Working Paper
Section 5 - Measuring the Platforms: Meta, X and YouTube · Section 6 - What the Test Cases Show About Audit Architectures
Section 4 set out the structural case for why DSA-mandated audit alone cannot be trusted as a self-sufficient accountability mechanism. Section 5 tests that case against evidence. The Harm Index, twelve indicators across three sub-indices (Purpose, Petition, Peer), applies in full to three VLOPs: Facebook (Meta), X and YouTube, chosen for contrast.
X’s auditor relationship changed entirely between cycles. As noted in Section 4, X was one of only two services to change auditor between cycles (Albert, 2025). X replaced FTI Consulting with BDO LLP, a member of the European Contact Group, whose guidance on not concluding under Commission investigation is discussed in Section 3 (Albert, 2025). The professional basis of the audit changed too: FTI applied ISACA’s IT audit and assurance standards (FTI Consulting, 2024, p. 11), whereas BDO conducted its engagement under ISAE 3000 (BDO LLP, 2025, p. 4).
X’s response to its first-cycle audit was selective. It accepted some recommendations, committing, for example, to update its trusted flagger guidance and its transparency reporting manual (Twitter International Unlimited Company, 2024, pp. 29, 35). But where FTI reached negative conclusions on contested or investigated obligations, X met the findings with reinterpretation or deferral rather than correction. FTI found X non-compliant on online interface design (Art. 25(1)) and the protection of minors (Art. 28(1)) (FTI Consulting, 2024, pp. 33, 191). X replied that the first finding “goes beyond the requirements of Article 25”, and that the auditor’s proposed age-assurance standard “does not comply with Article 28.3 DSA” (Twitter International Unlimited Company, 2024, pp. 42, 52). FTI also reached negative conclusions on systemic risk assessment and mitigation (Arts 34(2), 35(1)) (FTI Consulting, 2024, pp. 35–36). On these, and on Article 25, all under Commission investigation, X stated that it “does not intend to implement the auditor’s recommendation and will await the EC’s decision in the investigation” (Twitter International Unlimited Company, 2024, pp. 42, 57–58, 62; see also Albert, 2025).
YouTube serves as the control case. Its auditor reached a conclusion on every applicable obligation in both cycles, including the systemic risk obligations under Articles 34 and 35 that were disclaimed for Facebook in both cycles and for X in Cycle 2 (Table 4.2; Google Ireland Limited, 2024b, p. 137; 2025c, p. 178). Its headline Harm Index score of 1 diverges from the 0 recorded for both Meta and X under the same Index and DSA rules (see the platform results below). Together the three span the range the Index is built to detect: concentrated failure, contested failure and a partial pass.
One scoring choice carries through every table that follows: a disclaimed Article scores 0 on the relevant process indicators, as a documented failure would, whatever the reason given (Section 4, “Disclaimers and the Harm Index”). The tables apply this rule without restating it.
Tables 5.1–5.3 set out the scores for all three platforms, one table per index. Each table asks one question of every platform.
Purpose (five indicators) how strong is the architectural transparency of its governing logic
Petition (four indicators) can its decisions be challenged
Peer (three indicators) can its logic be contested
Each cell gives the score and the band it corresponds to; the full scoring guidance for each indicator is set out in Tables 3.3–3.5.
The evidence and reasoning behind every score follow, platform by platform.
Table 5.1. Purpose (Architectural Transparency): scores by platform
| Indicator | DSA Articles | Meta | X | YouTube |
|---|---|---|---|---|
| Disclosure of optimisation objective or declared decision logic | 14, 15/24, 27, 39 | 1: Disclosed reactively | 1: Disclosed reactively | 1: Disclosed reactively |
| Independent verification of declared logic against operation | 34/35, 37 | 0: No independent verification | 0: No independent verification | 2: Routine, continuous verification |
| Public availability | 24(5), 42(4)(c)–(d) | 2: Proactively published on a fixed cycle | 2: Proactively published on a fixed cycle | 2: Proactively published on a fixed cycle |
| Methodological concurrence across subjects | 37; Delegated Reg. (EU) 2024/436 | 1: Common procedural framework; subject-defined benchmarks | 1: Common procedural framework; subject-defined benchmarks | 1: Common procedural framework; subject-defined benchmarks |
| Depth of verification | 37(4); disclaimed Articles | 0: Confirms only that a control exists | 0: Confirms only that a control exists | 1: Confirms an observable effect; logic not characterised |
| Index score | 0 | 0 | 1 |
Source: author’s scoring.
Evidence for each score is given in the platform narratives below and in Appendices A–C.
Indicators reflecting minimal, record-generating compliance: Disclosure (1), Methodological concurrence (1), Public availability (2). Meta meets its formal disclosure obligations on the statutory cycle: EY reached positive conclusions on terms and conditions and recommender transparency in both cycles (Ernst & Young LLP, 2024, pp. 49, 51; 2025, pp. 61–62). However, those obligations require disclosure of a recommender system’s main parameters (Regulation (EU) 2022/2065, Art. 27(1)–(2)), not its optimisation objective. What Meta’s systems are optimised for has surfaced reactively, through litigation discovery: internal documents record a decision to reduce advertising load for teenage users to “maximize long-term revenue growth” (In re Social Media Litigation, 2026, p. 21). The formal route to data is constrained, with the Commission preliminarily finding Meta in breach of its researcher data access obligations (European Commission, 2025a). Meta’s audit reports and audit implementation reports are likewise published as Article 42(4) requires (Regulation (EU) 2022/2065, Art. 42(4); Ernst & Young LLP, 2024; 2025; Meta Platforms Ireland Limited, 2024; 2025), which satisfies a statutory obligation. On Methodological concurrence, the audit criteria for Article 20(4), which requires complaints to be handled in a timely manner, rest on a benchmark Meta set itself. EY describes such benchmarks as the “audited provider’s developed supplemental criteria”, comprising its “legal interpretation, operational benchmarks and definitions” (Ernst & Young LLP, 2025, p. 6). That benchmark changed between cycles. In Cycle 1, management defined “timely” as complaints “decisioned within 72 hours” (Ernst & Young LLP, 2024, p. 31); in Cycle 2, it was redefined as handling reviews “as quickly as reviewer resources allow”, against an internal goal of seven days (Ernst & Young LLP, 2025, p. 34). The benchmark is therefore one Meta can, and did, revise at its own discretion, rather than an externally fixed requirement.
Indicators reflecting the absence of independent examination: Independent verification (0), Depth of verification (0). These two scores are of concern. They do not indicate that Meta was tested and found deficient. Rather, no independent verification occurred in either audited year in respect of the systemic risk obligations (Arts 34(1), 34(2), 35(1)). In both cycles, and in near-identical terms, EY stated that ongoing Commission investigations meant it could not obtain sufficient appropriate evidence and that it did “not express a conclusion” on these and eleven other sub-articles (Ernst & Young LLP, 2024, p. 2; 2025, pp. 3–4; see Table 4.2). Where EY did examine Meta’s controls, it did so “not for the purpose of expressing an opinion on the effectiveness of the audited provider’s internal control” (Ernst & Young LLP, 2024, p. 5; 2025, p. 5).
