On 24 July 2026, the European Commission sent TikTok preliminary findings (“Findings”) indicating that TikTok accounts for minors do not meet the safety standards required under the Digital Services Act (“DSA”).
This article examines the legal basis for the Commission’s preliminary view, the role of its Guidelines on the protection of minors, and what the Findings mean in practice for platforms’ account settings, content visibility and recommender systems.
Article 28(1) of the DSA provides that:
“Providers of online platforms accessible to minors shall put in place appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors, on their service.”
The initial observation suggests that the provision does not prescribe particular account settings or expressly prohibit minors from holding public accounts. Instead, the provision is framed as an outcome-based obligation, thus leaving platforms with a degree of uncertainty as to which particular measures will satisfy the required standard of “high level of privacy, safety, and security of minors”.
Separately from Article 28 obligations, platforms such as TikTok are subject to the enhanced obligations applicable to Very Large Online Platforms, having been itself formally designated as such pursuant to Article 33 of the DSA. Where designated, Article 34 requires such platforms to diligently assess actual or foreseeable systemic risks, including tackling risks towards the protection of minors from negative consequences for their well-being. Saliently, such assessment must take account of the design of any relevant algorithm and where systemic risks are identified, Article 35 requires “reasonable, proportionate and effective mitigation measures, tailored to...” those specific risks.
The interaction between these overlapping but distinct obligations add a further layer of practical uncertainty as neither prescribe an example of compliant design. The measures required will ultimately depend on the particular risks presented by the platform and their effectiveness in practice.
The Findings focus on how TikTok’s account settings expose minors and their content to wider audiences. The Commission acknowledged that accounts belonging to users aged 13 to 15 are private by default and further noted that those users are able to change the setting to public, while users aged 16 or 17 can choose between having a private and public account.
A public account may make a minor’s content visible to anyone, including people without a TikTok account. Content published through the public accounts of 16, or 17-year-olds may also be recommended to any other TikTok user through their personalised video feed.
The Commission also identified risks affecting private accounts which may be easily found through other users’ “following” and “followers” lists, while minors’ profile photographs remain accessible to anyone, including people without a TikTok account.
What is particularly striking is the breadth of the Commission’s assessment, reflecting a notably holistic approach to DSA compliance and extending well beyond mere settings. Amongst other things, mechanisms relating to account discoverability, content visibility and algorithmic recommendation were all considered.
On such basis, merely offering a private-account option may not be enough if other aspects of the platform continue to make the minor or their content widely discoverable. In other words, while a minor may understand that a public post can be viewed by others, they may not appreciate the extent of how personalised recommendation system can distribute it to a far larger, and unchosen audience.
The Commission expressly relied on its Guidelines on the protection of minors (“Guidelines”) when assessing TikTok’s compliance. Its preliminary view is that the default settings applicable to minors’ public accounts should be adjusted so that their content is visible only to TikTok users whom the minor has accepted. Although older minors may retain the option of sharing content with a broader audience within TikTok, their content should “under no circumstances” be accessible to a global audience outside the platform.
The Guidelines are non-binding, and adherence to the principles set out therein is voluntary and does not itself establish compliance. Equally, departing from a particular recommendation does not automatically establish an infringement. Whilst they do not enact a categorical ban on public accounts, they do explain how the Commission interprets the DSA’s general requirements and serve as an important reference point when assessing compliance.
At the time of writing, the Findings remain preliminary. TikTok may examine the Commission’s investigation file and respond in writing while the European Board for Digital Services will be consulted.
If the Commission’s position is ultimately confirmed, it may adopt a non-compliance decision and impose a proportionate fine of up to 6% of the provider’s worldwide annual turnover in the preceding financial year.
For other platforms, the proceedings indicate that compliance is not merely a matter of making privacy settings or other controls available. Rather, the relevant question is whether the platform’s overall design maintains a high level of protection in practice.
For any additional information or assistance, relating to the DSA, do not hesitate to contact us at info@gtg.com.mt
Article written by Dr J.J. Galea and Ms. Amy Leah Barbara