TikTok in breach of DSA for failing to provide account safety features for minors

The European Commission has sent its preliminary findings to TikTok, indicating that the account settings of child users fail to meet the high privacy, safety, and security standards required under the Digital Services Act (DSA). 

During its investigation, the Commission found that minors can set TikTok accounts to public, exposing their content to non-registered users and allowing material from 16- and 17-year-olds to be recommended on the For You Feed. The Commission warned these features create risks of cyberbullying, unwanted contact, and lifelong reputational harm. Furthermore, even with privacy settings on, the profile photos of minors remain accessible to anyone, and their accounts can be located via followers lists.

In its findings, the Commission recommends that TikTok change its default settings for minors so that their content is visible only to known users, access to global audiences beyond the platform is restricted, and it stops recommending posts from minors.

TikTok now has the opportunity to examine the investigation files and respond in writing. If the preliminary findings are confirmed, the Commission may issue a non-compliance decision, which could result in periodic penalty payments or a fine. 

Training Announcement: The IAPP Certified Information Privacy Technologist (CIPT) is a privacy-focused IT professional certification from the IAPP that addresses data protection requirements and controls in complex technical environments. It explores the data lifecycle, privacy risk models and frameworks, the principles of Privacy by Design, and the role of privacy-enhancing technologies within the organisation. Find out more.