Why Better Platform Data Won’t Show Regulators What They Need to See
The Digital Services Act gave Europe something genuinely new: a legal right for researchers to access platform data. Article 40 replaced years of precarity — scraping, sock puppets, begging for API keys — with a standardized, legally protected process. The €120 million fine against X in December 2025, which included €40 million for researcher data-access failures, showed the provision has teeth.
But what happens after that fight is won? Even in the best-case scenario, where the platform is cooperating and provides improved APIs with full access for researchers, a critical category of evidence the DSA requires will still be missing. Platform data, however complete, can show what the system did. It cannot tell you what that did to people. Both matter for enforcing Article 34, but only one is currently being made available under the law.
The good news is that the other can be.
Related Knowledge Center: Digital privacy and data security
If you’re online, you’re generating a constant stream of information about yourself — sometimes voluntarily, sometimes unwittingly — that is assembled and used to craft your online experience. And generate wealth for data brokers. Meanwhile, designers and managers of the digital infrastructure on which the world depends are engaged in a never-ending effort to thwart attempts, by both criminal enterprises and state actors, to exploit vulnerabilities in those systems.
Signalgate | State surveillance