The European Commission has fined Elon Musk’s X €120 million (around $140 million) for breaching its transparency rules under the . The European Union’s executive arm that it was investigating the social media company’s blue checkmarking verification system — first introduced when it was still known as Twitter — last year, along with other alleged DSA violations. Today’s concerns the “deceptive design” of the checkmark, as well as “the lack of transparency of [X’s] advertising repository, and the failure to provide access to public data for researchers.”

The Commission’s issue with X’s verification system is that where blue checkmarks were once something that Twitter that Twitter vetted, they can now be bough by anyone. According to the EU, this puts users at risk of scams and impersonation fraud, as they can’t tell if the accounts they’re engaging with are authentic. “While the DSA does not mandate user verification, it clearly prohibits online platforms from falsely claiming that users have been verified, when no such verification took place,” it wrote in a statement.

The EU has also ruled that X’s advertisement repository employs “design features and access barriers” that make it difficult for good faith actors and the general public to determine the source of online ads and spot scams or threat campaigns. It says that X fails to provide information pertaining to both the content of an ad and the entity paying for its placement.

The third alleged infringement concerns the public data that companies are required by the DSA to make available to qualifying researchers. The European Commission claims that X’s practices in this area are unnecessarily prohibitive, therefore “effectively undermining research into several systemic risks in the European Union.”

X has 60 working days to respond to the EU’s non-compliance decision — the first of its nature — on blue checkmarks, and 90 days to submit an “action plan” of how it will address the alleged breaches relating to its advertising repository and access to public data. Failure to comply could result in financial penalties.