EU Charges TikTok with Failing to Protect Children’s Privacy Under the DSA
Brussels’ Preliminary Findings
The European Commission issued preliminary findings on July 24, 2026, stating that TikTok platform violated the Digital Services Act (DSA) by leaving minors’ accounts exposed to strangers. The latest development escalates a probe that has been ongoing since 2024.
Key Findings
- Privacy Settings: Investigators concluded that TikTok’s default settings did not adequately keep children’s profiles private, treating this omission as a systemic risk rather than a design quirk.
- Account Visibility: Users aged 13 to 15 could easily switch their accounts from private to public, while accounts of 16- and 17-year-olds were visible to anyone online, including non-TikTok users.
- Potential Risks: This exposure created avenues for cyberbullying, unwanted contact, and predatory behavior.
"Children’s content must never be visible to strangers," said Commission spokesperson Thomas Regnier, emphasizing that default settings for minors are not a beauty contest under the DSA and "must be effective."
Legal Implications
- Non-Compliance Decision: TikTok can now review the Commission’s file and respond in writing before any formal non-compliance decision is made, a process that could take months.
- Potential Fine: If the findings stand, TikTok could face a fine of up to 6% of its global turnover, calculated against the parent company ByteDance.
TikTok’s Response
TikTok, owned by ByteDance, disagreed with the findings, stating:
"Protecting minors is a goal we share… We have more than 50 preset privacy and safety features on teen accounts, private-by-default settings for under-18s, and a block on direct messaging for younger teenagers."
They have previously expressed intentions to continue improving these tools while contesting the Commission’s legal interpretation.
Background
The dispute is not new. In February, the Commission reached a separate preliminary finding that TikTok’s addictive design, including infinite scroll, autoplay, and push notifications, violated the same rules under the DSA.