EU Finds TikTok Breaches Digital Services Act on Minor Safety

The European Commission sent TikTok preliminary findings on July 24, 2026, concluding that the platform's account settings for minors fail to meet Digital Services Act (DSA) safety standards. The ruling could trigger fines up to 6% of global annual turnover.

The Commission found TikTok allows minors to set accounts to "public," making content visible to any user, including those without TikTok accounts. Content from users aged 16-17 can also be recommended to any TikTok user through the "For You" feed, exposing older minors to potentially harmful interactions.

Private Settings Still Leave Minors Exposed

Even when minors choose private accounts, significant vulnerabilities remain. Profile photos stay accessible, and accounts can be discovered through the "following" and "followers" lists of other users.

"TikTok's account settings fail to meet this standard, as they expose minors' accounts and content too widely," the European Commission stated.

TikTok now has the opportunity to respond in writing before the Commission issues a final non-compliance decision.

Part of Broader DSA Investigation

This action stems from a formal proceeding launched on February 19, 2024, to investigate TikTok's overall DSA compliance. Previous preliminary findings addressed TikTok's "addictive design" in February 2026 and restrictions on researcher access to public data in October 2025. An investigation into advertising transparency closed in December 2025. Ongoing probes examine the "rabbit hole effect" of recommender systems and age-misrepresentation risks.

Setting a Legal Precedent

The case represents a significant escalation in EU tech enforcement. By challenging the opt-in nature of safety settings, regulators aim to establish that high-level privacy and security for children must be the default, not a user choice.

A final determination could force TikTok to overhaul its account architecture across global markets. The Commission's approach signals that platforms with very large online reach face heightened obligations to protect vulnerable users through design, not just policy.