The EU has accused TikTok of not adequately safeguarding children's privacy in accordance with the DSA.

      On 24 July, the European Commission released initial findings indicating that TikTok violated the Digital Services Act by allowing minors' accounts to be accessible to adults. This development is the latest in an ongoing investigation that has involved the app since 2024.

      The finding is specific yet significant. Investigators determined that TikTok's default settings did not effectively maintain the privacy of children's profiles, which the Commission sees as a systemic risk rather than merely a design flaw. This aligns with a broader EU initiative focused on online child safety that encompasses major platforms.

      The Commission noted that users aged 13 to 15 could easily change their accounts from private to public, while the accounts of those aged 16 and 17 were visible to anyone online, including individuals without TikTok accounts. Regulators stated that this exposure opens doors to cyberbullying, unwanted interactions, and predatory behavior.

      “Children’s content should never be accessible to strangers,” said Commission spokesperson Thomas Regnier, emphasizing that the default settings for minors are not merely cosmetic under the DSA and “must be effective.” The DSA evaluates platforms based on their outcomes, rather than their intentions.

      Henna Virkkunen, the Commission's executive vice-president for tech sovereignty, described the action in structural terms, stating that the law mandates platforms to incorporate safeguards into their service designs and be accountable when those safeguards fail.

      These findings are preliminary, not a final ruling. TikTok now has the opportunity to review the Commission’s findings and respond in writing before any decision regarding non-compliance is made, a process that could take several months. If the response does not meet the investigators' expectations, the Commission can issue a formal decision, mandate changes, and impose ongoing financial penalties until compliance is achieved.

      Should the findings be upheld, the penalties could be substantial. The DSA permits fines of up to 6% of a company's total worldwide annual revenue, calculated against the parent company rather than its European subsidiary.

      The regulation requires major platforms to establish a high level of privacy and safety for minors by default. The Commission is specifically scrutinizing the default settings, rather than the privacy options users can eventually access.

      TikTok, owned by China’s ByteDance, has contested the findings, asserting that safeguarding minors is a shared goal. The company highlighted its more than 50 preset privacy and safety features for teen accounts, default private settings for users under 18, and restrictions on direct messaging for younger teenagers.

      Previously, TikTok noted its commitment to enhancing these tools while disputing the Commission’s legal interpretation of them. This disagreement is not new; in February, the Commission reached a separate preliminary conclusion that TikTok's design, characterized by its infinite scrolling, autoplay, and push notifications, violated the same regulations—a claim the company dismissed as “categorically false.”

      Both issues are part of the formal proceedings initiated by Brussels in February 2024, following TikTok’s classification as a very large online platform, which subjected it to the DSA's most stringent requirements. This classification entails responsibilities to assess and reduce systemic risks, particularly regarding children's rights, which is the specific concern the Commission is currently addressing.

      TikTok is not alone in facing scrutiny; the Commission is exploring child-safety issues with competing platforms, having previously identified shortcomings in Meta’s Instagram and Facebook concerning the same design standards. Its age-verification investigations are also expanding rather than diminishing.

      Collectively, these cases represent a shift from launching investigations in large numbers throughout 2024 to moving towards issuing charges that precede actual penalties. For the time being, the charges remain preliminary and the potential fines are theoretical. However, what is clear is the Commission's interpretation of the law: in terms of children's privacy, a setting that a 13-year-old can deactivate within seconds does not qualify as a protection in the Commission's perspective.