On 6 November 2026 the European Commission preliminarily found that TikTok's 'For You' feed breaches the Digital Services Act. The Commission says the so-called 'rabbit hole effect' keeps serving users personalised videos, including content about mental health struggles and body image. It says TikTok failed to properly assess and mitigate that risk, especially for vulnerable adults and minors. The finding is preliminary, and TikTok can still respond. It follows earlier preliminary findings in the same proceedings on addictive design (February 2026) and the protection of minors (July 2026).
The strongest case for the Commission
The Commission's argument deserves a fair hearing. Recommender systems are not neutral pipes. They are the product. If a feed learns that a user lingers on content about sadness or body image and responds with more of it, a design choice is amplifying a harm, and that effect compounds at scale. Executive Vice-President Henna Virkkunen put it this way, as reported by Eunews: 'Every time a user scrolls or likes a video on TikTok, the algorithm serves more of the same, leading users down rabbit holes they cannot easily escape from.'
The legal hook is also sound. The DSA (Regulation (EU) 2022/2065) requires very large platforms to assess systemic risks, including risks to mental well-being and to minors, and to put reasonable mitigation in place. The Commission describes these findings as covering 'both risk assessment and mitigation measures'. That is a test of process and of whether the response was effective. It is not a ban on personalisation.
Where the finding is strong
According to Eunews's account of the Commission's reasoning, TikTok's existing tools do not work well enough. The company uses 'dispersion' techniques and a feed-refresh function, but the Commission says the refresh 'has proved to be temporary'. It also says the measures 'do not sufficiently reduce how often similar content is recommended'. An unnamed EU official said only 0.2 per cent of TikTok users use the 'not interested' option. If that figure is right, a mitigation that almost nobody uses is a weak mitigation. Judging safeguards by whether they work in practice, not by whether they exist on paper, is the kind of evidence-based approach regulators should take.
The finding is also consistent with a procedural record. The Commission has been building this case against TikTok in stages. The July 2026 preliminary conclusions on minors, reported by Eunews, concerned default account visibility. TikTok replied that accounts for young people come with 'over 50 pre-set privacy and safety features'. Giving the company a written right of reply before any decision is the due-process step that makes this a legitimate enforcement path.
Where the risks lie
The danger is in the remedy. Eunews reports that the Commission wants TikTok to 'disable viewing time as an indicator for content recommendations', among other changes. Viewing time is one of the most basic signals in any feed. It is also a crude proxy for harm. Dwell time is as likely to reflect a user watching a cooking video or a lecture as a distressing clip. Removing it by regulatory fiat means a public authority choosing which ranking inputs are acceptable. That moves from supervising risk management toward designing the product.
Three problems follow.
- Proportionality. A design mandate applied to TikTok will be treated as a template for every very large platform, including those with very different feeds and users. The DSA is meant to produce outcomes through risk management, not to prescribe ranking signals.
- Evidence. The causal link between recommendation exposure and mental-health harm is contested in the research literature, and effects vary by user. A regulator that bans a signal should be able to show what harm it prevents, and what useful content it suppresses, such as peer support for people struggling with isolation.
- Speech. Content about sadness or body image includes recovery communities, awareness campaigns and personal testimony. A system tuned to suppress repeated exposure to a topic can't tell support from harm. Over-removal and quiet down-ranking of lawful speech are real costs, and the DSA's risk framework should weigh them alongside the harms.
What proportionate enforcement looks like
The Commission can protect users without setting a precedent that regulators specify algorithms. Four principles would help.
- Measure outcomes. Require TikTok to show, with audited data, how often users are served narrow repeated streams of sensitive content and whether mitigations reduce that. Success should be a measured result, not the removal of a particular input.
- Make user control real. If only 0.2 per cent of users use a control, the fix may be better defaults and clearer controls. Giving users easy, durable control over their own feed is less intrusive than blanket changes to ranking.
- Focus on minors. The strongest justification for stricter defaults is for children. Adults should keep room to choose what they watch.
- Be consistent. If this standard applies to TikTok, the Commission should say how it applies to every other very large platform. Selective application would invite the suspicion that enforcement tracks geopolitics, not risk.
What happens next
As Eunews reports, the European Committee on Digital Services will be consulted. If the conclusions are confirmed, the Commission may adopt a non-compliance decision. Any fine must reflect 'the nature, gravity, recurrence and duration of the infringement' and may reach 6 per cent of the provider's total annual global turnover. That ceiling makes the legal reasoning matter. A decision that sticks to process failures and shows evidence of ineffective mitigation will be defensible, including in the EU courts. A decision that mandates specific algorithmic inputs will be harder to defend and could chill product innovation across the sector.
The Commission has a legitimate case that TikTok's mitigation was inadequate. It should keep to that case and resist turning it into a general power to approve ranking systems.