EU charges TikTok over ineffective child privacy defaults under DSA
Brussels has accused TikTok of breaching digital rules by failing to make minors' accounts private by default, signalling a shift towards real financial penalties for tech platforms.
The European Commission has charged TikTok with failing to protect the privacy of minors, issuing preliminary findings that the platform breached the Digital Services Act by leaving children’s accounts exposed to adults.
Investigators found that users aged 13 to 15 could switch their accounts from private to public with minimal friction. Accounts belonging to 16- and 17-year-olds were visible to anyone on the internet, including non-registered users, creating avenues for cyberbullying and predatory behaviour. Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, noted the law requires platforms to build safeguards into their design and answer for it when those safeguards fail.
“Children’s content must never be visible to strangers,” Commission spokesperson Thomas Regnier said. He added that default settings for minors are “not a beauty contest under the DSA” and “must be effective”. The regulation judges platforms on outcomes rather than intentions, testing whether theoretical settings actually protect users in practice.
For ByteDance, TikTok’s Chinese parent company, the financial stakes are severe. If the Commission adopts a formal non-compliance decision, it can order operational changes and impose periodic penalty payments until compliance is achieved. Under the DSA, fines can reach up to 6% of a parent group’s total worldwide annual turnover.
TikTok pushed back against the findings, arguing that protecting minors is “a goal we share”. The company pointed to private-by-default settings for users under 18, a block on direct messaging for younger teenagers, and more than 50 preset privacy features. It has signalled it will continue refining these tools while disputing the Commission’s legal interpretation.
This privacy probe is the second front in formal DSA proceedings against TikTok that began in February 2024. Earlier this year, the Commission also issued preliminary findings that the app’s addictive design features—such as infinite scroll and autoplay—violated the same rulebook, an assessment TikTok called “categorically false”.
TikTok is not alone in the regulator's sights. The Commission has already determined that Meta’s Instagram and Facebook fell short of the same child-safety design standards, and its scrutiny of age-verification practices across the sector is expanding. For major platforms operating in Europe, the actions mark a definitive shift from opening investigations to issuing the charges that precede real penalties.
