EU Escalates TikTok Probe Over Lack of Teen Privacy Protections

The European Union escalated a probe against TikTok under its content moderation rulebook, accusing the social network of failing to protect the safety and privacy of teen users.

The EU’s executive branch, the European Commission, on Friday announced preliminary findings against the ByteDance-owned platform under the Digital Services Act, or DSA. The commission said TikTok’s custom accounts for users under 18 can be easily found and viewed by other people online.

Teen users’ profile photos “remain accessible to anyone, including users without a TikTok account,” the commission wrote in a statement on the decision. “TikTok’s settings continue to expose them to risks – including unwanted contact, cyberbullying, or predatory behavior.”

DSA guidance stipulates that children’s accounts on social media platforms shouldn’t be viewable by people outside their networks.

TikTok “teen accounts” feature has 50 privacy and safety settings that have been vetted by experts, according to a company spokesperson. The company’s policies state children’s accounts are private by default.

“Protecting minors online is a goal we share, and we are committed to building on our strong track record of continuous improvement,” the spokesperson said. “We will review these preliminary findings as we continue to engage constructively with the Commission.“

The decision ramps up the EU’s wide-ranging investigation into TikTok, launched in February 2024. TikTok will be able to defend itself, including by proposing measures that address the commission’s concerns. Failing that, it might face fines, which under the DSA can reach as much as 6% of a company’s annual global sales.

TikTok is also facing two other EU probes, and separate preliminary findings targeting its alleged use of addictive design.

The DSA requires social networks and search engine with more than 45 million monthly users in the EU to meet strict standards of safety, privacy and risk-mitigation. Most big platforms have been targeted with proceedings, and some have faced fines.

In December, Elon Musk’s X was issued a penalty of €120 million ($137 million) over deceptive design and lack of transparency. In May, Chinese e-commerce platform Temu was ordered to pay €200 million for failing to remove illegal products. Earlier this week, Chinese e-commerce giant AliExpress was fined €550 million for the same breach.

While the DSA is often considered a tool to clamp down on misinformation and counterfeits, the commission has increasingly wielded the rules to pressure companies to bolster their child protection measures.