The relationship between the 2 and the two 0s. Considered in isolation, “findings proactively published on a fixed cycle” suggests good transparency practice. However, what is published on these obligations is that no conclusion was reached, rather than any substantive finding about the systems themselves. Publication also does not make the public the report’s audience. The audit report is “intended solely for the information and use of” Meta, the Commission and the Digital Services Coordinator (Ernst & Young LLP, 2024, p. 3). From Cycle 2 it expressly excludes “users of the service” (Ernst & Young LLP, 2025, p. 4). This is EY’s standard wording, also used in YouTube’s report (Google Ireland Limited, 2025c, p. 5) and so a feature of the audit architecture rather than of Meta’s conduct. Meta’s documentary record is timely. Evidentiary content, on the obligations of greatest consequence, is minimal. The pattern is one of visible process and untested substance, (Arts 34(1), 34(2), 35(1)) recurring across both zero scores as the obligations where that gap is concentrated. Ultimately, because Independent verification and Depth of verification both score 0, Meta fails the Purpose index outright.
Disclosure (1). Cycle 1 findings (Articles 14(1), 14(2)) show algorithmic decision-making, human review and internal complaint-handling procedures documented nowhere in X’s Terms and Conditions directly (FTI Consulting, 2024, pp. 66–67). The information exists but is dispersed across separately linked pages rather than stated at the point a user would need it (p. 13). X’s Rules and Policies are treated inconsistently against its formal Terms of Service and users are not informed when they change (pp. 71, 73). Disclosure occurs, but reactively and diffusely rather than as a matter of routine, proactive practice resulting in a score of 1.
Independent verification (0). Articles 34(1), 34(2) and 35(1) were disclaimed in Cycle 2 (BDO LLP, 2025, p. 5). Under the disclaimer rule it scores 0, whatever a prior cycle found. It is nonetheless worth noting what Cycle 1 had found before the disclaimer took effect. FTI returned Positive with comments on 34(1), Negative on 34(2), No Conclusion on 34(3), and Negative on 35(1), where mitigation effectiveness was measured only by the volume of content that evaded proactive detection, with no other effectiveness measure in use (FTI Consulting, 2024, pp. 34–36). In Cycle 2, three of the four obligations were disclaimed outright. The fourth, 34(3), returned Positive, but on the strength of an assurance that supporting documents “will be preserved” and an inspection that the risk assessment itself had been retained (BDO LLP, 2025, p. 52).
Public availability (2). X’s audit and implementation reports are published on the statutory cycle required under Article 42(4), proactively rather than on request. Nothing in the appendix evidence distinguishes X’s case from Meta’s or Google’s on this narrow point.
Methodological concurrence (1). Article 20(4) requires internal complaint-handling to be applied in a timely, non-discriminatory, diligent and non-arbitrary manner. This is the DSA’s standard, not X’s. The Cycle 1 finding is not that X substituted its own benchmark, as Meta did, but that FTI could not verify the DSA’s existing standard was applied consistently. Complaints from high-profile accounts, when escalated, could not be confirmed as reviewed under the same criteria as standard accounts (FTI Consulting, 2024, pp. 142–143). The framework is externally set; whether it was met consistently across different classes of user remains unverified.
Depth of verification (0). In Cycle 2, BDO disclaimed 10 of X’s sub-articles and, for a further 14 where no occurrences were reported, “only assessed the design of processes, systems and controls”, performing no tests of implementation or operating effectiveness (BDO LLP, 2025, pp. 5–6). Of 75 conclusions, 24 therefore carry no operational verification. Cycle 1 had tested substantively: of FTI’s 82 obligation-level conclusions, 9 were Negative and a further 29 Positive with comments or No Conclusion (FTI Consulting, 2024, pp. 20–44).
What the pattern shows. X’s failure is broader than Meta’s. Where Meta’s two 0s concentrated on a fixed pair of obligations disclaimed identically across both cycles, X’s two 0s sit on top of a documented collapse in scrutiny. A Cycle 1 that tested substantively found issues. This was followed by a Cycle 2 in which almost a third of the obligations discussed stopped being tested at all. Independent verification and Depth of verification both register 0 not for lack of checking, but because whatever checking occurred has now not been reported on. This is a more concerning trajectory of the two platforms, since it shows genuine oversight capacity being withdrawn rather than never having existed. Because Independent verification and Depth of verification both sit at 0, X fails the Purpose index outright. This is the same conclusion reached for Meta, though the underlying narrative here is one of erosion across cycles rather than a static, repeated gap.
Disclosure (1). In Cycle 1, Articles 14(5) and 14(6) both returned Positive with comments (Google Ireland Limited, 2024b, pp. 28, 30): the terms-and-conditions summary and translation obligations were tested and broadly met with recommendations only. Articles 39(1) and 39(2) (advertisement repository) similarly returned Positive with comments (Google Ireland Limited, 2024b, pp. 109, 111). In Cycle 2, Article 14(6) returned Negative: 24 of 33 in-scope terms were not published in all 24 official Member State languages (Google Ireland Limited, 2025c, pp. 26–27). YouTube represented that the most deficient term was published in all languages by 19 June 2025, which EY did not evaluate (Google Ireland Limited, 2025c, p. 27). The remaining 23 were still under assessment at the time of the implementation report (Google Ireland Limited, 2025a, p. 11). Disclosure occurs and is independently tested every cycle, but the pattern across both cycles is one of partial or delayed compliance rather than proactive disclosure, band 1.
Independent verification (2). In my coding of EY’s obligation-level conclusions for YouTube (Appendix B), every applicable risk-assessment and mitigation sub-article received a conclusion in both cycles. Articles 34(1) and 34(2) returned Positive with comments in both cycles (Google Ireland Limited, 2024b, pp. 96, 98; 2025c, pp. 103, 106). Article 34(3) returned Positive in both (Google Ireland Limited, 2024b, p. 100; 2025c, p. 107). Article 35(1) returned Positive in Cycle 1 and Positive with comments in Cycle 2 (Google Ireland Limited, 2024b, p. 102; 2025c, p. 111). Articles 35(2) and 35(3) are not obligations on the provider and were marked not applicable (Google Ireland Limited, 2024a, p. 50; 2025a, p. 38). EY’s own declaration confirms the result: in both reports, the section for obligations where “an audit conclusion could not be reached with a reasonable level of assurance” (Article 8(8) of the Delegated Regulation) reads “Not applicable” (Google Ireland Limited, 2024b, p. 137; 2025c, p. 178). No risk-assessment or mitigation obligation was therefore disclaimed or left without a conclusion in either cycle. This is the strongest record on this indicator of any platform in the study.
Methodological concurrence (1). EY declares that both engagements were conducted under ISAE 3000 (Revised) (Google Ireland Limited, 2024b, p. 6; 2025c, p. 6), as the Delegated Regulation’s Annex I, Section B.5 requires. The procedural standard is named and external to YouTube. The substantive benchmarks are not. In both cycles EY states that “many of the obligations needed to be supplemented by the audited provider’s own legal determination, operational benchmarks and/or definition of ambiguous terms” (Google Ireland Limited, 2024b, p. 10; 2025c, p. 172). The Article 24(5) finding, for example, is measured against YouTube’s own “4-day operational benchmark” (Google Ireland Limited, 2024a, p. 24). This is the same language EY used auditing Facebook (Ernst & Young LLP, 2024, p. 11; 2025, p. 122). The same auditor applies the same caveat to both clients. A common procedural framework with provider-defined substantive benchmarks is band 1.
Depth of verification (1). The Articles tested, 14(6)’s translation completeness (Google Ireland Limited, 2025c, pp. 26–27), 24(1)’s transparency-report specificity (Google Ireland Limited, 2024b, p. 68; 2025c, p. 75), 22(1)’s trusted-flagger delay (Google Ireland Limited, 2025c, p. 60) are procedural and reporting-focused. As such, they are not obligations that reach the platform’s ranking, weighting, or recommender logic. A tested, disclaimer-free examination, but of process rather than of the system’s governing logic itself.
