EU provisionally finds TikTok failed to protect children under Digital Services Act

The European Commission has provisionally found that TikTok breached the Digital Services Act by failing to provide sufficient privacy protections for minors, saying the platform's default account settings expose children to unnecessary risks.

Under the Digital Services Act, platforms accessible to minors must provide a high level of privacy, safety and security by default. The Commission found that TikTok falls short of this standard in several ways.

Minors on TikTok can choose to make their accounts public, meaning their content becomes visible to anyone – including people who do not have a TikTok account. Content posted by 16 and 17-year-olds can also be recommended to any user through the For You Feed. Even when a minor sets their account to private, their profile can still be found through the followers and following lists of other users, while their profile photo remains visible to anyone.

The Commission said these settings create risks including unwanted contact, cyberbullying and predatory behaviour, warning that content posted by minors could remain online indefinitely, with potentially life-long consequences.

"A high level of protection should not be an opt-in; it should be the default," said EU tech chief Henna Virkkunen.

TikTok said it would review the findings and continue working with regulators, arguing that it already has extensive protections in place for younger users.

"Under-18 accounts are private by default and we are one of the only platforms where younger teens cannot use direct messaging or have their content eligible to appear in the For You feed," a spokesperson said.

TikTok can now respond to the Commission's provisional findings before a final decision is issued. If the findings are ultimately confirmed, the platform could face a fine of up to 6% of its global annual turnover.

The decision adds to growing regulatory scrutiny of TikTok across Europe. Earlier this month, Ofcom opened an investigation into whether the platform has complied with its duties under the UK's Online Safety Act to protect children from harmful content, including whether its age assurance measures are effective enough to identify under-18 users.

The findings form part of a wider Digital Services Act investigation into TikTok launched in February 2024, and follow similar action against Meta earlier this year, when the Commission provisionally found Instagram and Facebook had failed to adequately enforce their minimum age requirements. 

The Commission has also previously issued provisional findings over TikTok's potentially addictive design and researcher access to platform data.