The findings
On 24 July 2026, the European Commission sent TikTok preliminary findings that the platform's handling of minors' accounts breaches the Digital Services Act (DSA). The Commission says 13-15-year-olds can flip their accounts from private to public with minimal friction, while 16-17-year-olds' accounts are public by default — visible not just to other TikTok users but to anyone browsing the web without logging in. Content from those older minors is also pushed into the algorithmic For You feed, meaning a 16-year-old's video can reach a global, anonymous audience without the teenager taking any additional action. Even minors who keep accounts private aren't fully shielded: the Commission notes their profiles can still surface through other users' follower and following lists, and profile photos remain publicly visible regardless of privacy settings (European Commission; JURIST).
The case rests on Article 28(1) of the DSA, which requires platforms accessible to minors to provide "a high level of privacy, safety and security" for child users. The Commission is applying that requirement through its own non-binding Guidelines on the Protection of Minors, published 14 July 2025, which specifically recommend that platforms set minors' accounts to private by default so that personal data and content are hidden from people the minor hasn't accepted, precisely to reduce unsolicited contact from strangers (European Commission Guidelines). TikTok now gets to examine the Commission's evidence file and respond in writing; the European Board for Digital Services will also be consulted before any final decision. If the findings are confirmed, TikTok faces a formal non-compliance decision, mandatory design changes, and fines of up to 6% of ByteDance's global annual turnover (TNW).
The case for intervention, stated fairly
The strongest version of the Commission's case doesn't require assuming bad faith. A 16-year-old whose account is public by default, and whose posts can be algorithmically surfaced to strangers worldwide, has effectively been opted into a level of exposure that most parents — and most 16-year-olds, if asked in advance — would not choose. The harms the Commission cites (unwanted contact, cyberbullying, and the risk that content posted as a teenager stays discoverable into adulthood) are well documented and not hypothetical. TikTok has roughly 169.7 million users across the EU, a meaningful share of them minors, so a default-visibility setting isn't a marginal design choice — it determines the baseline exposure of a very large number of children (JURIST). Reasonable regulators can conclude that where a platform nudges users through defaults, the safest default should be the one that requires an affirmative, informed choice to leave — not the reverse.
Where the proportionality argument bites
Even granting that framing, the case sits on a thinner legal foundation than the fine at the end of it suggests. Article 28(1)'s "high level of privacy, safety and security" is a broad standard, and the Commission is giving it concrete content through Guidelines that are explicitly non-binding — a soft-law instrument the Commission itself describes as "proportionate and appropriate" measures rather than fixed rules. Using a document with no formal legislative process behind it as the operative benchmark for a fine that can reach 6% of a global conglomerate's turnover blurs the line between guidance and law in a way that leaves platforms genuinely uncertain what compliance requires until the Commission tells them, after the fact, that they got it wrong. That's a due-process problem independent of whether TikTok's defaults were, on the merits, too permissive.
There's also a real design tension the Commission's remedy doesn't resolve: enforcing stricter defaults reliably pushes platforms toward more aggressive age verification, which means collecting more identity data on minors, not less. The Commission's own Guidelines call for "robust age verification or estimation," but robust age assurance is itself a privacy-invasive undertaking, and the DSA and GDPR are in tension here that Brussels has not squared. A platform trying to satisfy one obligation (verify age reliably enough to apply the right defaults) can end up violating the spirit of the other (minimize data collected from children). None of that excuses TikTok's default settings for 16-17-year-olds, which are hard to defend as this case is described — content pushed to a global feed by default is not a proportionate design choice for a minor's account. But it argues for a narrower remedy: fix the defaults and the algorithmic promotion of minors' content, and stop there, rather than treating this case as a template for expansive mandatory age-verification regimes that carry their own privacy costs.
What to watch
This is not TikTok's first DSA scrape with Brussels — the Commission opened its broader investigation into the platform's addictive design, ad transparency, and researcher access in February 2024, and has pursued parallel child-safety proceedings against Meta's Instagram and Facebook on similar grounds (TNW). The near-term question is procedural: how TikTok's written response and the European Board for Digital Services consultation shape the final decision. The more consequential question is whether the Commission treats a fix to account defaults as sufficient, or uses this case to push the industry toward mandatory age verification at scale — a much bigger intervention that deserves its own proportionality debate, not one bootstrapped from a case about default privacy settings.