What the pattern shows. YouTube’s Purpose record is the only one of the three with no indicator at 0. The strongest indicator, independent verification, contrasts with Meta’s and X’s weakest results, systemic risk assessment and mitigation, a reversal of the pattern on the other two platforms. The three 1s, Disclosure, Methodological concurrence, Depth of verification, show the record does not yet clear the top band on every indicator. YouTube’s record shows disclaimer-free testing throughout, and a named procedural standard, though with provider-defined substantive benchmarks. However, the benchmarks against which compliance is measured remain YouTube’s own.
Its Purpose score is 1. No indicator at 0, so YouTube does not fail the Purpose index outright, unlike Meta and X. This is the first index score, for any platform in this research, above the minimum.
Table 5.2. Petition (Justificatory Addressability): scores by platform
| Indicator | DSA Articles | Meta | X | YouTube |
|---|---|---|---|---|
| Existence of an external addressee for individual grievances | 11, 12, 37 | 1: Internal channel only; no certified external body | 1: Internal channel only; no certified external body | 1: Internal channel only; no certified external body |
| Enforceability of findings | 37(6), 42(4)(d) | 0: Advisory only | 0: Advisory only | 1: Must engage and report; not required to implement |
| Accessibility of the channel to an individual citizen | 16, 20, 21 | 0: Realistically usable only by well-resourced actors | 0: Realistically usable only by well-resourced actors | 1: Open to individuals; cost or procedural burden |
| Outcome reporting | 17, 24(5), 42(4)(c)–(d) | 0: Outcomes not reported | 2: Reported with enough granularity to assess function | 1: Aggregate statistics only |
| Index score | 0 | 0 | 1 |
Source: author’s scoring.
Evidence for each score is given in the platform narratives below and in Appendices A–C.
The one indicator reflecting a functioning channel, existence of an external addressee. Article 12(1) establishes a single point of contact through which EU users can communicate directly with Meta. The Cycle 1 audit found this channel working, with one qualification: 1 of 25 sampled requests was not answered within Meta’s own 7-day “rapid response” target, attributed to a volume spike (Ernst & Young LLP, 2024, p. 16). A channel exists and, on the evidence tested, functions. It falls short of the top band because it is a point of contact rather than the external, independently certified body the top band specifies.
The three indicators reflecting the absence of functional recourse: Enforceability (0), Accessibility (0), Outcome reporting (0). On Enforceability, Meta declined an auditor recommendation in Cycle 2. EY concluded that Meta complied with Article 14(2), with comments, and recommended that Meta assess whether changes to the webpages linked from its Terms of Service were significant enough to notify users (Ernst & Young LLP, 2025, p. 15). Meta replied that the recommendation would extend compliance “beyond the contours of Art. 14(2)”, and that “no additional measures, over and above MPIL’s existing measures, have been implemented” (Meta Platforms Ireland Limited, 2025, pp. 4–5). X made the same move on Article 25, arguing that its auditor’s finding “goes beyond the requirements” of the Article (Twitter International Unlimited Company, 2024, p. 42). Nothing in the audit regime compels reconsideration: a provider may decline a recommendation provided it justifies its reasons (Regulation (EU) 2022/2065, Art. 37(6)). The regime is advisory by design.
On Accessibility, the evidence is mixed rather than absent. The 0 reflects a judgement on that mixed record rather than a default. Article 20(4) and 20(5) were tested and returned Positive with comments, the same finding already noted under Methodological concurrence, where two sampled appeals missed Meta’s self-set 7-day timeliness target. Set against that finding is a much larger disclaimed cluster: Articles 16(1), 16(5), 16(6), 20(1) and 20(3), covering the notice-and-action and internal complaint-handling mechanisms, were disclaimed in both cycles (Ernst & Young LLP, 2024, p. 2; 2025, pp. 3–4; see Table 4.2). The tested evidence, on Article 20(4), indicates only how quickly Meta handled appeals that had already been successfully lodged, measured against Meta’s own timeliness benchmark (Ernst & Young LLP, 2024, pp. 31–32; 2025, pp. 34–35). The disclaimed obligations cover an earlier question: whether the routes into that process, flagging content and lodging a complaint at all, are accessible to a genuine complainant in the first place. The indicator is scored on the obligations that define the channel, not the one obligation that happened to be tested, which is why the mixed record still returns 0.
On Outcome reporting, Article 17(1), the statement-of-reasons obligation, was disclaimed in both cycles. Article 17(3) was tested in Cycle 2 and returned Positive with comments: Meta’s statements of reasons did not specify whether a decision followed a notice or automated detection, as Article 17(3)(b) requires (Ernst & Young LLP, 2025, p. 30). The score remains 0: the disclaimer rule applies to the obligation that defines the indicator, Article 17(1), whatever a narrower, adjacent obligation shows.
What the pattern shows. A working point of contact exists and is evidenced. Beyond that, the audit record either finds against Meta directly (Enforceability), finds only on a narrow procedural item while leaving the substantive mechanism untested (Accessibility), or is silent on the core obligation by disclaimer while returning a finding on an adjacent one (Outcome reporting). In each of the three failing indicators, some evidence exists; in none of them does it meet the obligation the indicator is testing.
Because Enforceability, Accessibility and Outcome reporting all sit at 0, Meta fails the Petition index outright. One functioning point of contact does not offset the absence of enforceability, of accessibility on the mechanisms that matter, or of outcome transparency on the core reporting obligation.
Existence of an external addressee (1). Articles 11(2) and 12(2) require X to make its points of contact for authorities and users easy to identify. In Cycle 1, FTI found the information publicly available but not easily accessible: a process-flow error in the Help interface meant the relevant form was reached only by clicking “Contact Us” twice (FTI Consulting, 2024, pp. 20, 53–54, 63). X reports having fixed the flow in August 2024 (Twitter International Unlimited Company, 2024, pp. 2–4).
Enforceability (0). Article 14(4), Cycle 1: FTI concluded Positive with comments (FTI Consulting, 2024, p. 21). Its detailed finding states that “insufficient evidence of objectivity was seen in enforcement of the Terms of Service”, attributing this to “accepted privileges for accounts with large followers or certain checkmarks” (FTI Consulting, 2024, p. 77). X did not simply decline the recommendation; it inverted the finding’s premise. It argued that high-follower accounts require “prioritized moderation for effective risk mitigation” (Twitter International Unlimited Company, 2024, pp. 11–12).
Accessibility (0). In Cycle 1, FTI reached a Negative on Article 16(3): having confirmed content as illegal in one Member State, X does not assess whether it is illegal in others where it may be viewed (FTI Consulting, 2024, pp. 23, 99). Articles 20(1), 20(4) and 20(5) each returned Positive with comments: statements of reasons to advertisers did not identify the violation, escalated complaints from high-profile accounts could not be verified as reviewed under the same criteria and redress notices sometimes omitted out-of-court dispute settlement information (FTI Consulting, 2024, pp. 26–27). Article 16(6) reached No Conclusion in Cycle 1 and, with 16(5), was disclaimed in Cycle 2 (FTI Consulting, 2024, p. 24; BDO LLP, 2025, p. 5). Unlike Meta’s record on this indicator, each of these tested obligations surfaced a deficiency rather than a narrow caveat.
