mitigation and French prosecutors raiding the X office in Paris. 

For now, grok seems to have stopped creating synthetic intimate images of women and children. Still, the platform continues to be used as a means of distributing non-consensual intimate imagery. 

February

Everything Data Access

The 17th was the key day for data access in February, for three separate reasons:

First, the Berlin Court of Appeal ruled that the CSO Democracy Reporting International (DRI) is entitled to receive publicly accessible data from X under the DSA. Previously, X had refused their application for data access submitted to monitor the Hungarian elections – and so DRI, supported by Gesellschaft für Freiheitsrechte (GFF), sued them in front of the Berlin Regional Court. Initially, however, the court rejected the lawsuit, declaring that it did not have jurisdiction (contradicting an earlier ruling by a different judge). But DRI and GFF appealed this first-instance decision in front of the Higher Regional Court of Berlin, which overruled the previous decision and thus confirmed “lack of data access as a tort,” meaning that the harm researchers suffer by not being able to access data occurs in the member state and can therefore be litigated there also. This is important because such cases would otherwise have to be litigated in the member state the platform is registered in (Ireland), which is expensive and would greatly increase the burden for researchers to appeal platform decisions. You can find an English translation of all rulings here. One important detail is that the court explicitly ordered X to grant data access without quota restrictions, which is a good sign for researchers currently limited by such quotas.

Second, on the same day, 170 work days after the initial press release, the European Commission quietly released the decision and commitments relating to their investigation of AliExpress’ potential violations of the DSA, including its data access provisions. Apart from information about the monitoring trustee overlooking the platform’s commitments, the decision provides some insights into the behind-the-scenes back and forth between the Commission and AliExpress, as well as some additional details on the specific commitments. These are our top three noteworthy highlights:

1. Scraping is allowed by including an “exception to the restrictions on data access and use in the AliExpress Terms of Use” for researchers that meet the criteria in Art. 40(8b-d) DSA and comply with specific terms for researchers AliExpress may set. The European Commission had pushed for similar exemptions vis-a-vis X.
2. Next to “(near) real time” access to readily-available datasets to qualified researchers (provided through an API for example), AliExpress is also supposed to provide additional customised datasets and other statistical data for the research purposes denied in Art. 40(12) upon researcher request. While the text does not provide examples, this could potentially include aggregated data on the most-viewed products.
3. AliExpress has committed to “gradually expand the available datasets” based on frequent requests by researchers. While it remains to be seen, how this develops in practice, the fact that the scope of the data available through API could grow in the future offers an additional incentive to researchers to ask for data that is public but not yet easily accessible.

Finally, 17 February also marked the second and last day of “The DSA and Platform Regulation Conference”, which featured two sessions on access to platform data. The conference was organised by the DSA Observatory, which is run by the Institute for Information Law (IViR) at the University of Amsterdam. If you have not watched it yet, we’d recommend you take a look at the keynote by Prabhat Agarwal (the Acting Director of DG CONNECT, leading the DSA’s enforcement and strategic development), which not only gave insights in the roadmap for the future of DSA implementation but also addressed the (American) elephant in the room: “Don’t let yourself be scared. We at the Commission stand by the European civil society organizations that have been threatened, and we stand by our teams as well.” From his mouth to the ears of Ursula von der Leyen!

DSA Addendum

February also marked the end of a second year of the DSA being in force. A perfect chance to put the censorship claims from across the Atlantic to the test against the actual data. And as it turns out, the data submitted by platforms to the Statements of Reasons database tells a different story: Since its application, out of the 165 million content moderation decisions appealed by users, roughly 30 % (165 million) have been reversed. And as the conservative German newspaper, WELT, showed 99,8 % of moderation decisions by platforms are voluntary, 0,09 % are based on notices by third parties and notices by all trusted flaggers only informed 560 moderation decisions, which amounts to 0,0008 %.

Key Harms and Risks

In February the discussion around addictive platform design started heating up, as multiple lawsuits alleging addictive design patterns in Meta, YouTube, TikTok, and Snap made their way through the courts, putting the tech industry’s engagement-maximizing practices under renewed legal scrutiny. This allowed for interesting comparisons between what platforms had published in their DSA risk report and the internal documents that emerged as part of US litigation. While Meta and YouTube were found to have harmed young users with addictive design in March (TikTok and Snap had previously settled), the European Commission preliminarily found TikTok’s addictive design – including features like infinite scroll, autoplay, push notifications, and a highly personalised recommender system – in breach of the Digital Services Act. According to its findings, TikTok had neither conducted adequate risk assessments nor put in place adequate risk mitigation measures. Effectively, the Commission seems to require TikTok to change the basic design of its service, which could have wide-reaching consequences for all platforms, if successful. While child protection did not play an explicit role in the Commission’s preliminary findings, the mention of existing parental controls failing and the mention of “effective ‘screen time breaks’, including during the night” already gave a preview of the Commission’s push towards child safety online later in the year (see April).

On another note, if “AI chatbots” are ever designated VLOSEs, we’re already looking forward to  investigations into similar design patterns, which are already actively being documented.

March

Everything Data Access

After a hectic start to the year, March was a fairly quiet time for data access. While there was some commotion around the first negative responses to access applications under Art. 40(4), we only documented two relevant events apart from that:

1. The latest round of reports under the Code of Conduct on Disinformation was published, revealing improved data access to application ratios for the platforms that reported them (YouTube and TikTok). Looking at the overall numbers, it’s somehow not surprising that LinkedIn withdrew from the data access reporting commitments early last year.