The European Commission has determined that TikTok is fundamentally failing to protect children on its platform, citing serious flaws in how the app handles accounts belonging to young users. In a statement issued on July 24, Brussels regulators outlined how TikTok's default account settings create unnecessary risks for minors, exposing them to contact from strangers and leaving their content vulnerable to misuse. The findings represent a major escalation in regulatory pressure on the Chinese-owned platform and could result in unprecedented financial penalties if the company is found in breach of European law.
At the heart of the commission's concerns is TikTok's permissive approach to account visibility. The platform allows children to maintain public profiles by default, meaning anyone—even those without a TikTok account—can view their videos and interact with them. This design choice, regulators argue, creates a direct pathway for potential exploitation. The commission explicitly warned that such exposure invites unwanted contact from bad actors and dramatically increases the risk of cyberbullying, as children's content becomes freely accessible across the internet rather than restricted to a controlled network of verified friends.
Beyond account visibility, the commission identified troubling practices in how TikTok's algorithm amplifies content from young users. The platform routinely recommends videos posted by 16- and 17-year-olds to its broader user base, leveraging its recommendation engine to push teenage content to older audiences without meaningful safeguards. Additionally, TikTok's design makes private accounts surprisingly easy to discover through the platform's search and discovery functions, meaning that even teenagers attempting to restrict their visibility may find their accounts readily searchable and accessible to strangers.
Under the European Union's Digital Services Act, one of the world's most comprehensive internet regulations, platforms must embed protections for minors directly into their service architecture rather than treating safety as an optional add-on. The commission argues that TikTok's account settings violate these mandatory standards by exposing young users' accounts and content too broadly. Henna Virkkunen, the European Commission's Vice President, emphasised that robust child protection should be the default setting, not something families must actively enable. "Minors deserve a safe experience from the moment they go online," she stated, framing the issue as one of fundamental rights rather than mere corporate compliance.
The regulatory action carries substantial financial consequences. TikTok now has an opportunity to formally respond to the commission's allegations, but if Brussels ultimately determines that the company has violated EU law, fines could reach as high as six percent of TikTok's global annual turnover. Given ByteDance's estimated revenues in the tens of billions of dollars annually, such a penalty would represent a multibillion-euro sanction—among the largest regulatory fines ever imposed on a technology company.
This investigation builds on previous regulatory concerns raised against the platform. In February, the commission already published findings suggesting that TikTok's interface design could foster addictive behaviour among young users, pointing to features that encourage excessive screen time and continuous engagement. The latest allegations represent a second significant line of attack, concentrating instead on direct safety threats rather than psychological manipulation. Together, these investigations paint a picture of a platform that regulators believe has prioritised user engagement and growth over the wellbeing of its youngest users.
TikTok's popularity across Europe amplifies the stakes of this regulatory action. The platform boasts more than 200 million users on the continent and maintains a particularly strong presence among teenagers and young adults. Any mandatory changes to the platform's architecture could affect hundreds of millions of European users and set global precedents for how social media companies structure their services. The company's response, when it arrives, will likely prove influential in shaping future regulatory approaches across the European Union and potentially beyond.
The commission's action also reflects intensifying political momentum around age restrictions for social media across Europe. France recently became the first European Union member state to legislate a ban on social media use for children under 15, with parliament approving the measure by a substantial majority on July 21. European Commission President Ursula von der Leyen has previously signalled support for similar age-based restrictions, and several other EU nations are developing their own national proposals for limiting children's social media access. TikTok's regulatory failures could accelerate these trends, as policymakers use evidence of inadequate child protection to justify more restrictive approaches.
TikTok has pushed back against the allegations, with company representatives noting that teenage accounts come equipped with more than 50 pre-configured privacy and security features from the moment of creation. The company also highlighted that it restricts direct messaging capabilities for younger teenagers, a feature absent from several competing platforms. These defences, however, appear insufficient to address the commission's core concern: that default settings prioritise accessibility and engagement over child protection, and that even features presented as safeguards fail to prevent the exposure and algorithmic amplification that regulators identified.
The investigation reflects a fundamental philosophical disagreement about how platforms should approach child safety. TikTok's model treats robust protections as features users can adopt if they choose, whereas EU regulators argue that high protection standards should be mandatory by design, with no opportunity for users to opt into riskier configurations. This tension between corporate flexibility and regulatory mandates will likely define the platform's response and shape the broader future of child protection in European digital regulation. For Southeast Asian observers, the case offers important lessons about how major democracies are moving to constrain platform power, potentially signalling regulatory trends that could eventually reach the region.
