The European Commission announced on Friday that TikTok had not adequately protected the privacy of minors on its platform, allowing adult users to view the accounts of children. The finding marks another escalation in Brussels' ongoing regulatory pressure on major technology firms under the Digital Services Act (DSA).
According to the Commission, the failure exposed children to cyberbullying, unwanted contact, and predatory behavior. The investigation, launched in February 2024 after TikTok was designated a Very Large Online Platform under the DSA, has now produced its second adverse finding against the Chinese-owned company.
Growing List of Violations
This is not the first time TikTok has run afoul of EU rules. In February, the Commission found that the platform's addictive design—including features like autoplay and infinite scroll—could harm the physical and mental health of users, particularly minors. TikTok rejected those findings at the time, calling them "categorically false."
Beyond the DSA, TikTok has faced significant penalties under the EU's General Data Protection Regulation (GDPR). In 2023, Ireland's Data Protection Commission fined the company €345 million for allowing accounts for children under 13 and failing to adequately safeguard their data.
The latest finding gives TikTok an opportunity to respond. If the Commission remains unsatisfied, it could issue a non-compliance decision and impose a fine of up to 6% of the company's total annual revenue. Given TikTok's global revenue—estimated at over $16 billion in 2023—such a penalty could reach nearly $1 billion.
The DSA, which came into full effect in February 2024, requires very large online platforms to conduct annual risk assessments and take measures to protect minors. The Commission has been actively enforcing the law against several tech giants, including Meta and Apple, in what has become a global benchmark for digital regulation.
TikTok's challenges in Europe extend beyond privacy and addiction concerns. The platform has also faced scrutiny over its content moderation practices, particularly regarding disinformation and political advertising. The company has repeatedly stated its commitment to complying with EU laws, but the accumulating findings suggest a persistent gap between its policies and regulatory expectations.
For European parents and policymakers, the case underscores the difficulty of enforcing child safety measures on platforms designed for viral engagement. The Commission's investigation continues, and the outcome could set a precedent for how the DSA handles similar cases involving other social media companies.