Outcome reporting (2). Articles 17(1), 17(2) and 17(3) returned Positive with comments in Cycle 1: statements of reasons for advertisers did not identify the violation, advertisers were not consistently notified of monetisation restrictions from the date imposed and statements of reasons for pausing ads revenue sharing omitted redress information (FTI Consulting, 2024, pp. 24–25). In Cycle 2, all three returned Positive (BDO LLP, 2025, pp. 26–29). Deficiencies identified in Cycle 1 were retested a year later and found resolved: identification, followed by remediation and independent verification that the remediation held.
What the pattern shows. X’s Petition record does not fail uniformly, attracting scores across the full three-point range. A working point of contact exists, functioning despite a navigational defect. Outcome reporting shows the audit mechanism working as intended, an issue corrected, then independently confirmed as resolved. Set against that, Enforceability and Accessibility show a more troubling pattern: not absence of testing, as with Meta, but active contestation of a finding’s legal meaning and a consistent run of tested obligations each returning a real deficiency rather than a caveat. Where Meta’s failures came from obligations never reaching an opinion, X’s come from obligations that were tested, opined on and either disputed or found wanting outright. Because Enforceability and Accessibility both sit at 0, X fails the Petition index outright. One functioning point of contact and one genuinely resolved obligation do not offset the absence of enforceability or of accessibility on the mechanisms that matter.
Existence of an external addressee (1). Articles 11 and 12, the points of contact for authorities and for users, returned Positive in both cycles (Google Ireland Limited, 2024b, pp. 17–22; 2025c, pp. 14–18). This is a stronger record than Meta’s (a single missed 7-day target out of 25 sampled requests) or X’s (a process-flow defect making the channel hard to reach). The auditor, EY, is itself an external party, appointed in both cycles (Google Ireland Limited, 2024a, p. 3; 2025a, p. 3). The indicator still scores at band 1 rather than 2: the top band specifically requires the external, independently certified body under Article 21, not a point of contact under Articles 11 and 12.
Enforceability (1). No declined recommendation appears in YouTube’s implementation reports (Google Ireland Limited, 2024a, pp. 6–44; 2025a, pp. 8–28). Every finding is engaged with and most are remediated or in progress, though not all: on Article 16(1), YouTube is still “determining the extent to which remediation is necessary and appropriate” (Google Ireland Limited, 2025a, pp. 13–14). This is the strongest enforceability record of any platform in the study. Band 2 is structurally unreachable for platforms under the current DSA architecture: Article 37(6) obliges only that a recommendation be “taken due account of”, never implemented. No mechanism exists to compel a fix regardless of platform conduct. YouTube’s score of 1 therefore reflects the best available outcome under a ceiling the DSA itself imposes, not a shortfall in YouTube’s own response. The democracy-relevant finding here is not about YouTube specifically: Meta’s Article 14(2) shows what the same architecture permits when a platform chooses otherwise. Until a positive audit finding carries a direct enforcement consequence, every platform retains the fallback ability YouTube chose not to use.
Accessibility (1). Articles 16(1), 16(5), 16(6) and 20(1) were tested in both cycles, and none was disclaimed (Google Ireland Limited, 2024b, pp. 33, 38–39, 50; 2025c, pp. 31, 35, 37, 47). Article 21, not applicable in Cycle 1, returned Positive on 21(1), 21(2) and 21(5) in Cycle 2 (Google Ireland Limited, 2024a, p. 50; 2025c, pp. 55–58). YouTube’s record is one of full testing. This is a fuller and more consistent testing record than either Meta (a disclaimed core cluster) or X (a run of comprehensive deficiencies). Each auditor finding is a narrow operational gap rather than an untested obligation or a systemic failure. In Cycle 2, the notice mechanism for allegedly illegal content was not operable on the desktop webpage for users without a YouTube channel, though those users could still report through the Help Centre webform (Article 16(1)) (Google Ireland Limited, 2025c, p. 31). In Cycle 1, YouTube did not retain evidence of when decisions on notices were made. In Cycle 2, YouTube represented that it had retained this from 27 March 2025, but EY did not obtain evidence of it (Articles 16(5) and 16(6)) (Google Ireland Limited, 2024b, pp. 38–39; 2025c, pp. 35, 37). Also in Cycle 2, a public-facing appeal policy stated that appeals could be filed up to 90 days after a warning or strike, when the system allowed six months (Article 20(1)) (Google Ireland Limited, 2025c, pp. 46–47).
Outcome reporting (1). Article 24(1) (transparency-report specificity on suspensions) returned Negative in both cycles for the same defect: suspensions for manifestly unfounded complaints were not reported per platform (Google Ireland Limited, 2024b, p. 68; 2025c, p. 75). The breakdown was missing again from the August 2024 Transparency Report and was supplied only in February 2025, nine months after the Cycle 1 examination period ended (Google Ireland Limited, 2025c, p. 75). Article 24(5) (statement-of-reasons submission timeliness) returned Negative in Cycle 1, with 14 percent of statements submitted late (Google Ireland Limited, 2024b, p. 73), and Positive in Cycle 2 (Google Ireland Limited, 2025c, p. 80). Article 17 (individual-level statements of reasons) returned Positive in both cycles (Google Ireland Limited, 2024b, pp. 41, 43; 2025c, pp. 39, 41). Both audit reports and both implementation reports are published, satisfying Article 42(4)(c)–(d) (Google Ireland Limited, 2024a; 2024b; 2025a; 2025c). A defect flagged, repeated in the next reporting period and corrected only late holds the indicator at band 1.
What the pattern shows. All indicators score 1. This is based on disclaimer-free testing, with a finding attached to each auditor judgement. The contact channel works but is not the certified adjudicatory body band 2 requires. Recommendations are acted on, but nothing makes a finding binding. Accessibility obligations are tested, but each reports an issue. Outcome reporting has a gap that recurred across both cycles before late correction. This is a different position from Meta, where obligations went untested altogether, and from X, where obligations were tested and either disputed or found deficient. YouTube’s Petition record is one of consistent, moderate friction across every indicator, not extreme failure and not complete success either.
Table 5.3. Peer (Minimal Co-authorship): scores by platform
| Indicator | DSA Articles | Meta | X | YouTube |
|---|---|---|---|---|
| Permanent channel to contest the governing logic itself | 21 | 1: Narrow or conditional channel | 1: Narrow or conditional channel | 1: Narrow or conditional channel |
| Independence of any structural-input mechanism | 37(3); Delegated Reg. (EU) 2024/436, Annex I, B.4–B.5 | 1: Nominally external; funding or governance entanglement | 0: Controlled by the regulated entity | 1: Nominally external; funding or governance entanglement |
| Functioning access to system-level data | 40(12), 24(5), 37(4)(d), 38 | 0: No usable external access to system-level data | 0: No usable external access to system-level data | 1: Access exists but incomplete or unreliable |
| Index score | 0 | 0 | 1 |
Source: author’s scoring.
Evidence for each score is given in the platform narratives below and in Appendices A–C.
Contesting channel (1). Article 21 establishes certified out-of-court dispute settlement bodies, and Meta’s Cycle 2 audit found this positive, without comment, on 21(1), 21(2) and 21(5) (Ernst & Young LLP, 2025, pp. 40–42). It fails to achieve the top band because of what the mechanism actually reviews. Article 21 bodies rule on individual disputes, whether a specific decision should be overturned, not on the governing logic that produced the decision in the first place. A channel that exists and is tested still scores 1 rather than 2 if its scope is confined to outputs rather than the system that generated them. That is the case here. The space of reasons is limited.
