EU says TikTok's child privacy settings may breach Digital Services Act

The European Commission has informed TikTok of its preliminary finding that the platform's account settings for minors fail to meet the child protection requirements of the European Union's Digital Services Act (DSA), warning that young users may be exposed to unwanted contact, cyberbullying and predatory behaviour.

The Commission said on Friday that its preliminary assessment concluded TikTok does not provide the high level of privacy, safety and security required for minors under the DSA because children's accounts and content can be viewed too broadly by other users.

If the preliminary findings are confirmed following the investigation, TikTok could face a formal non-compliance decision and a fine of up to 6 per cent of its global annual turnover, in accordance with the Digital Services Act.

The findings are not the final outcome of the investigation, and TikTok has been given the opportunity to examine the Commission's evidence and respond in writing before any final decision is made.

Public account settings raise safety concerns

According to the Commission, TikTok currently allows minors to choose a public account when registering on the platform.

For users aged 16 and 17, content posted through public accounts can be recommended to other users via TikTok's For You Feed. Public content may also be visible to people without TikTok accounts.

The Commission said these settings could expose minors to unwanted contact from strangers, facilitate cyberbullying and increase the risk of predatory behaviour.

Officials also warned that content shared during childhood may remain available online indefinitely, potentially affecting users later in life.

The Commission said public accounts effectively provide strangers with a window into a child's personal life.

Private accounts remain discoverable

The investigation also found that even minors who choose private accounts remain identifiable through the followers and following lists of other users.

In addition, profile photographs remain accessible to anyone, including people who do not have TikTok accounts.

According to the Commission, these settings continue to expose minors to unnecessary risks despite their accounts being designated as private.

Commission calls for stronger default privacy settings

Under the Digital Services Act, online platforms that are accessible to children must ensure a high level of privacy, safety and security for minors by design.

The Commission said TikTok should modify its default account settings so that content posted by minors is visible only to TikTok users whom the child has explicitly approved.

While the Commission acknowledged that older teenagers should retain the option to broaden the audience for their content if they choose, it said such material should never be accessible to a global audience outside the platform by default.

The Commission also said TikTok should stop recommending content posted by minors through the For You Feed.

Executive Vice-President for Tech Sovereignty, Security and Democracy Henna Virkkunen said online platforms have a legal responsibility to ensure children are protected from the moment they begin using digital services.

"Minors deserve a safe experience from the moment they go online," Virkkunen said.

"The Digital Services Act requires platforms to build protections for minors into the design of their services, and holds them to account when they fail to do so."

"A high level of protection should not be an opt-in; it should be the default. This is our responsibility for current and future generations of European children."

Investigation began in February 2024

The preliminary findings form part of the European Commission's formal investigation into TikTok's compliance with the Digital Services Act, launched on 19 February 2024.

The assessment follows what the Commission described as an extensive investigation involving analysis of TikTok's user interface, internal company documents and data, together with interviews involving law enforcement authorities and specialists in child protection, child abuse prevention and neuropsychology.

The Commission said it relied on its Guidelines on the Protection of Minors when assessing whether TikTok complies with its legal obligation to provide children with a high level of privacy, safety and security.

Other investigations into TikTok remain ongoing

The investigation into children's account settings forms part of a broader examination of TikTok's compliance with the Digital Services Act.

In February 2026, the Commission issued separate preliminary findings concerning what it described as TikTok's potentially addictive platform design.

The Commission had previously issued preliminary findings in October 2025 concerning researchers' access to public platform data.

A separate investigation into TikTok's advertising transparency obligations was concluded in December 2025 after the company agreed to legally binding commitments.

The Commission is also continuing to investigate TikTok's recommendation algorithms, including the so-called "rabbit hole effect", and whether minors may be exposed to age-inappropriate content because users can misrepresent their age.

TikTok could face fines of up to 6 per cent of global turnover

TikTok will now be allowed to review the Commission's investigation file and submit written observations responding to the preliminary findings.

The European Board for Digital Services will also be consulted before the Commission reaches a final decision.

If the Commission ultimately concludes that TikTok has breached the Digital Services Act, it may issue a formal non-compliance decision.

Under the legislation, any financial penalty must be proportionate to the infringement but may not exceed 6 per cent of the company's global annual turnover.