AliExpress €550 Million DSA Fine: The Record That Redraws Marketplace Liability

The Largest DSA Penalty Yet Lands on a Marketplace

The European Commission fined AliExpress €550 million on 20 July 2026 for breaching the Digital Services Act (DSA), a decision the Commission described as one of the highest penalties imposed to date under the EU’s digital rulebook. According to the European Commission’s enforcement announcement, AliExpress “fell short of its obligation under the DSA to diligently assess the risk of dissemination of illegal, unsafe, or counterfeit products” and “failed to take effective measures to reduce” that risk.

This is not a fringe enforcement action against a marginal actor. AliExpress belongs to Alibaba Group, the Chinese commerce giant headquartered in Hangzhou, and is one of the “Very Large Online Platforms” the DSA singles out for the strictest obligations. When the Commission chooses this defendant and this number, it is setting a market price for marketplace negligence — and that price just became an order of magnitude more expensive than most compliance teams had modelled.

What AliExpress Actually Got Wrong

The Commission’s case is precise about the failures. AliExpress underestimated the operational scale required to police its own catalogue. Per law firm Lewis Silkin’s analysis of the decision, the platform “failed to properly evaluate whether it had enough staff to review potentially illegal products” and “inadequately assessed how its recommender and advertising systems worsened the spread of illegal products.”

Two systemic weaknesses stand out. First, mitigation was hollow: AliExpress was found to be “poorly enforcing its penalty policy for traders selling illegal products,” and its “product compliance checks could also be easily circumvented through mis-categorisation” — sellers relabelled restricted goods to slip past filters. Second, the platform’s own recommendation and advertising engines amplified reach for exactly the listings that should have been suppressed. Counterfeit clothing, unsafe toys and dangerous cosmetics were the categories the Commission named.

Crucially, this fine is separate from an earlier track. As Trending Topics reported, in June 2025 the Commission accepted commitments from AliExpress on reporting mechanisms, remedies and advertising transparency — but the risk-assessment and mitigation failures now sanctioned “were not covered by those earlier commitments.” Fixing the reporting form did not fix the underlying safety system, and the DSA treats those as distinct obligations. AliExpress must submit an action plan with concrete remedial measures by 20 October 2026; failure to comply can trigger periodic penalty payments on top of the fine.

A Penalty Curve That Is Steepening Fast

Read alongside the other 2026 decisions, the AliExpress fine is not an outlier — it is a trend line. The Commission’s first DSA enforcement action fined X €120 million in December 2025 over its paid blue-checkmark deception and blocked researcher data access. Months later, the Commission fined Temu €200 million in May 2026 for basing its risk assessment on “general e-commerce risks, rather than taking into account the specific characteristics of TEMU’s services,” after test purchases turned up non-compliant baby toys.

Three decisions, three escalating numbers: €120M, €200M, €550M. The DSA lets the Commission fine up to 6% of a platform’s global annual turnover, so none of these are near the ceiling — which is precisely the warning. The enforcement muscle is warming up, not maxing out. For marketplaces, the common thread is unmistakable: generic, box-ticking risk assessments that ignore how your specific design spreads illegal goods are now a fineable offence, and the fine scales with your size.

What This Means for E-Commerce Operators

The AliExpress decision converts abstract DSA text into concrete engineering and staffing mandates. Any operator running a third-party marketplace — inside or outside the EU, if it serves EU users — should treat these as action items, not reading material.

1. Assess the risk your specific design creates, not generic e-commerce risk

Both AliExpress and Temu were penalised for the same conceptual error: assessing “general e-commerce risks” instead of how their own recommender, search and advertising systems amplify illegal listings. Your risk assessment must trace the actual path a counterfeit or unsafe item takes through your ranking and ad engines. Document how a mis-categorised listing gets surfaced, promoted or advertised, and quantify the mitigation. A boilerplate assessment copied from a template is now evidence of non-compliance, not proof of it.

2. Staff moderation to real catalogue volume — and prove the math

The Commission faulted AliExpress for failing to evaluate whether it had “enough staff to review potentially illegal products.” Coverage ratios matter: if your catalogue grows 40% and your trust-and-safety headcount is flat, that gap is now a documented liability. Build a defensible model linking listing volume, high-risk category share and reviewer capacity, and keep the evidence. Regulators are asking not just whether you moderate, but whether you resourced moderation to the size of the problem you created.

3. Close the mis-categorisation loophole before an auditor finds it

AliExpress’s compliance checks were “easily circumvented through mis-categorisation.” If a seller can relabel a restricted product into a permitted category and escape screening, your controls are decorative. Add cross-category detection, image-based classification and post-listing audits that catch relabelling. Then enforce the penalty policy you already publish — the Commission specifically flagged “poorly enforcing” trader penalties. A written policy you do not apply is worse than no policy, because it documents the gap between what you promised and what you did.

4. Treat prior commitments as a floor, not a settlement

AliExpress’s June 2025 commitments did not shield it from a €550 million fine on separate grounds. Closing one DSA workstream does not close the others; risk assessment, mitigation, transparency and trader traceability are enforced independently. Map every DSA obligation to an owner and a control, and never assume that satisfying a regulator on reporting mechanisms buys goodwill on product safety. The obligations do not net against each other.

The Broader Signal for Global Marketplaces

Strip away the specifics and the AliExpress fine tells every marketplace the same thing: the EU has decided that platform scale is an aggravating factor, not a defence. Executive Vice-President Henna Virkkunen framed the decision bluntly — scale is not an excuse, and risks must be identified and addressed systematically. That principle travels well beyond Brussels. The UK’s Online Safety regime, emerging rules across the Gulf, and data-and-consumer laws maturing across Africa all borrow the DSA’s core logic that the largest intermediaries owe the highest duty of care.

The commercial reading is that product-safety compliance has crossed from cost centre to competitive moat. Marketplaces that can credibly demonstrate design-aware risk assessment and adequately resourced moderation will find it easier to enter regulated markets and win enterprise sellers who fear reputational contagion. Those that cannot are now carrying an un-provisioned liability whose size the Commission has helpfully published. €550 million is not the ceiling — it is the current reading on a gauge that is still climbing.

Frequently Asked Questions

Sources & Further Reading

• Commission fines AliExpress €550 million for breaching the Digital Services Act — European Commission
• European Commission fines AliExpress a record €550 million for breaching the Digital Services Act — Lewis Silkin
• AliExpress Hit With €550 Million EU Fine Over Illegal Products — Trending Topics
• European Commission slaps X with €120 million fine over Digital Services Act breach — Pinsent Masons
• Understanding the Temu fine under the EU Digital Services Act — PRODlaw