European Commission Finds TikTok in Preliminary Breach of Digital Services Act Over Harmful Recommendations

Key Takeaways

• Preliminary DSA Breach: The European Commission preliminarily found TikTok in breach of the Digital Services Act for failing to adequately assess and mitigate risks associated with harmful recommendations in its “For You” feed.
• Mental Health Risks: Regulators warned that repeated exposure to content involving mental health struggles and body image may harm users, particularly minors and vulnerable adults.
• Insufficient Safeguards: The Commission found TikTok's content diversification measures and user controls ineffective, with viewing time potentially outweighing users' explicit preferences.
• Algorithm Changes Sought: Regulators consider changes necessary, including greater reliance on explicit user preferences, removing viewing time as a recommendation signal and regularly testing the algorithm.
• Potential Penalties: TikTok can respond to the preliminary findings before a final decision, which could result in fines of up to 6% of the provider's total worldwide annual turnover.

Deep Dive

The European Commission has preliminarily found that TikTok breached the European Union's Digital Services Act by failing to adequately assess and address the risks posed by its recommendation algorithm, which regulators say can repeatedly expose users to content involving mental health struggles, eating disorders and body image.

The Commission said TikTok's personalized “For You” feed can draw users into harmful patterns of content consumption, known as the “rabbit hole effect,” in which watching or liking certain videos leads the platform to recommend more of the same material.

The concern is particularly serious for minors and vulnerable adults. According to the Commission, repeated exposure to content involving sadness, isolation or body image may contribute to anxiety, lower self-esteem, body dissatisfaction and the worsening of existing mental health conditions.

The findings mark another development in the Commission's ongoing investigation into TikTok's compliance with the Digital Services Act, which requires major online platforms to assess and address systemic risks associated with their services. Regulators are now questioning whether the design of TikTok's recommendation system, and the safeguards intended to limit its potential harm, meet those obligations.

The conclusions are preliminary and do not establish a final infringement. TikTok will have an opportunity to respond before the Commission determines whether enforcement action is warranted.

Commission Questions TikTok's Risk Assessments

The Commission's investigation examined how TikTok's recommendation algorithm uses information about user engagement, including viewing time and likes, to determine which videos appear in a person's feed. Regulators found that the system may reinforce exposure to potentially harmful material by treating repeated engagement as evidence that a user wants to see similar content.

A person who watches or likes several videos about weight loss or body image, for example, may receive additional recommendations on those subjects, even when the content could be triggering or harmful.

The Commission said TikTok had not adequately assessed how this process could lead users into prolonged exposure to material that may adversely affect their wellbeing.

Its preliminary findings also identified the algorithm's design as an important factor in the development of these recommendation patterns. Because the system continually adjusts its recommendations based on user behavior, repeated engagement can produce a feed increasingly concentrated on particular subjects.

The Commission warned that such exposure may have serious consequences, including increased sadness or anxiety, diminished self-esteem and the worsening of existing eating disorders or mental health conditions.

The assessment draws on an extensive investigation involving TikTok's internal documents and data, risk assessment reports, responses to regulatory information requests, scientific research and interviews with experts in recommendation systems, psychology and psychiatry.

Ireland's Digital Services Coordinator, Coimisiún na Meán, supported the Commission's investigation.

Existing Safeguards Deemed Ineffective

Beyond the shortcomings identified in TikTok's risk assessments, the Commission preliminarily concluded that the company had failed to implement proportionate, reasonable and effective measures to address the risks associated with its recommendation system.

TikTok has introduced measures intended to diversify recommended content and give users greater control over their feeds. The Commission acknowledged those safeguards but found that they did not sufficiently reduce repeated exposure to similar material, including videos concerning mental health struggles and body image.

Regulators also raised concerns about the effectiveness of TikTok's user controls, particularly the option to indicate that a person is not interested in certain content.

According to the findings, selecting the “not interested” option may not be enough to change subsequent recommendations because the algorithm can give greater weight to viewing time than to a user's expressed preference to receive less of a particular type of content.

The Commission's assessment suggests that users may have difficulty influencing their feeds even when they actively attempt to limit certain recommendations.

At this stage of the proceedings, regulators consider changes to the design of the “For You” feed necessary. The Commission identified several possible measures, including placing greater emphasis on users' explicit preferences, disabling viewing time as an indicator for recommending content, improving the accessibility and usability of user controls, and regularly testing the recommendation algorithm.

These are changes the Commission considers necessary based on its preliminary assessment, rather than requirements imposed through a final enforcement decision.

The findings place particular attention on the effectiveness of platform safeguards. Under the Commission's assessment, providing users with tools to influence recommendations is insufficient if those tools do not adequately address the risks created by the recommendation system.

Latest Findings in Broader DSA Investigation

The November assessment follows several earlier developments in the Commission's formal investigation into TikTok's compliance with the Digital Services Act. Regulators adopted preliminary findings concerning access to public data for researchers. The advertising transparency portion of the proceedings was subsequently closed through binding commitments in December 2025.

The Commission issued further preliminary findings concerning addictive design in February 2026 and the protection of minors in July. The latest findings address the potential consequences of repeated recommendations involving sensitive content, adding to the Commission's examination of TikTok's platform design and its protections for users.

Henna Virkkunen, the Commission's executive vice-president for tech sovereignty, security and democracy, said the company needed to strengthen its safeguards.

“Every time a user scrolls or likes a video on TikTok, the algorithm serves more of the same leading users down rabbit holes they cannot easily escape from,” Virkkunen said.

She added that the Digital Services Act makes platforms responsible for addressing the negative effects associated with their recommendation systems and that TikTok needed to improve protections for users, including minors.

The investigation reflects the Commission's scrutiny of the systems that determine what users encounter on major online platforms. Its findings concern the operation of TikTok's recommendation algorithm and whether the company has adequately evaluated and mitigated the risks associated with that design.

TikTok can now review documents in the Commission's investigation files and submit a written response to the preliminary findings. The European Board for Digital Services will also be consulted.

If the Commission ultimately confirms its conclusions, it may issue a formal non-compliance decision and impose a financial penalty. Under the DSA, fines can reach up to 6% of a provider's total worldwide annual turnover, depending on factors including the nature, gravity, recurrence and duration of the infringement.

The Commission emphasized that its preliminary findings do not prejudge the outcome of the investigation. For TikTok, the proceedings now turn to whether its existing assessments and safeguards adequately address the risks identified by regulators, or whether changes to the operation of its recommendation system will be required.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey