EU finds TikTok breached Digital Services Act by failing to protect minors online

The European Commission on Friday preliminarily found that TikTok breached the EU's Digital Services Act by failing to provide safe default settings for minors, exposing children to public visibility, unwanted contact, and potential predatory behavior through the platform's "For You" feed and discoverable account features.

According to the Commission, minors on TikTok can set their accounts to public, allowing any user, including those without a TikTok account, to view content from minors. This setting also allows content created by older minors (aged 16–17) to be displayed as a recommendation in the feeds of all other TikTok users. This can lead to unwanted contact and the risk of cyberbullying, giving strangers a window into a child's life.

Henna Virkkunen, the Commission's Executive Vice-President for Technological Sovereignty, Security and Democracy, stated that minors deserve a safe online experience from the moment they go online. "The Digital Services Act (DSA) requires platforms to make protective measures for minors an integral part of their services and to take responsibility if they fail to do so. A high level of protection should not be an optional feature but the default standard. This is our responsibility to the current and future children of Europe," she said.

The Commission's preliminary position is that TikTok's account settings fall short of this standard by exposing minors' accounts and content too broadly. TikTok should adjust the default settings for minors' public accounts so that their content is, by default, visible only to TikTok users approved by the minor.

If TikTok does not take steps called for by the European Union’s landmark Digital Services Act, “minors are exposed to predators, to grooming and to cyberbullying,” said commission spokesperson Thomas Regnier. He added that children aged 13 to 15 can “easily” change their accounts from private to public and the private accounts of minors aged 16 to 17 can be seen by anyone on the internet.

TikTok can now defend itself and reply to the findings. If unsatisfied with the Chinese firm’s response, the European Commission could issue a so-called non-compliance decision and possible fine worth up to 6% of the company’s total annual revenue.

The Chinese social media firm, whose parent company ByteDance is based in Beijing, said in a statement it would review Brussels’ findings and “continue to engage constructively with the Commission.” “Protecting minors online is a goal we share, and we are committed to building on our strong track record of continuous improvement,” TikTok said in a statement.

The investigation comes on the heels of back-to-back crackdowns on Big Tech by Brussels, which has led the world in regulating tech behemoths including Meta and Apple. The commission estimates most of TikTok’s 170 million users in the EU are children, with 7% of children aged 12 to 15 spending four to five hours daily on the app.

The 27-nation European Union found in February that TikTok had breached another aspect of its digital rule book with an “addictive design” of features such as autoplay and infinite scrolling that could harm the physical and mental health of users and minors especially.

Kulturstaatsminister Wolfram Weimer (parteilos) will eine europäische Eigentümerstruktur für den Onlinedienst TikTok. Es sollten die Voraussetzungen geschaffen werden, „TikTok Europa zu schaffen, also TikTok in europäische Hände zu überführen“, sagte er der „Welt am Sonntag“. Eine europäische Eigentümerstruktur sei „der wirksamste Weg, europäisches Datenschutz-, Medien- und Jugendschutzrecht durchzusetzen“.

Hintergrund sind Weimer zufolge ungeklärte Fragen zum Datenschutz und zum möglichen Zugriff chinesischer Behörden auf Nutzerdaten. „Wir wissen bis heute nicht, wohin die sensibelsten Daten unserer Jugendlichen fließen und welchen Zugriff chinesische Behörden darauf haben“, sagte er.

Der chinesische TikTok-Eigentümer ByteDance hatte im Januar eine Vereinbarung zur Gründung eines mehrheitlich in US-Besitz befindlichen Gemeinschaftsunternehmens abgeschlossen. Damit sollte ein Verbot von TikTok in den USA abgewendet und Sicherheitsbedenken von US-Politikern wegen des chinesischen Eigentümers ausgeräumt werden.

Weimer sprach sich in dem Interview mit der „Welt am Sonntag“ auch für eine Plattformabgabe aus. „Die großen Plattformen profitieren massiv von journalistischen Inhalten. Deshalb sollten sie sich auch angemessen an der Finanzierung unserer Medienlandschaft beteiligen.“ Es gebe dazu bereits einen Bundesratsbeschluss. Auch parlamentarisch sehe er gute Chancen. „Mein Ziel ist, das Vorhaben noch in diesem Jahr auf den Weg zu bringen.“

Tiktoks Hauptsitz in Europa ist in Irland. Nach eigenen Angaben speichert die Plattform die Daten ihrer europäischen Nutzerinnen und Nutzer hauptsächlich im dortigen Datenzentrum und an einem weiteren Standort in Norwegen. Das Unternehmen hat Bedenken, es leite Daten an den chinesischen Staat weiter, stets zurückgewiesen.

The EU preliminarily found TikTok at fault in exposing minors to danger online on Friday (24 July), with issues with the Chinese social media giant’s account settings possibly to result in a fine. TikTok is under investigation for the privacy settings of its 13-18 year old users, with the European Commission arguing that the Chinese firm is in breach of the Digital Services Act (DSA).

Minors above 15-years old can choose whether their account stays private, but those choosing to have a public account would have their content visible globally, even to those without a TikTok account. Users aged between 13 and 15 are also at risk despite default private settings, which the commission attributes to DSA efforts. Yet the commission took issue with the platform’s design choices, allowing the display of profile picture of under 15s even while an account is private.

The minimum age necessary to make a TikTok account is 13. Features allowing the promotion and recommendation of adolescent accounts was also included as a design issue: “all these are loopholes in the security web that should really be designed around the accounts of teens,” a commission official told the press on Friday.

The status of the EU's preliminary finding allows TikTok the right to review the commission’s evidence and reply. Should the findings be confirmed, the commission can issue a fine of up to six percent of the provider's global annual turnover - which would be up to €1.2bn based on its 2024 revenue.

Despite some safeguarding advancements being made on the platform, EU officials worry that current design concerns and privacy issues leave space for unsolicited content, cyberbullying, predators, exploitation of minors, “or even the long-lasting consequences of the fact that there may be a digital footprint of the children and minors who may not, at this point in time, fully understand their actions,” the official continued.