On 6 November 2026 the European Commission issued preliminary findings that TikTok breached the Digital Services Act (DSA). The Commission says the 'For You' recommender system draws users into 'rabbit holes' of content about sadness, self-harm and body image. According to The Record's reporting, officials described it as the first time EU regulators have directly challenged the engagement-based recommender of a major platform. They said that, to their knowledge, it is the first enforcement action of its kind anywhere.
The strongest case for the Commission
The case for acting is serious. A feed that learns from what a distressed teenager lingers on can keep serving more of it. The Commission says the effect is cumulative: 'The more a user interacts with a certain type of content, the more TikTok's 'For You' feed algorithm recommends similar content.' It also says TikTok's own risk assessments identified some of these issues, but the company failed to analyse them properly or set adequate safeguards. That is a process failure, not a content judgment. Investigators reportedly analysed around 20,000 videos with psychologists, psychiatrists and system-design experts, and obtained internal company documents and data.
The legal hook is also narrower than critics of the DSA often assume. The Commission is the primary enforcer of the DSA's obligations on the largest platforms, including the duty to mitigate systemic risks. It is not ruling on whether any single video is lawful. It is asking whether a company that knew of a risk built reasonable defences against it. A risk-management duty of that kind is a defensible model. It is far closer to proportionate regulation than a list of banned content.
Where the case is on firm ground
Two features deserve support from anyone who values open speech.
- It does not order removals. The findings concern how content is ranked and amplified, not whether legal speech may exist. Tightening amplification of legal but distressing material is a very different act from censoring it.
- It follows due process. These are preliminary findings. TikTok can review the evidence and respond, and the Commission's own enforcement page says a provider must be given 'the opportunity of being heard on its preliminary findings' before a non-compliance decision.
TikTok's reply was blunt. It said the Commission 'has made a series of statements that are fundamentally inaccurate and distort our platform's architecture.' Those claims should be tested in the proceeding, not assumed away.
Where the remedy raises questions
The Commission wants recommendations to rest on what users explicitly say they want, rather than on implicit signals such as how long they watch a video. This is intuitive, and it echoes the long-standing policy preference for user control. But three problems should be settled before it becomes a template.
First, evidence on outcomes. Moving from implicit to explicit signals is a design hypothesis, not a proven safety measure. Users who ask for 'more of this' during a low moment may deepen the loop rather than break it. A regulator that prescribes the input to a ranking system takes on responsibility for the result. If explicit signals perform worse on wellbeing or on discovery, the cost falls on users and creators.
Second, scope creep. Nearly every recommender, from video to music to news, uses implicit behavioural signals. A principle that dwell time is suspect for TikTok will be invoked against smaller rivals, many of them European, that lack TikTok's compliance budget. The enforcement framework already covers 25 very large platforms and 3 very large search engines, and the logic will not stay confined to one company.
Third, a cumulative pile-on. The Record counts this as the third set of preliminary findings the Commission has issued against TikTok this year, after findings in February on 'addictive design features' and in July on protections for minors' accounts. The same recommender is now a subject of overlapping proceedings. Overlap makes it harder for a company to know what compliant design looks like. It also makes it harder for the public to tell whether the Commission is enforcing a standard or accumulating cases.
The fine, and why it should not be the point
The DSA caps fines at 6% of global annual turnover; the Commission's page says the amount 'must be proportionate and shall in no case exceed 6%.' The Record notes that TikTok and ByteDance do not publish global revenue, so the ceiling is hard to translate into a number. The figure matters less than the precedent. The better outcome is a negotiated, tested redesign that gives users genuine choice, not a headline penalty followed by years of litigation.
What a proportionate outcome looks like
The Commission should keep the risk-assessment theory at the centre of the case and treat explicit signals as one acceptable mitigation, not the only one. It should publish its methodology for the 20,000-video analysis so that outside researchers can replicate it. The Record reports that the Commission has also proposed a KIDS Act that would bar platforms from relying solely on engagement signals to recommend content to children. If so, Brussels is moving from case-by-case enforcement towards a statutory rule, and that rule should be written after the evidence from this case, not before it.
For platforms, the lesson is practical. Risk assessments are not paperwork. If a company's own analysis names a harm, regulators will ask what it did next. For policymakers elsewhere, the lesson is to copy the DSA's process discipline, and the evidence-gathering behind it, before copying the remedy.