The court ruled X should have granted access, in what DRI believed could become a precedent-setting case. But months later the organization was back in court after X denied access for research ahead of Hungary’s election. That case nearly collapsed when a Berlin court ruled the researchers should have sued in Ireland, where X is based. DRI won on appeal.

“EU law is still not uniformly applied,” he said, reflecting on the Hungarian case. “It’s cost us a lot of time and energy, and there is an ongoing calculus of whether or not it’s worth having these lawsuits every time we apply for data access.”

In December 2025, the European Commission imposed its first DSA penalty, fining X €120 million ($137 million) partly for creating “unnecessary barriers” to researcher access that “effectively undermin[e] research into several risks in the European Union.”

On February 20, 2026, X appealed, calling the investigation “incomplete and superficial” and accusing the EU of “systemic breaches of rights of defence and basic due process requirements.”

Last week, the commission accepted X’s action plan to fix the researcher screening process, provide data free of charge, cut processing times, and lift restrictions on data scraping. X has six months to put these changes in place.

Allen called the plan “a step in the right direction” but remains skeptical about how it will be implemented. He wants X to be more specific about how it will improve the vetting process used to determine whether researchers qualify for API access under the DSA.

The EU, having said in another DSA investigation that Meta and TikTok “may have put in place burdensome procedures and tools for researchers to request access to public data,” leaving them with partial or unreliable data, started meeting with platforms in May to work on a new standard for vetting researchers.

Late last year, the commission also expanded researchers’ access to nonpublic platform data to study risks including illegal content, financial scams, and recommender systems. Researchers say the new provisions have yet to be tested, but they are cautiously optimistic.

The new regulations on nonpublic data could force X to release an account’s full follower list. This gives disinformation researchers a much clearer view of how coordinated attacks spread online, because they can use this data to map out which accounts interact or follow one another and how they amplify content, Allen says.

This story originally appeared on wired.com.