Independence (1). The baseline is Article 37(3) and the Delegated Regulation’s independence provisions (Annex I, Sections B.4–B.5). Meta’s auditor, EY, is nominally external, a third-party firm, but is selected and paid by Meta itself, in both cycles. That is precisely the funding and governance entanglement band 1 describes: the mechanism is not internal to Meta, but it is not free of Meta’s control over who performs the check either. It falls short of band 2, which requires the mechanism to be governed by parties other than the regulated entity.
System access (0). Primary Transparency Database evidence, drawn from Facebook’s full July 2026 submissions (29,454,716 statements of reasons) shows the decision_facts field taking only two values across the entire month: “This account was determined to violate terms of service” (20,628,316 statements) and “This content was determined to violate terms of service” (8,826,400). The same two sentences are used regardless of what was actually decided, across 13 statement categories, both decision grounds and every type of action, including 1,085,971 decisions categorised as negative effects on civic discourse or elections and 933 decisions grounded in illegal content. In a 1,000-row sample from 30 June 2026, the incompatible_content_ground field returned a single identical string, “This was a violation of “sections 3.2” of our terms of service”. Whatever reasoning Meta’s systems applied, the disclosed output cannot distinguish one case from another. The pattern is not unique to this research. Kaushal et al. (2024), analysing over 131 million statements of reasons submitted by all 16 VLOPs then reporting, between 19 and 28 November 2023 (including around 20 percent of Facebook’s submissions to that date), found Facebook using the same two-template structure, then worded “terms of use” and the same single ground string (Kaushal et al., 2024, pp. 1122, 1127). The disclosure has therefore remained essentially unchanged for both audit cycles. Article 40(12), the route through which outside researchers would reach the underlying data, was disclaimed in both cycles (Ernst & Young LLP, 2024, p. 2; 2025, pp. 3–4; see Table 4.2). This evidence also bears directly on an obligation the audit left unverified: Facebook’s submissions to the database under Article 24(5) were disclaimed in both cycles (Ernst & Young LLP, 2024, p. 2; 2025, pp. 3–4; see Table 4.2).
A second point of corroboration sits within the audit record itself. Article 38 requires VLOPs to offer at least one recommender option “not based on profiling” (Regulation (EU) 2022/2065, Art. 38), the DSA’s only mechanism giving users a structural lever over the logic applied to them. In Cycle 1, EY reached a negative conclusion on this obligation because the option was missing from the Facebook Dating recommender system “between 29 August 2023 to 15 February 2024”, roughly five and a half months of the examination period, until Meta implemented it on 15 February 2024 (Ernst & Young LLP, 2024, p. 58). Two separate channels of system access, one for disclosure and one for user control, both show the same gap.
What the pattern shows. A contesting channel and an independence mechanism both exist in some form. Neither is fabricated or absent, the audit record supports a limited version of each. What is missing is the one indicator that would let a genuine act of contestation happen: system-level access good enough to reconstruct or verify the governing logic itself. Without that, the channel and the nominally independent auditor both operate on Meta’s own account of what happened, because no other account is available to check it against.
Because System access resolves 0, Meta fails the Peer index outright. A contesting channel and a genuinely external auditor do not amount to co-authorship if neither can be tested against the system’s actual logic.
Contesting channel (1). In Cycle 1, FTI found 21(1), 21(2) and 21(5) Positive, but because no out-of-court dispute settlement bodies had yet been certified in Ireland, so there were “subsequently no requirements to satisfy” (FTI Consulting, 2024, pp. 27–28, 152). In Cycle 2, BDO found no occurrences and assessed only the design of the process, concluding Positive with comments (BDO LLP, 2025, pp. 6, 35–37). Across both cycles, X has never had this obligation operationally tested. The channel exists on paper in both years; whether it functions has not yet been established either way, which is what band 1 describes.
Independence (0). Like every DSA provider, X selects and pays its auditor. What moves X below band 1 is how that power was used. FTI’s Cycle 1 audit reached Negative conclusions on interface design, the protection of minors and the systemic-risk obligations (FTI Consulting, 2024, pp. 33, 35–36, 191). For Cycle 2, X replaced FTI with BDO LLP, a member of the European Contact Group (Albert, 2025), which reached no conclusion on the systemic-risk obligations then under Commission proceedings (BDO LLP, 2025, p. 5). The professional standard changed with the firm, from ISACA’s standards to ISAE 3000 (Revised) (FTI Consulting, 2024, pp. 10–11; BDO LLP, 2025, pp. 4, 72). Meta and YouTube hold the same power of selection but did not exercise it against an adverse audit; X did. That is control over the check, not merely entanglement with it.
System access (0). Primary Transparency Database evidence, drawn from X’s full July 2026 submissions (379,888 statements of reasons, retrieved 3 September 2026; dataset X726.csv, see note 2 and Data), shows a similar pattern to Meta’s at a smaller scale. The decision_facts field takes only 10 action-and-trigger combinations across the month, such as “Decision - action Suspend triggered by the system with no human intervention”. The decision_ground field returns DECISION_GROUND_ILLEGAL_CONTENT for every statement, with none under the terms-of-service ground on which Meta relies almost exclusively. The illegal_content_legal_ground field shows more surface variety, 74 distinct values across the month, against Meta’s single fixed string. But each value is a short internal policy code, such as PlatformManipulation, Cse or NsfwAdultContent, which names the category that applies rather than explaining the specific case. In all of the 379,888 statements, the illegal_content_explanation field repeats that code verbatim: the field meant to explain why content is illegal restates the category instead. Pasquale’s description of credit ‘reason codes’ applies. Rather than explain what happened, they simply name a factor in the decision (Pasquale, 2015, p. 149). A wider menu of categories is still a menu of categories. Data that is schema-compliant but withholds case-specific content functions as a denial of access and is scored accordingly rather than given partial credit for the larger menu. Article 40(12), researcher data access, points the same way: tested Positive in Cycle 1 (FTI Consulting, 2024, p. 40), it was disclaimed in Cycle 2 (BDO LLP, 2025, p. 5) and, under the disclaimer rule, scores 0.
Contesting channel (1). Article 21 was Not Applicable in Cycle 1 (Google Ireland Limited, 2024a, p. 50) and tested for the first time in Cycle 2, returning Positive, no comments, on 21(1), 21(2) and 21(5) (Google Ireland Limited, 2025c, pp. 55–58). X’s Cycle 1 finding was Positive because no certified dispute-settlement bodies yet existed in its jurisdiction to test against. YouTube’s Cycle 2 finding, by contrast, is substantive: EY inspected the service’s public-facing site and confirmed it links to the list of certified out-of-court dispute settlement bodies and their contact details, and that this information is “easily accessible… clear, and user friendly” (Google Ireland Limited, 2025c, p. 55). This is a tested mechanism, though what was tested is narrower than it appears. EY’s positive conclusion on Article 21(2), the duty to engage in good faith, was measured against YouTube’s own definition of good faith: maintaining a process to consider each dispute and respond to the body (Google Ireland Limited, 2025c, p. 56). Over a largely overlapping period, Appeals Centre Europe reported that YouTube had shared no content with it, and 13 of its 29 YouTube decisions were default decisions (Appeals Centre Europe, 2025, p. 48). The audit confirmed that a process exists. However, it did not establish that the process gives a dispute body what it needs to decide. The score is unaffected, since the indicator is already capped at 1 on scope, but the case shows the gaps the Depth of verification and Methodological concurrence indicators are built to register: a control confirmed to exist rather than shown to work, measured against a benchmark the platform wrote. It still caps at band 1 rather than 2, for the same structural reason as Meta and X: Article 21 bodies rule on individual disputes, not on the governing logic that produced the decision.
