On 24 July, the European Commission issued preliminary findings that the TikTok platform breached the Digital Services Act by leaving minors’ accounts open to adults, the latest escalation in a probe that has shadowed the app since 2024.

The finding is narrow but pointed. Investigators concluded that TikTok’s default settings failed to keep children’s profiles private in practice, an omission the Commission treats as a systemic risk rather than a design quirk, and one that sits inside a wider EU drive on online child safety that now stretches across the biggest platforms.

According to the Commission, users aged 13 to 15 could switch their accounts from private to public with little friction, while the accounts of 16- and 17-year-olds remained visible to anyone online, including people without a TikTok login.

That exposure, regulators said, created avenues for cyberbullying, unwanted contact, and predatory behaviour.

“Children’s content must never be visible to strangers,” Commission spokesperson Thomas Regnier said, adding that default settings for minors are “not a beauty contest under the DSA” and “must be effective”. The register is deliberate. The DSA judges platforms on outcomes, not intentions.

Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, framed the action in structural terms.

The law, she said, requires platforms to build safeguards into the design of their services and to answer for it when those safeguards fail.

These are preliminary findings, not a verdict. TikTok can now inspect the Commission’s file and reply in writing before any non-compliance decision is taken, a procedural stage that can run for months.

Should the response fail to satisfy investigators, the Commission can adopt a formal decision, order changes, and impose periodic penalty payments until the platform complies.

If the findings stand, the penalty could be steep. The DSA allows fines of up to 6% of a company’s total worldwide annual turnover, a figure measured against the parent group rather than the European subsidiary.

The regulation obliges the largest platforms to set a high level of privacy and safety for minors by default, and it is that default, rather than the settings a user can eventually reach, that the Commission is testing here.

TikTok, owned by China’s ByteDance, pushed back on the substance. The company said protecting minors was “a goal we share”, pointing to more than 50 preset privacy and safety features on teen accounts, private-by-default settings for under-18s, and a block on direct messaging for younger teenagers.

It has previously said it will keep improving those tools while contesting the Commission’s legal reading of them.

The dispute is not new. In February, the Commission reached a separate preliminary finding that TikTok’s addictive design, meaning its infinite scroll, autoplay, and push notifications, breached the same rulebook, an assessment the company called “categorically false”.

Both threads belong to the formal proceedings Brussels opened in February 2024, shortly after TikTok was designated a very large online platform and brought under the DSA’s strictest obligations.

That designation carries duties to assess and mitigate systemic risks, including risks to the rights of the child, which is the specific hook the Commission is now pulling on.

TikTok is not the only target. The Commission has run parallel child-safety cases against rival platforms, having earlier found that Meta’s Instagram and Facebook fell short of the same design standards, and its age-verification scrutiny of the sector is widening rather than easing.

Taken together, the cases mark a shift from opening investigations, which Brussels did in bulk through 2024, to issuing the charges that precede real penalties.

For now, the charge is preliminary and the fine hypothetical. What is settled is the Commission’s reading of the law: on children’s privacy, a setting that a 13-year-old can switch off in seconds is not, in Brussels’ view, a protection at all.

Get the TNW newsletter

Get the most important tech news in your inbox each week.