TikTok's Default Settings for Minors Fall Short of DSA's Child Safety Rules

Key Takeaways

• Preliminary DSA Findings: The European Commission preliminarily concluded that TikTok's default account settings for minors may violate the Digital Services Act by failing to provide a sufficiently high level of privacy, safety, and security.
• Default Settings Under Scrutiny: Regulators said minors' public accounts and certain features of private accounts expose children to risks including unwanted contact, cyberbullying, and predatory behavior.
• Safety by Design: The Commission said platforms should provide the strongest protections by default, including limiting the visibility of minors' content and preventing it from being recommended through the For You feed.
• Enforcement Process Continues: TikTok can now respond to the Commission's findings before a final decision is made. If the company is ultimately found to be in breach of the DSA, it could face fines of up to 6% of its global annual turnover.

Deep Dive

The European Commission said that it has reached preliminary findings that TikTok's default account settings for minors do not meet the child protection standards required under the Digital Services Act, accusing the platform of exposing young users to unnecessary risks from the moment they create an account. The findings stop short of a final decision, but they mark another significant step in the Commission's increasingly broad scrutiny of TikTok's design.

The Commission argues that TikTok's current settings leave too much of minors' lives visible to people who have no business seeing them. A child who chooses a public account can make content available not only to other TikTok users but also, in some circumstances, to people without TikTok accounts. For users aged 16 and 17, videos posted publicly may also be recommended to a much wider audience through the platform's For You feed, extending their reach far beyond any circle of friends.

That, the Commission says, creates more than an abstract privacy concern. Greater visibility increases the likelihood of unwanted contact from strangers, cyberbullying, and predatory behavior. It also raises a quieter risk that receives less attention: what teenagers publish today can remain online long after adolescence has passed, shaping reputations and identities in ways they could never have anticipated.

Choosing a private account, regulators contend, does not fully solve the problem. Even then, minors can still be discovered through the followers and following lists of other users, while profile photographs remain visible to anyone, including people who are not signed into TikTok. Privacy, in other words, becomes conditional rather than foundational.

Safety by Design

The Commission's case rests less on what children do than on what platforms choose to build. Under the Digital Services Act, services that are accessible to minors are expected to provide a high level of privacy, safety, and security by default. The accompanying Guidelines on the Protection of Minors push that principle further still, urging platforms to assume young users will not always make the safest choices and to design accordingly.

Regulators therefore believe TikTok should configure minors' accounts so that content is visible only to TikTok users the child has accepted, even when a public account has been selected. Older teenagers may decide to share more broadly within the platform, the Commission said, but their content should never be accessible to a global audience outside TikTok. Nor, according to the preliminary findings, should videos posted by minors be distributed through the For You recommendation system.

Henna Virkkunen, the European Commission's Executive Vice-President for Tech Sovereignty, Security and Democracy, said the law requires protections for children to be built into digital services rather than offered as optional settings.

"Minors deserve a safe experience from the moment they go online," she said. "A high level of protection should not be an opt-in; it should be the default."

The Commission is measuring platforms not simply by whether harmful outcomes occur, but by whether the architecture of the service makes those outcomes more likely. The design itself has become part of the compliance question.

The preliminary findings are part of the Commission's formal Digital Services Act investigation into TikTok, which began in February 2024. Officials said the assessment draws on an extensive review of the platform's interface, internal documents and data, as well as interviews with law enforcement officers and specialists in child protection, child abuse, and neuropsychology.

The Commission continues to examine TikTok's recommender systems, including what it describes as the "rabbit hole effect," along with the risk that users who misrepresent their age could be exposed to content inappropriate for minors. Earlier this year, the Commission issued separate preliminary findings concerning TikTok's potentially addictive design. An investigation into researcher access to public platform data produced preliminary findings in October 2025, while a separate advertising transparency case concluded later that year after TikTok offered binding commitments.

TikTok will now have the opportunity to review the Commission's investigative file and respond in writing before any final decision is reached. The European Board for Digital Services will also be consulted. If the Commission ultimately confirms its preliminary assessment, it may adopt a formal non-compliance decision under the Digital Services Act. That could lead to financial penalties of up to 6% of TikTok's global annual turnover. The larger consequence, however, may lie elsewhere. Europe is steadily redefining what it means for a platform to be safe, shifting responsibility away from the judgment of individual users and toward the choices software companies make long before anyone opens an account.

‍The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.