A new kind of DSA case
On 10 July 2026, the European Commission preliminarily found that Meta breached the Digital Services Act (DSA) — not because of what Instagram and Facebook allow users to post, but because of how the products are built. The investigation targets infinite scroll, autoplay, push notifications and Meta's personalised recommender systems, which the Commission says were never properly risk-assessed for their effect on users' physical and mental wellbeing, including minors and "vulnerable adults." Executive Vice-President Henna Virkkunen framed it as a health mandate: "protecting the physical and mental health of Europeans must be a priority for social media platforms."
This is a meaningful escalation. Since the DSA's very-large-platform obligations took effect in 2023, Brussels' enforcement record has been about outputs — deceptive verification badges, opaque ad libraries, blocked researcher access. Its first non-compliance fine, €120 million against X in December 2025, punished exactly that kind of behavior. The Meta case instead targets the underlying mechanics of engagement — the interface choices that keep a feed scrolling. If confirmed, Meta faces a fine of up to 6% of global annual turnover, which on 2025 revenue of roughly $201 billion could exceed $12 billion (€11 billion), by far the largest DSA exposure to date.
The steelman
Regulators have a real case to make, and it deserves to be stated plainly before it's argued against. The European Commission's own June 2026 Eurobarometer-linked survey of adolescents found that EU teens spend an average of 4.5 hours online on school days and more than 6 hours on weekends, with nearly one in three reporting they feel "stressed, sad or socially excluded" as a result of social media use, and 45% saying they compare themselves negatively to others. Nine in ten report physical symptoms — tired eyes, headaches, concentration problems — that track with heavy screen use. The DSA's Article 34 explicitly requires very large platforms to assess systemic risks to minors' physical and mental wellbeing arising from recommender-system design, not merely from illegal content flowing through it. If a platform's core interaction loop is engineered to maximise time-on-app among people who by their own account feel worse for using it, a regulator asking "did you assess that risk, and did your mitigations work" is not reaching outside its mandate. It is applying the law as written.
Meta disputes the finding. A company spokesperson said Meta already runs Teen Accounts that default to protective settings, letting parents block Instagram access overnight and cap daily use — one of several product changes made since 2024 specifically in response to regulatory and reputational pressure. That is a genuine mitigation, and the Commission's own statement acknowledges Meta has some measures in place; its finding is that those measures don't adequately address the risk the design itself creates.
Where the case gets harder to defend
The problem is that "addictive design" is not a bright-line legal category — it's a description that could plausibly apply to nearly every consumer app built around engagement, from Netflix's autoplay to TikTok's For You page to email's push notifications. The DSA gives the Commission broad discretion to decide, case by case, whether personalization and interface choices amount to an unassessed systemic risk. That discretion is precisely what makes the precedent consequential beyond Meta: any platform with a recommender system and a notification service now has reason to wonder whether its UX defaults are the next target, with no clearer test than "the Commission will tell you afterward."
There's also a causation gap the Eurobarometer data doesn't close. Correlation between screen time and self-reported distress is well documented, but the survey does not establish that infinite scroll specifically — as opposed to smartphone access generally, school stress, or the content itself — is the mechanism driving harm. A regulator imposing an 11-figure fine on a specific design choice should be able to show that changing the design changes the outcome, not just that both numbers move together.
The remedy question matters more than the fine
What happens next matters more than the headline fine number. Meta now has the right to examine the Commission's file and respond in writing before any non-compliance decision issues — the same procedural stage X passed through before its December 2025 penalty. If the Commission proceeds, its order will likely specify remedies: disabling autoplay and infinite scroll by default, mandatory break prompts, and recommender adjustments that de-weight engagement optimisation for minors. Those are more consequential than the fine itself, because they become the template other VLOPs are expected to pre-emptively adopt.
A proportionate outcome would tie remedies tightly to minors and clearly demonstrated risk pathways — mirroring the narrower, evidence-specific approach Meta itself claims to have taken with Teen Accounts — rather than treating engagement-optimised design as inherently unlawful for the general adult population. The DSA's risk-assessment framework is a legitimate response to real, measured harms to young users. Its value depends on the Commission tying its findings to that evidence with the same rigor it demands of the platforms it investigates.