The European Commission on 24 July issued preliminary findings that TikTok has breached the Digital Services Act (DSA) by failing to ensure a high level of privacy, security, and protection for underage users. The executive body found that default account configurations allow minors—particularly those aged 16 and 17—to make their profiles public, enabling anyone, including individuals without a TikTok account, to view their content. If the infringement is confirmed, the Commission could impose fines of up to 6% of parent company ByteDance’s global annual turnover.

The Commission’s investigation, launched in February 2024, concluded that current settings expose children to “contact from potential predators, cyberbullying, and predatory behaviour.” Even when accounts are set to private, officials noted, profiles can still be located via followers lists, and profile photographs remain accessible to all. European Commissioner Henna Virkkunen declared that “a high level of protection should not be a voluntary feature but the default setting,” signalling Brussels’ insistence on systemic safeguards rather than user-dependent options.

TikTok responded by pledging to review the preliminary findings and to continue “constructive engagement” with Brussels. The company highlighted that accounts belonging to users under 18 are private by default and pointed to more than 50 pre-set privacy and safety features developed in consultation with experts. However, the Commission’s objections centre on the ease with which older minors can switch to public profiles and the fact that even private accounts are discoverable, creating what Brussels describes as a “window into a child’s life.”

The preliminary ruling is the fourth against TikTok under the DSA in under two years. Earlier probes targeted addictive design features such as infinite scrolling and autoplay, which Brussels deemed harmful to mental health, especially for younger users. The broader enforcement wave also hit Google and AliExpress with multimillion-euro fines this week, underscoring the EU’s determination to hold large platforms accountable regardless of their geographic origin. TikTok now has the opportunity to examine the Commission’s file and submit a written response. If the preliminary conclusions are upheld, a non-compliance decision could lead to a penalty calibrated to the gravity and duration of the breach.