The EU accuses TikTok of not safeguarding children's privacy in accordance with the DSA.

      On July 24, the European Commission released initial findings indicating that TikTok violated the Digital Services Act by leaving accounts of minors accessible to adults. This marks a significant development in an ongoing investigation into the app initiated in 2024.

      The findings are specific yet significant. Investigators determined that TikTok's default settings inadequately ensured the privacy of children’s profiles, an oversight the Commission regards as a systemic risk rather than a mere issue of design. This situation aligns with a broader EU initiative aimed at enhancing online child safety across major platforms.

      The Commission noted that users aged 13 to 15 could easily change their accounts from private to public, while accounts of those aged 16 and 17 remained visible to anyone online, including individuals without a TikTok account. Regulators stated that this exposure led to risks such as cyberbullying, unwanted contact, and predatory behavior.

      “Content from children should never be visible to strangers,” stated Commission spokesperson Thomas Regnier, emphasizing that the default settings for minors are “far from a beauty contest under the DSA” and “must be effective.” The DSA measures platforms based on outcomes rather than intentions.

      Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, articulated the issue in terms of structural requirements. She emphasized that the law mandates platforms to incorporate safeguards into their services and hold accountability when those protections fail.

      These findings are preliminary and not conclusive. TikTok can review the Commission's files and respond in writing before any decision on non-compliance is made, a process that may take months. If the response does not meet the investigators’ expectations, the Commission can issue a formal decision, mandate changes, and impose ongoing penalty payments until compliance is achieved.

      If the conclusions remain unchanged, the potential fines could be substantial. The DSA permits penalties of up to 6% of a company’s total global annual revenue, calculated against the parent company rather than the European subsidiary. The regulation requires the largest platforms to ensure a high level of privacy and safety for minors by default. This default setting is the focus of the Commission’s evaluation, rather than the eventual settings that a user can modify.

      TikTok, which is owned by China’s ByteDance, has countered the allegations, asserting that protecting minors is a mutual objective. The company pointed to over 50 default privacy and safety features for teen accounts, default private settings for users under 18, and restrictions on direct messaging for younger teenagers. TikTok has previously stated its intention to continue enhancing these tools while disputing the Commission’s interpretation of them.

      This conflict is not new. In February, the Commission issued another preliminary finding indicating that TikTok’s addictive design—characterized by features such as infinite scroll, autoplay, and push notifications—violated the same regulations, a claim the company labeled as “categorically false.”

      Both inquiries are part of formal proceedings that began in February 2024, shortly after TikTok was classified as a very large online platform and subjected to the strictest obligations under the DSA. This classification imposes responsibilities to evaluate and reduce systemic risks, including risks related to children's rights, which is the specific focus of the Commission's current scrutiny.

      TikTok is not alone in facing these issues; the Commission is simultaneously pursuing child-safety cases against competing platforms, having previously determined that Meta’s Instagram and Facebook also fell below the required design standards. Additionally, its scrutiny regarding age verification processes across the sector is expanding rather than diminishing.

      Overall, these cases signify a transition from the initiation of investigations, which Brussels conducted extensively throughout 2024, to the issuance of charges that could precede actual penalties. Currently, the charge is preliminary and the potential fine remains hypothetical. What is clear is the Commission’s interpretation of the law: a setting that a 13-year-old can change in moments is not considered a meaningful protection in Brussels' perspective.