EU Researchers Say Big Tech Is Running Out the Clock on Platform Transparency
In the weeks before Romania's November 2024 presidential vote, something odd happened on TikTok. Accounts that had spent years posting nail tutorials and outfit hauls abruptly pivoted to championing Calin Georgescu, a fringe politician whose views on immigration and Jewish people were, to put it charitably, alarming. Those posts racked up 120 million views. Georgescu, previously polling in single digits, walked away from the first round with 23% of the vote.
Adriana Iamnitchi, who chairs computational social sciences at Maastricht University, wanted to know how it happened. Specifically, she suspected hidden influencer marketing and monetised political livestreams were driving the surge. So her team did the sensible thing: they applied for access to TikTok's API under the EU's Digital Services Act.
TikTok said no.
The rejection cited failure to prove researcher credentials, unexplained commercial interests, and unmet security requirements. This was October 2024. Two months later, TikTok itself quietly flagged 116,000 potentially compromised accounts and removed over 27,000 fakes linked to a coordinated network run by what the company called a "fake engagement vendor" promoting Georgescu. TikTok claimed not to know who ran it or where it came from.
The first round result was annulled. A May 2025 runoff saw independent candidate Nicusor Dan beat George Simion, who had taken over Georgescu's party after Georgescu was barred from standing again. Declassified Romanian intelligence concluded Georgescu had received preferential algorithmic treatment on TikTok and alleged Russian coordination behind the campaign.
Iamnitchi thinks her team could have traced who created and profited from that content, if they had the data. They didn't get it.
Hers is not an isolated case. Multiple researchers working on disinformation have told WIRED they face systematic obstruction when trying to access platform data they are legally entitled to under EU law. The DSA was supposed to fix this, giving vetted academics at credible institutions a clear path to API access for research into systemic risks. Two years on, the reality is messier.
Platforms have quietly raised the bar on what "vetted" means in practice. Security requirements are steep: most applications demand data be stored on infrastructure physically disconnected from the internet. Most universities simply don't have that. Meta killed CrowdTangle and replaced it with tools researchers describe as more restrictive. X paywalled its API, pushing academics to pay hundreds of dollars a month for access that previously cost nothing. TikTok, while nominally more generous, caps daily API pulls in ways that make large-scale research impractical.
The DSA40 Collaboratory, a German initiative that tracks DSA access applications, found that of 46 monitored cases, 20 were approved and 14 rejected. But those numbers likely flatter the platforms since the tracker depends on voluntary self-reporting. The true rejection rate is probably worse. X rejected 11 of 23 tracked applications. TikTok approved 11 of 13.
For researchers who do get approved, the problems don't stop there. API data is often difficult to reproduce independently, which makes peer review essentially impossible. That's not a minor inconvenience; reproducibility is a foundational requirement of scientific research.
Democracy Reporting International has been battling X in court since early 2025 after the platform rejected their application to study political discourse ahead of Germany's federal election. The initial ruling went in DRI's favour, potentially setting a useful precedent. Then X refused access for research ahead of Hungary's election and the whole process started again. At one point a Berlin court ruled DRI had sued in the wrong country and should have gone to Ireland, where X is incorporated. DRI won on appeal, but the experience illustrates how expensive and draining this route is.
"There's an ongoing calculation of whether it's worth having these lawsuits every single time we apply," said Duncan Allen, a research officer at DRI.
In December 2025, the European Commission issued its first DSA financial penalty, fining X 120 million euros partly for erecting barriers to researcher access. X appealed in February 2026, describing the investigation as "incomplete and superficial." Last week the commission accepted an X action plan promising faster processing, free data access, and fewer scraping restrictions. X has six months to make good on it. Allen called it a step forward while remaining sceptical about follow-through.
The commission has also opened talks with platforms about standardising the researcher vetting process, and late last year it expanded researcher access to non-public platform data covering illegal content, financial scams, and recommendation algorithms. These new provisions are untested but have generated cautious optimism. One potentially significant change: platforms could be forced to provide full follower lists, giving disinformation researchers a proper tool to map how coordinated networks actually spread content rather than guessing at the edges of data they've scraped together themselves.
For now, scraping remains the main workaround, a slow and incomplete process that cannot capture full follower graphs and makes coordinated inauthentic behaviour much harder to identify. It is not a substitute for proper API access, and everyone involved knows it.
The DSA's ambitions were reasonable. The implementation has been, to put it diplomatically, a work in progress. Until researchers can reliably get the data they need, the gaps in public understanding of how these platforms actually operate will keep widening.