Independence (1). EY, the same auditor in both cycles, formally declares its engagement under ISAE 3000 (Revised) (Google Ireland Limited, 2024b, p. 6; 2025c, p. 6), as the Delegated Regulation’s Annex I, Section B.5 requires. That declaration is auditor-attested rather than independently confirmed, and, as noted under Methodological concurrence, the standard is applied against benchmarks YouTube itself defines. EY is nominally external, but it was appointed by Google Ireland Limited in both cycles and the audit is conducted at the provider’s “own expense” (Google Ireland Limited, 2025a, p. 3). This is the same funding-and-selection method that holds Meta at band 1. YouTube avoids X’s additional problem, a change of firm and standard between cycles, but does not clear band 2, which requires governance by parties other than the regulated entity.
System access (1). Primary Transparency Database evidence, drawn from YouTube’s full July 2026 submissions (4,582,544 statements of reasons, retrieved 3 September 2026; dataset YT726.csv, see note 2 and Data), shows decision_facts taking 359 distinct values of explanatory prose that distinguish violation types. In the incompatible_content_explanation field, 4,184,859 of YouTube’s 4,582,544 July statements (91 percent) link to a specific policy page; almost all of these (4,148,118) link to Google’s advertising policies. The richer explanation is therefore concentrated in advertising decisions, including all 20,375 statements categorised as negative effects on civic discourse or elections. The remaining 434,426 statements carry policy-level rather than case-level explanations, with three standard texts accounting for almost half of them. This is a substantially different pattern from Meta’s fixed sentences or X’s bare policy codes. It still falls short of band 2. The underlying data remains a grouped export by violation type, not an account of why this particular item was actioned over another matching the same template. A second area of evidence supports the same score: Article 40(12), researcher data access, returned Positive, no comments, in both cycles (Google Ireland Limited, 2024b, p. 117; 2025c, p. 132). YouTube is the only platform with a clean, consistently tested record on this obligation across the analysis. Its Peer score is 1, the same as for Purpose and Petition.
Meta’s headline result. Purpose, Petition and Peer each floor at 0, through Independent verification and Depth of verification under Purpose, Enforceability, Accessibility and Outcome reporting under Petition, and System access under Peer. Because the headline Harm Index score is the minimum across all three indices, not their average, Meta’s overall result is 0. This is not an averaging approach or a single weak indicator dragging down an otherwise adequate record. All three indices fail independently, on different obligations and for different reasons.
X’s headline result. Purpose, Petition and Peer each resolve at 0 : through Independent verification and Depth of verification under Purpose, Enforceability and Accessibility under Petition and Independence and System access under Peer. The headline Harm Index score is the minimum across all three indices, the same headline figure as Meta, though reached through a different evidentiary path. Where Meta’s failures concentrated on obligations that were never independently tested at all, X’s failures are drawn substantially from obligations that were tested and found wanting: a disputed legal interpretation (Enforceability), a run of genuine accessibility deficiencies rather than a single caveat (Accessibility) and an auditor replaced after adverse findings (Independence). X also shows the one clean instance of the audit mechanism working as designed anywhere in either platform’s record, Outcome reporting, a genuine failure in Cycle 1 independently verified as resolved in Cycle 2. As with Meta, any one of the three failing indices would have been sufficient on its own to produce this result; the minimum rule confirms a finding that holds under several different ways of reading the same record.
YouTube’s headline Harm Index score is 1. Each of its three indices scores 1: no indicator falls to 0, but none clears the top band across a whole index. It is the first result across any platform in this study that moves from the lowest score.
Thirty-six scored indicators across three platforms, twelve indicators * three platforms, were drawn from primary audit reports, implementation reports and Transparency Database information for July 2026. This provides a set of data which combines third party auditors, platform responses, raw data and DSA Articles.
The Harm Index result is aggregated as follows:
Table 5.4. Aggregated Results
| Table | Meta | X | YouTube |
|---|---|---|---|
| Purpose | 0 | 0 | 1 |
| Petition | 0 | 0 | 1 |
| Peer | 0 | 0 | 1 |
| Harm Index | 0 | 0 | 1 |
Two platforms output the minimum score the Index can produce, Meta and X, with YouTube scoring 1. I have shown that the Index has scope for variation, not just at the headline level (0, 0, 1) but within it. Across the thirty-six scored indicators, individual scores span the full 0–2 range. Where platforms score poorly or at the top range, this is driven by the evidence base.
How the two 0s are reached provides further evidence of where and how platforms do not achieve the goals of the DSA. Meta’s failure is concentrated. The same Articles used in Independent verification and Depth of verification under Purpose and System access under Peer are disclaimed identically across both audit cycles. Nothing was independently tested on the platform’s recommender logic and systemic risk in either audit year. X’s failure is distributed differently. Articles were tested, and either actively disputed, Enforceability, via a competing legal reading of Article 14(4), or found repeatedly lacking, Accessibility, together with an auditor replaced after adverse findings, Independence. Meta’s verification did not reach the target. X’s verification functioned procedurally but was defeated substantively. The audit mechanism worked. FTI reached unfavourable findings: a Positive with comments on Article 14(4), qualified by ‘insufficient evidence of objectivity’ in enforcement (FTI Consulting, 2024, pp. 21, 77) and Negatives on the systemic-risk obligations, Articles 34(2) and 35(1) (FTI Consulting, 2024, pp. 35–36). How X reacted to this is the core problem. X did not accept or decline these findings, it supplied a competing legal reading of the obligation itself, arguing the very conduct FTI flagged was what the law required. On Article 26(2), X declined a recommendation to improve commercial-content detection, citing the auditor’s own positive conclusion as its justification for not acting (Annabell, 2025). Where the findings were most problematic, on systemic risk, now under formal Commission proceedings (BDO LLP, 2025, p. 5), X replaced the auditor (Albert, 2025). In each instance, a finding was reached and X’s response was not correction but reinterpretation, justification or discontinuation. Verification happened, surfacing non-compliance, but X’s response neutralised the finding rather than acting on it. Meta and X achieve the same score through different routes. This is the Index’s evidence of two structurally distinct ways an accountability mechanism can fail. Similarly, YouTube provides a control case for the Index. Every YouTube indicator reaches at least 1, so none scores 0. Its Independent verification score is the strongest recorded for any platform on any indicator in this study. This is tested and disclaimer-free in both cycles. These are the systemic-risk Articles (34, 35) where Meta and X failed. YouTube’s score of 1, rather than 2, illustrates that the Index does not have an automatic fail risk embedded. A pass is possible under the same rules that produced Meta’s and X’s 0s.
This pattern is not confined to the three platforms scored here. Two independent studies, each covering different obligations and different platforms, reach the same underlying conclusions. On Methodological concurrence specifically, the self-authored-benchmark problem the harm Index identifies from what is present or absent in individual findings has been stated directly by an auditor. Auditing Facebook’s recommender-system obligations under Articles 27 and 38, EY noted that many obligations required supplementing with the audited provider’s own legal determination, benchmark or definition of terms (Chapman, 2025; see also Ernst & Young LLP, 2024, p. 11). EY’s YouTube reports carry the same statement in both cycles, quoted above under YouTube’s Methodological concurrence (Google Ireland Limited, 2024b, p. 10; 2025c, p. 172). The same auditor applies the same caveat to different clients, so even a shared auditor does not produce a shared benchmark. EY also notes that “the professional standards applied prohibit the auditing organization from developing its own criteria” (Google Ireland Limited, 2025c, p. 172). The benchmarks are therefore authored by the platforms, not the auditors. This correlates with my findings and raises issues of comparability across platforms. Where each platform authors the benchmark it is audited against, consistency across platforms becomes even more difficult to achieve. On the problem of what an auditor’s “compliant” verdict establishes, a comparative study of eight platforms’ Article 26(2) audits, found all of them rated compliant despite inconsistency in audit methodology: no defined sample sizes in most reports, auditors using different procedures on the same obligation and at least one instance of an auditor’s report omitting a disclosure feature the platform itself publicly advertises (Annabell, 2025). Uniform positive findings are achieved by inconsistent means. This raises an increased risk of legitimising the gap the DSA’s audit mechanism is in place to close.
