EU Tells TikTok: Kids' Privacy Settings Shouldn't Require Opting In

The European Commission has put TikTok on notice over how it handles young users, releasing preliminary findings under the Digital Services Act that call out specific gaps in the platform's child safety defaults.

At the center of the complaint: TikTok's approach to minors' "public" accounts. Right now, content posted by teens on public accounts can end up in front of far more people than the teen likely intended, including through TikTok's For You recommendation feed. The Commission wants that changed so posts from minors' accounts are visible only to the specific users a teen has chosen to share with, and are excluded from being pushed out algorithmically to strangers.

Even TikTok accounts set to private aren't fully shielded, according to the findings. The Commission notes that private accounts can still be surfaced through other users' "following" lists, and that profile photos remain visible to anyone regardless of privacy settings. In other words, a teen who thinks they've locked down their account may still be discoverable and identifiable to people they never approved.

The message from Brussels is that stronger protections shouldn't require minors to go digging through settings menus to turn them on. EU tech chief Henna Virkkunen made that point directly in the Commission's announcement: "Minors deserve a safe experience from the moment they go online. The Digital Services Act requires platforms to build protections for minors into the design of their services, and holds them to account when they fail to do so." She added, "A high level of protection should not be an opt-in; it should be the default. This is our responsibility for current and future generations of European children."

What happens if TikTok doesn't comply

These are preliminary findings, not a final ruling, which gives TikTok a chance to respond and adjust its practices. But the stakes for ignoring them are real. If the Commission ultimately decides TikTok hasn't addressed the concerns, it can issue a formal DSA non-compliance decision, which carries the potential for fines of up to six percent of the company's global annual revenue. The DSA, the EU's core law governing how online platforms manage content and user safety, has increasingly become the bloc's primary lever for pressuring large platforms on issues ranging from disinformation to, now, child protection design choices.

Not the only regulator circling

TikTok is facing scrutiny on multiple fronts at once. The UK's communications regulator, Ofcom, opened its own child safety investigation into the platform last week, with the first updates expected in October. Separately, the European Commission is still running a distinct probe into TikTok's recommender system and what regulators describe as its "rabbit hole effect," the concern that the app's algorithm can pull younger users into increasingly narrow or compulsive content loops. That investigation remains open, and today's findings on account privacy are a separate track from it.

Taken together, the pattern is a regulatory environment closing in on the same core question from several directions: whether TikTok's design choices, not just its content moderation, are putting minors at risk by default. The EU's emphasis on "opt-in" versus "default" gets at something regulators have pushed on across the tech industry more broadly, the idea that safety features buried in settings menus don't actually protect the users who need them if those users never find or use the toggle.

For TikTok, the immediate task is responding to the Commission's specific asks: tightening who can see minors' public content, cutting that content out of algorithmic recommendation, and closing the loopholes that make even private accounts discoverable. How the company responds, and whether the Commission judges that response sufficient, will determine whether this becomes another case study in EU tech enforcement or a rare instance of a platform getting ahead of a fine.