Brussels Finds TikTok's Minor Privacy Controls Fall Short of EU Law

Preliminary Findings Target Default Visibility Settings

The European Commission has issued preliminary findings this week asserting that TikTok's privacy architecture for underage users fails to meet the baseline requirements established under the Digital Services Act. At the center of the complaint: accounts belonging to minors default to public visibility, allowing any user on the platform to view their content and profile information.

The commission's objection extends beyond static privacy toggles. TikTok's recommendation engine actively surfaces videos posted by users aged 16 and 17 through the For You feed, a discovery mechanism that places content in front of audiences who do not follow the creator. According to the European Commission, this combination of public profiles and algorithmic amplification creates pathways for unwanted contact, cyberbullying, and predatory outreach that the DSA explicitly seeks to prevent.

At DailyTechWire, we've tracked how platform liability frameworks in Brussels have evolved from voluntary codes of conduct into binding obligations with financial teeth. The DSA, which came into full force last year for very large online platforms, shifts the burden of proof onto tech companies to demonstrate that their design choices actively mitigate harm, particularly for vulnerable user groups.

What the DSA Demands from Platforms Serving Minors

The Digital Services Act establishes a tiered accountability structure. Platforms designated as very large online platforms or very large online search engines, those with more than 45 million monthly active users in the EU, face heightened obligations around systemic risk assessment and mitigation. For services accessible to minors, the law requires a demonstrable commitment to privacy, safety, and security by default.

The commission's interpretation is clear: when a platform permits minors to opt into public visibility rather than enforcing privacy as the baseline state, it falls short of the standard. The preliminary findings argue that TikTok's current configuration exposes young users too widely, creating risk vectors that the platform has not adequately addressed through technical or policy measures.

This marks a departure from earlier content moderation debates, which centered on reactive takedowns and community guidelines enforcement. The DSA framework demands proactive design, requiring platforms to engineer their systems in ways that reduce exposure to harm before content is even published or recommended.

Revenue-Based Penalties and Compliance Pressure

TikTok now has an opportunity to respond to the preliminary findings before the European Commission issues a final decision. Should the commission proceed with a non-compliance determination, the platform faces fines reaching up to 6% of its global annual revenue. For a company that generated tens of billions in advertising income last year, the financial exposure is substantial.

Revenue-based penalties represent a deliberate policy choice by EU regulators. Fixed fines, even in the millions, have historically proven insufficient to alter behavior at companies operating at TikTok's scale. By tying penalties to turnover, Brussels aims to ensure that compliance costs outweigh the benefits of maintaining controversial features or delaying remediation.

The commission has recommended specific remedial steps: default accounts for minors to friends-only visibility and remove content from users under 18 from algorithmic recommendation surfaces like the For You feed. Both measures would require significant engineering work and would likely impact engagement metrics, a core driver of ad revenue and platform growth.

A Pattern of Regulatory Friction

This is not TikTok's first collision with the European Commission over DSA compliance. Earlier in 2026, the commission opened proceedings related to design features it characterized as addictive, including infinite scroll, autoplay video, and push notification strategies. Those findings remain under review.

Beyond the EU, TikTok has faced parallel scrutiny in the United Kingdom, where Ofcom, the communications regulator, concluded that the platform's content moderation systems were insufficiently effective at preventing harmful material from reaching children. The convergence of regulatory pressure across multiple jurisdictions signals a broader shift in how democracies with mature digital markets are approaching platform governance.

For TikTok, the strategic challenge is not simply legal compliance in one market. The company must navigate divergent regulatory regimes, from the EU's systemic risk and design obligation model to the US focus on data sovereignty and national security concerns, and the UK's duty-of-care framework. Each jurisdiction demands different evidence, different technical interventions, and different corporate accountability structures.

Design Choices and the Future of Social Platforms

The commission's findings underscore a fundamental tension in social media design: the features that drive engagement, discovery, and network effects often conflict with privacy and safety objectives, especially for younger users. Public profiles and algorithmic recommendation are not incidental to TikTok's product; they are core to its value proposition as a discovery-first platform where anyone can go viral.

Restricting visibility and recommendation for minors would create a two-tier user experience. Accounts under 18 would function more like private networks, limiting their ability to build audiences or participate in viral trends. Whether such a model can coexist with TikTok's growth ambitions remains an open question.

Other platforms have experimented with age-differentiated design. Instagram introduced "Teen Accounts" with default privacy restrictions, and YouTube has long limited data collection and ad targeting for users identified as minors. Yet enforcement remains inconsistent, and age verification technologies remain imperfect, relying largely on self-reported birth dates that are easy to falsify.

The broader policy question is whether platforms can simultaneously serve minors and operate recommendation-driven, engagement-optimized business models. The European Commission's position suggests that when those goals conflict, safety must prevail, even at the cost of reduced functionality or commercial performance.

As the DSA enforcement cycle matures, we expect Brussels to refine its interpretation of what constitutes adequate protection for minors, potentially setting precedents that extend to other very large platforms. For now, TikTok must decide whether to contest the findings or accept a model that fundamentally alters how millions of young European users experience the app.