European Commission finds TikTok violated child privacy protections under Digital Services Act
The European Commission has determined that TikTok failed to adequately safeguard children's privacy on its platform, exposing minors to cyberbullying and predatory behavior. The Chinese-owned social media giant now faces potential fines of up to 6% of its global revenue.
EU Finds TikTok Violated Child Privacy Protections Under Digital Services Act
The European Commission announced Friday that TikTok has violated the European Union's Digital Services Act by failing to protect the privacy rights of children using its platform, allowing adults unrestricted access to view minors' accounts and content.
The preliminary finding exposes significant deficiencies in TikTok's child safety measures, with commission spokesperson Thomas Regnier stating that the platform's inadequate privacy controls leave children vulnerable to cyberbullying, unwanted contact and predatory behavior from strangers.
Privacy Settings Fall Short of Legal Requirements
According to the commission's investigation, TikTok's default privacy settings for young users fail to meet the standards established under Article 28 of the Digital Services Act, which requires online platforms accessible to minors to adopt appropriate and proportionate measures ensuring a high level of privacy, safety and security for children. The regulation also prohibits targeted advertising based on profiling when platforms are aware with reasonable certainty that the user is a minor.
Regnier emphasized that children aged 13 to 15 can easily switch their accounts from private to public settings, while private accounts belonging to users aged 16 to 17 remain visible to anyone on the internet. The commission published specific guidelines on minor protection under the DSA in July 2025, setting clear expectations for platforms to implement measures safeguarding young users.
Children's content must never be visible to strangers. If TikTok does not take steps called for by the European Union's landmark Digital Services Act, minors are exposed to predators, to grooming and to cyberbullying.
The finding marks the second preliminary breach determination against TikTok this year. On February 6, 2026, the commission found the platform violated the DSA through addictive design features including infinite scroll, autoplay, push notifications and highly personalized recommender systems that could harm the physical and mental health of users, particularly minors.
Substantial Financial Penalties Loom
TikTok now has an opportunity to respond to the commission's findings and demonstrate corrective measures. If the EU executive body remains unsatisfied with the company's response, it could issue a formal non-compliance decision carrying fines of up to 6% of TikTok parent company ByteDance's total annual revenue. Based on ByteDance's approximately $186 billion in revenue for 2025, such a penalty could reach roughly $11 billion.
Beyond the potential one-time fine, the DSA's enforcement framework allows for periodic penalty payments of up to 5% of average daily worldwide turnover for each day a company delays complying with commission orders, meaning financial consequences could accumulate rapidly for continued non-compliance.
The commission's enforcement approach gained precedent in December 2025 when it issued its first major DSA fine, imposing €120 million on social media platform X for violations including deceptive use of verification checkmarks.
Widespread Impact on European Youth
The commission estimates that most of TikTok's 170 million users across the 27-nation European Union are children. According to the regulatory body, 7% of children aged 12 to 15 spend four to five hours daily on the platform. Survey data indicates even higher engagement rates among teenagers, with 8% spending nearly five hours per day on TikTok and 22% using the app for two to three hours daily.
TikTok has been subject to DSA obligations since August 2023, when the regulations took effect for Very Large Online Platforms following their designation in April 2023. The platform has had over two years to implement compliant privacy protections for minors.
In a statement, TikTok said it would review the commission's findings and continue constructive engagement with Brussels regulators. The Chinese-owned firm, whose parent company ByteDance is based in Beijing, emphasized its commitment to protecting minors online.
Protecting minors online is a goal we share, and we are committed to building on our strong track record of continuous improvement.
The commission's action represents the latest chapter in Brussels' leadership role regulating major technology companies, with the EU having previously taken enforcement actions against other tech giants including Meta and Apple under various digital regulations.
