The Week in European Digital: Record Fines, TikTok's Reckoning and Europe's Sovereignty Wager

Brussels closed out the week by breaking its own record twice over. The European Commission fined AliExpress 550 million euros for failing to assess and mitigate the risk of illegal and counterfeit products on its marketplace, a Digital Services Act penalty that stood as the bloc's largest online-platform fine for all of three days. Then Google overtook it, receiving an 890 million euro penalty under the Digital Markets Act, the first fine ever issued under that rulebook. Of that sum, 460 million euros was for self-preferencing Google's own services in search rankings, with the remainder tied to how the company handled advertising and Play Store disclosures, as Heise Online and The Register both detailed. The Commission is not finished with Google's search business either: it is separately demanding that Android make room for rival AI chatbots and share search data with competitors, a move aimed squarely at Gemini's home-field advantage.

Where AliExpress and Google's cases are concluded penalties, TikTok's week under the DSA is a different animal entirely. The Commission opened preliminary proceedings, not a fine, arguing the platform should not let teenagers' accounts default to public and discoverable. As netzpolitik.org and The Verge reported, investigators want private-by-default settings and tighter limits on how minors' content gets recommended to strangers. It is a serious complaint, but it is a charge to be argued out, not a verdict already reached, and the distinction matters for a company that will now spend months contesting it.

A rulebook that fines platforms for being too closed is now colliding with apps built to stay that way.

That contradiction showed up elsewhere too. The DMA's interoperability mandate, the same principle invoked against Google's ecosystem, is now running into messaging apps that built their reputation on being closed by design. Threema laid out, at length, why it will not open its network to WhatsApp and other messengers, arguing that mandated interoperability threatens end-to-end encryption rather than merely inconveniencing incumbents, a position WhatsApp itself has echoed. Meanwhile EDRi flagged a less visible but arguably bigger fight over data: leaked documents describing an Enhanced Border Security Partnership with Washington suggest the Commission has quietly conceded ground on sharing travelers' biometric and profiling data in exchange for visa-free access to the US. A regulator handing out record fines for how platforms treat European data in one breath, and reportedly negotiating away some of that same data in the next, is the kind of tension a retrospective can note without pretending to resolve.

If enforcement was one half of the week, the other was Europe trying to build its way out of dependency rather than just fine it. Microsoft struck a multi-billion euro deal with Mistral AI to run more of its infrastructure in Europe, a partnership AI Business and Presse-Citron both framed explicitly around sovereign AI rather than ordinary vendor economics. Samsung is reportedly in talks to back Mistral at a 20 billion euro valuation, according to the Financial Times, which would make the French company one of the most heavily capitalized AI challengers outside the US and China. That any of this needs an American cloud giant or a Korean conglomerate to happen is itself a reminder that sovereignty, in practice, rarely means going it alone.

Elsewhere the pushback against dependency was more direct. Ireland stalled a 1 billion euro Microsoft tender over sovereignty questions, with officials pointing to open-source and European-regulated alternatives instead, The Register reported. The Dutch government signed a framework deal with the European cybersecurity vendor ESET for state bodies, explicitly to cut reliance on non-European suppliers. And the European Parliament is rolling out its own generative AI tool, EPGenAI Hub, less to chase innovation for its own sake than to stop staff pasting draft legislation into ChatGPT.

Capital followed the same instinct. Airbus anchored a 500 million euro European defence tech fund, with its first bet landing on the French counter-drone startup Alta Ares. Humanoid raised 133 million euros at a 1.1 billion euro valuation, becoming the latest entrant in Europe's crowded industrial-robotics field. The UK's CuspAI closed a 450 million dollar round, and ispace-EUROPE landed a 65 million euro ESA contract to build MAGPIE, a lunar rover meant to search for polar ice, an unglamorous but telling example of Europe insisting on operating its own hardware rather than renting someone else's. None of these deals are sovereignty policy by themselves, but taken together they describe a continent trying to fund its own alternatives rather than simply regulate everyone else's.

Europe is not choosing between fining Big Tech and funding its own alternatives. This week, it did both, loudly.

What ties the week together is not a single storyline but a pattern: Brussels is more willing than ever to write nine-figure checks against the platforms that dominate European digital life, while a separate but related current, spanning national governments, EU institutions and private capital, is trying to make sure fewer of tomorrow's dominant platforms are American by default. Neither effort is complete, and the EU's own border-data concession is a reminder that the bloc's instincts do not always point the same direction. But the direction of travel, for once, is legible.