The above studies support the same methodological choice the Harm Index makes. An auditor’s headline verdict, Positive, Positive with comments, compliant, is not treated as the final acceptance. The evidence underlying the audit is re-examined against the Index’s twelve indicators. Even with the audit process and the DSA being in its early stages, the emerging literature and the Harm Index find the same credibility gap in DSA audit practice.
This returns us to the paper’s underlying claim, outlined in Sections 1 and 2. Democratic erosion via online platforms does not require force or acknowledged denial. It happens when the space of reasons in which citizens could contest a platform’s exercise of power is structurally occupied. This is, within the scope of the DSA, exhibited under the formal appearance of accountability in the form of published audits, implementation reports and statements of reasons. I provide the evidence of where and how this can be located. Meta’s and X’s 0s do not show that harm has occurred, or that either platform intends it. They show something prior: that on the Articles at the edge of democracy, systemic risk, recommender logic and researcher access, no external route exists through which those subject to the platform can verify, and so contest, how it acts upon them. A route to contest that no one outside the platform can verify is one the platform confers at will, and standing that is conferred rather than commanded is not standing (Pettit, 2002, p. 350). Within the conditions tested, that is domination in Forst’s sense: structural, whatever the intent behind it. The disclaimer pattern, an auditor declining to reach any conclusion where an investigation is live, is not an abstract, governance-design flaw. It is one with a direct, measurable consequence. This is the reason Meta’s Purpose score is 0 for the same two Articles, using the same commentary in consecutive years.
YouTube’s 1 is equally important to my conclusions. This shows that the erosion the Index detects is not an inherent property of internal platform governance, although this could feature, nor of the DSA’s architecture. It is contingent, at least partially, on how a given platform’s audit relationship is conducted. The same regulatory instrument and indicators concluded a different, better scoring result for a platform whose auditor tested the highest stakes obligations, in both cycles, without disclaiming them. This supports the need for independent oversight of the audit process itself, with power to inspect individual source material. The gap identified in Meta’s and X’s records is not inevitable. Disclaimers need not be used as a default. Currently that is a choice left entirely to the audited platform and its chosen auditor. This is the disclaimer functioning as a risk. Not that it wrongly says a platform is compliant, but that it lets an auditor avoid ever having to say it is not.
In Section 5, I tested three of the largest VLOPs against the Harm Index. The twelve indicators show that Meta and X fail across all three indices, placing them beyond the edge of democracy. Within the conditions tested, those subject to them have no verifiable route to contest how they act, towards citizens or towards the state. YouTube achieved the most positive result, with a consistent score of 1 across all three indices. This places it at the edge, standing holds, but precariously, short of secure (2).
A macro-level examination of the 2025 audit reports across 21 VLOPs and 2 VLOSEs, published by KPMG (2026), correlates with my findings. The cohort has expanded from the initial 19 services as newly designated platforms completed their first audit cycle (KPMG, 2026, p. 4). Holding a dual role, KPMG is not a disinterested source. KPMG is a DSA auditor and a member of the European Contact Group, the industry coalition whose guidance on disclaiming obligations under Commission investigation is examined in Section 3 (Albert, 2025). Its analysis is used here as evidence from within the audit profession, not as independent confirmation. The two VLOSEs are included in KPMG’s aggregate figures, but they account for 2 of the 23 reports analysed (KPMG, 2026, p. 31). The obligations examined are predominantly Chapter III platform obligations, meaning that their inclusion does not distort the findings. The failures are not anomalies confined to Meta, X and YouTube; the audit profession’s own cross-platform analysis shows them to be structural features of the wider cohort.
From KPMG, the headline figures in the 2026 cross-platform benchmark suggest a developing compliance. Overall, positive opinions rose to 79 percent, from 72 percent, while negative opinions fell to 6 percent (KPMG, 2026, p. 6). This aggregate finding does not survive when examined in detail, as KPMG’s finer analysis shows. Read through the Harm Index, in conjunction with KPMG’s analysis, the aggregate progress proves to be insubstantial. The full audit population exhibits persistent, systemic failures concentrated in the areas governing democratic contestation. Taking the three indices in turn, I show how this conclusion is sustained.
Purpose, Index 1, focuses especially on Articles 34 and 35: risk assessment and risk mitigation. They rank highest by request frequency among the EC’s enforcement priorities. Of the 58 requests for information, 15 led to the opening of an investigation or formal proceedings (KPMG, 2026, p. 26). There is no DSA requirement for auditors to disclaim if an EC investigation is underway; as Holznagel (2025, Observation 1) argues, Article 37 contains no provision allowing obligations under investigation to be skipped. On my reading, disclaiming risks rendering the audit more opaque rather than more accountable. The first enforcement outcome indicates what that opacity may conceal. The Commission’s €120 million fine on X, its first non-compliance decision under the DSA, concerned deceptive interface design, the advertisement repository and researcher data access (European Commission, 2025b). These are Articles 25, 39 and 40(12), precisely the obligations on which BDO declined to reach a conclusion in X’s second audit cycle (Table 4.2). In the same benchmark, KPMG note that Articles 14, 15, 24 and 42 “remain challenging” (KPMG, 2026, p. 6). This is more than a challenge. Platforms, simply put, are failing to provide users with a means to understand what happens to them once they enter a platform’s systems. Data indicates the typical global social media user is active on 6.5 platforms each month (DataReportal, 2026). Within the EU specifically, social media use is reported as an average of 67 percent, with the range being 56–90 percent of citizens (data.europa.eu, 2026). A user does not need every platform they use to fail Articles 34 and 35 to be affected. Partial failure across a user’s platform portfolio still compounds, returning to the position set out in Section 1, leaving the user increasingly blind and casting doubt on the extent of their agency. Based on KPMG’s analysis, four of the five Purpose indicators score poorly. Only Depth of verification remains clear of issues. Article 14’s gaps hit Disclosure and Public availability. Articles 15, 24 and 42’s benchmarking problems undermine Independent verification and Methodological concurrence. That is 80 percent of the Purpose indicators, impacted by findings the auditors themselves describe as challenging.
Petition, Index 2, particularly Article 16(5), returned a 43 percent negative-opinion rate. This is the highest failure rate of any Article in the DSA (KPMG, 2026, p. 6). The Harm Index registered the same obligation as unverified for Meta in both cycles and for X in Cycle 2, where Article 16(5) was disclaimed (Table 4.2). KPMG’s cohort-wide figure shows it is not an isolated problem but a multi-platform failure. KPMG highlight related issues within the statement of reasons, Article 24(5), Transparency Database transmission and the use of duplicate statements of reasons (KPMG, 2026, p. 17). Petition assesses whether there is addressability. It asks, ‘can a request for justification be issued and acted on?’ Article 16(5) fails that test in nearly half of all audited cases, largely through late notifications and missing redress options. The statement-of-reasons problems KPMG document in their Transparency Database analysis deepen this failure. Duplicate and lost records weaken the evidentiary trail even where a notification is issued. This two-pronged dilution affects the making of a request and the understanding of any reply, if received at all.
