Brussels just called out TikTok on its child safety features, and the findings are glaring. European regulators revealed that the platform's basic privacy protections for young users are fundamentally broken under the Digital Services Act (DSA).
If you think this is just standard corporate red tape, think again. The European Commission pointed directly at specific structural flaws that put teenagers at risk every time they open the app. In related updates, take a look at: The Invisible Highway Beneath the Oregon Surf.
How TikTok Exposes Teen Accounts to the Open Web
The core of the issue boils down to account defaults and visibility. Regulators pointed out that TikTok allows young teenagers to flip their accounts from private to public with minimal friction. Once public, anybody—including adults without a TikTok account—can watch their videos.
For 16- and 17-year-olds, public posts enter the global For You page recommendation engine. That means total strangers get a direct view into a teenager's life, daily routines, and location, creating ripe opportunities for cyberbullying, unwanted contact, and online grooming. TechCrunch has analyzed this fascinating issue in great detail.
Default Setting Flaws -> Unfiltered Public Access -> Grooming & Harassment Risks
Even when a teenager picks a private profile, the privacy isn't real. The EU noted that private accounts still leak sensitive details. Anyone can see profile photos and trace account connections through public follower lists, even without logging in.
European Commission spokesperson Thomas Regnier put it plainly: "Children's content must never be visible to strangers."
Key Privacy Vulnerabilities Identified by EU Regulators
- Public account accessibility: Unregistered web visitors can view public videos posted by minors.
- Algorithm exposure: Content from 16- and 17-year-olds gets pushed to global recommendation feeds.
- Profile leakage: Profile pictures and follower lists remain visible even when accounts are set to private.
- Easy setting toggles: Teenagers aged 13 to 15 can easily bypass default private settings.
The Real Power of the Digital Services Act
This isn't a stern warning letter that ByteDance can archive and forget. The Digital Services Act gives European officials real power.
If TikTok fails to fix these issues during its response window, the European Commission can issue a formal non-compliance ruling. That carries financial penalties up to 6% of ByteDance's total global annual revenue. We are talking billions of dollars.
Regulators aren't asking TikTok to add opt-in toggles buried in settings menus. They demand strict, mandatory defaults.
EU DSA Mandate: Strongest Privacy by Default, Not by Option
Henna Virkkunen, Executive Vice-President for Tech Sovereignty, emphasized that high protection shouldn't be a setting kids have to hunt for—it must be the baseline state of the product.
Why Opt-In Settings Don't Protect Teenagers
Tech platforms love to talk about user choice and parent controls. In practice, that design philosophy fails kids. Teenagers want visibility, engagement, and online community. Expecting a 14-year-old to voluntarily lock down their account flies in the face of how teens use social media.
The EU's investigation pulled data from child psychologists, law enforcement experts, and internal platform metrics. The consensus is clear: default settings dictate real-world safety outcomes. When a platform makes public visibility a single tap away, kids take it without understanding the long-term digital footprint they leave behind.
What TikTok Has to Fix Right Now
TikTok needs to redesign its core user onboarding and privacy framework for underage accounts to satisfy European regulators. The era of dark patterns and friction-free public switching is over in Europe.
First, content posted by minors must be restricted by default to approved followers. Second, content from accounts belonging to under-18s should never be pushed out to unregistered web visitors or served broadly on global recommendation feeds. Third, metadata like profile photos, follower lists, and following counts on private accounts must be fully shielded from public view.
If you run an online product, manage digital strategy, or build consumer apps, the regulatory direction is obvious. Product teams can no longer build engagement loops at the expense of safety, hoping legal teams can soft-talk regulators later.
If you design digital products for a global audience, audit your privacy defaults today. Strip away public searchability for minor profiles, build strict friction against public toggles, and ensure metadata doesn't leak through side channels like follower lists. Default privacy is no longer a feature—it's the law.
