EU Commission Finds TikTok in Breach of Digital Services Act Over Child Safety

Child Safety Defaults Are Now a Legal Obligation. TikTok Just Found Out.

On July 24, the European Commission issued preliminary findings that TikTok violated the Digital Services Act by failing to protect minors on its platform. The violations are specific and structural: children can set their accounts to public, and even private accounts remain discoverable through followers and following lists, visible to people who do not use the app. 1

This is the fourth DSA charge against TikTok in two years. The company has already offered concessions to settle two prior cases; a third remains open. 1

For ByteDance, the financial backdrop is crowded. Prior European penalties already exceed 875 million euros combined, including a 345 million euro fine from Ireland's Data Protection Commissioner in September 2023 for failures around children's data, and a separate 530 million euro fine over data transfers to China that the Irish High Court upheld in 2026. 2

The DSA adds a penalty ceiling those earlier cases did not carry: up to 6% of global annual turnover. 1

But the potential fine, however large, is not what makes this finding reverberate beyond ByteDance's finance department. The signal is in the Commission's framing of what counts as a violation.

EU tech chief Henna Virkkunen said it plainly: "A high level of protection should not be an opt-in; it should be the default." 1

That word, "default," is where the regulatory logic diverges from how platforms have traditionally defended themselves. The Commission is not counting how many safety toggles a product offers. It is auditing the state of the product before the user touches anything. The Commission said the DSA requires platforms to build protections for minors into the design of their services from the start, and to be held accountable when they fail. 1

A feature buried in settings that a teenager has to find and enable does not count as protection under this standard. The starting position of the product has to be safe.

TikTok pushed back. In a statement, the company said teen accounts carry "more than 50 preset privacy and safety features" and that under-18 accounts are private by default. The company also noted that younger teens cannot use direct messaging or have their content appear in the For You feed. 1

The gap between those two positions is the story. TikTok is arguing from its feature count. The Commission is arguing from a threat model: can a stranger without a TikTok account locate a child's private profile through a followers list? If the answer is yes, the defaults are not safe, no matter how many settings exist deeper in the app. The Commission recommended that TikTok adjust defaults so minors' content is visible only to users the child has accepted. 1

TikTok now has the opportunity to review the Commission's documents and respond before a final decision is issued. No fine has been determined at this stage. 2

But the compliance bar this finding establishes extends well past one company. The DSA governs every large online platform operating in the EU. ByteDance is privately held, so there is no stock ticker to absorb the market's verdict. But publicly traded peers operating under the same rules, from Meta to Snap, should read TikTok's regulatory record as a preview of their own exposure. 2

For anyone building or funding a social platform, the practical takeaway is direct. Compliance is no longer a legal review at the end of a product cycle. It is a design constraint at the beginning. The EU has decided that default privacy settings, discoverability controls, and algorithmic accountability for minors are not features to market in a press release. They are obligations to meet, enforced with fines calibrated to global revenue and an enforcement docket that keeps growing.

The platforms that treat child safety as something to architect for rather than something to patch after launch will be the ones that avoid the next set of preliminary findings. The ones that do not will find that the Commission is keeping count.