Article 21’s out-of-court dispute settlement, the external addressee Petition looks for, shows the same pattern. Dispute settlement produces a positive and a negative finding. The positive is that challenge is being made. Eleven certified bodies across eight Member States now handle disputes under Article 21 (European Commission, 2026c) and one, Appeals Centre Europe, has received over 30,000 disputes (Hughes, 2026). These typically arrive at out-of-court dispute settlement (ODS) bodies when users contest content or account decisions. The negative lies in how platforms handle the route. Negative audit opinions on Article 21 obligations rose from none in the first cycle to between 5 and 10 percent in the second, citing the lack of a documented ODS process, decision templates that omitted information on dispute settlement bodies, inconsistent notifications and informal handling procedures (KPMG, 2026, p. 16). Platform responses compound this. Because ODS decisions are non-binding, platforms can and do disengage. Hughes (2026) reports that “in the vast majority of cases, platforms are unable or unwilling to provide” the content needed to examine a dispute, especially for account suspensions. In essence, platforms are more likely to withhold content. Platforms are required to engage with ODS bodies in good faith (Regulation (EU) 2022/2065, Art. 21(2); European Commission, 2026c), so persistent non-cooperation is the type of activity that could draw Commission scrutiny. Whether it does is discretionary (Art. 66(1)), with the burden of enforcement falling back on Commission intervention rather than on the dispute mechanism functioning as designed. The impact reaches further into the audit process. Should an Article fall under investigation, it is likely to be disclaimed (Albert, 2025; Holznagel, 2025, Observation 1; KPMG, 2026, p. 14), producing no audit conclusion, which the Harm Index scores 0. Addressability is a key space of reasons concept. Barriers to it push platform actions towards the edge of democracy, again.
Peer, Index 3, is implicated by KPMG’s findings on transparency data and researcher access. KPMG notes undocumented or unverified calculation methodologies in transparency reporting (KPMG, 2026, p. 17). It also records zero negative opinions under Article 40 in Cycle 2, but its report gives two distinct reasons for this. They do not carry the same weight. Auditors were “unable to conclude” for several platforms because of ongoing EC investigations (KPMG, 2026, p. 23), a disclaimer. Separately, roughly half the population had obligations 40(1) to 40(7) marked “not applicable” because the Delegated Act became operational in October 2025, outside the audit timeframe (KPMG, 2026, p. 23). KPMG presents this as a matter of timing. I read it as inconsistency. Identical circumstances produced different audit treatment. The remaining platforms, facing the same timeline, still received audit opinions on the same Articles (KPMG, 2026, p. 23). That inconsistency points at the standardisation of approach and, more worryingly for the space of reasons, weakens the value of platform analysis individually and across the full cohort. An independent examination of researcher access under Article 40(12) found it “substantially incomplete and systematically biased” (Bekavac and Mayer, 2026, p. 3). Using sockpuppet accounts, Bekavac and Mayer reconstructed what users were shown in TikTok’s For You feed during the 2024 US presidential election (July–November 2024) and Meta’s Instagram Explore feed during the 2025 German federal election (January–February 2025), over 4,000 posts in total, and compared it with what the TikTok Research API and Meta Content Library returned for the same posts. Researchers could access only around 75 percent of the TikTok posts and 50 percent of the Instagram posts users saw (Bekavac and Mayer, 2026, p. 6)3. The ability to reconstruct or challenge system logic that Peer requires is obscured by the absence of negative findings, which is not the same as a positive outcome. This matters because Article 40(12) provides access specifically for research that “contributes to the detection, identification and understanding of systemic risks in the Union” (Regulation (EU) 2022/2065, Art. 40(12)), and those risks include negative effects on “civic discourse and electoral processes, and public security” (Art. 34(1)(c)). These are core areas the Harm Index is designed to identify and where noumenal power is most threatened. Where elections, civic discourse and public security are dominated, the space of reasons is constrained.
The DSA provides a framework against which VLOPs can be measured. This provides phenomenal outputs which identify multiple areas in which platforms are failing to meet their democratic obligations. This is not just a matter of mistakes being made. The ongoing nature of these problems and platforms’ documented unwillingness to cooperate with dispute resolution, even when users are directly affected, show issues of governance, failure to act and disregard for user concerns. These are not accidental. They are choices which reduce users’ roles in the accountability structure. KPMG’s cross-platform benchmark corroborates the Harm Index, albeit adopting a broad reporting rather than in-depth system analysis. Bekavac and Mayer (2026) provide a highly focused, Article 40, analysis examining Meta and TikTok, directly linking to and reinforcing Article 24 transparency concerns. Articles 24 and 40 are core Articles impacting multiple further Articles. This highlights substantive concerns the Harm Index identifies. Problems with access and transparency generate a foundation capable of obscuring a platform’s purpose. Through the interdependent structure of the Harm Index, this creates issues with a willingness to be petitioned and opportunities to challenge. Co-authorship is rendered improbable at even the most minimal of levels.
These choices extend beyond platforms’ relationship with users to their relationship with the regulator, as Section 2 anticipated. Platforms increasingly exercise functions once reserved to states, a shift Pasquale (2017) describes as “replacing the logic of territorial sovereignty with functional sovereignty”. Across the audit record they act towards the state less as regulated entities and more as counterparts contesting its authority to bind them. Platforms define the obligation: the audit criteria are built from benchmarks the audited provider supplies (Commission Delegated Regulation (EU) 2024/436, Art. 10(2)(a); Holznagel, 2025, Observation 2) and Meta treats Article 14(3) as not applicable to a service minors demonstrably use (Section 7). Platforms can and do restrict verification, with obligations under Commission investigation going unaudited and the research access through which compliance could be tested independently returning an incomplete picture of what users see (Bekavac and Mayer, 2026, p. 6). Platforms absorb sanctions. As Section 1 noted, penalties capped at a fraction of turnover (Regulation (EU) 2022/2065, Art. 74(1)) can function as a cost of doing business. The DSA’s first penalty, €120 million against X, addressed three transparency obligations while the wider investigation into illegal content and information manipulation remains open (European Commission, 2025b). The response to that decision made the state-versus-platform dimension explicit. In a post on X, the United States Secretary of State said the fine “isn’t just an attack on [X], it’s an attack on all American tech platforms and the American people by foreign governments” (Rubio, quoted in Wardwell, 2025). The administration linked further fines to the threat of tariffs on the EU (Wardwell, 2025). A dispute between a regulator and a regulated platform was recast as a dispute between states. In Diamond and Morlino’s terms, the DSA positions platforms in a relationship of horizontal accountability, answering to public bodies with the legal authority to check them (2004, pp. 25–26). The audit record shows platforms taking part instead as counterparts: choosing the checker, supplying the benchmarks, contesting what obligation means and absorbing the sanction. Diamond and Morlino note that agencies of horizontal accountability can be turned against opponents, at a cost to the credibility of the whole network (p. 26). Describing the X decision as an attack by foreign governments levels that charge at the check itself. Towards citizens, the platform occupies part of the governing position (Section 2; Klonick, 2018, p. 1603). Towards the regulator, it acts as a peer institution, a relation beyond the platform–user focus of Klonick’s account. In both relations, it stands where a state would.
Not knowing how an influencing system works prevents citizens from engaging in the space of reasons at all. Platforms are being shown not to fail democracy in isolated cases. They fail it structurally and at scale.
References, data and notes for the full paper are on the Eroding the Edge of Democracy page.