The EU’s TikTok case turns a privacy setting into a design test

A privacy default can look reassuring until a user changes it. The European Commission’s latest TikTok case asks what the platform should do after that change.

On 24 July, the Commission sent TikTok preliminary findings saying its minor-account settings may not provide the high level of privacy, safety and security required by the Digital Services Act. The finding is not a final decision. TikTok can inspect the case file, answer in writing and contest the Commission’s analysis.

The dispute is unusually concrete. It is about the boundary between an account’s chosen audience and the much wider distribution systems around it.

TikTok says accounts for users aged 13 to 17 are private by default. Its published safeguards also say content from users under 16 is not eligible for the For You Feed and that teen accounts are not suggested to adults when the relevant suggestion setting is enabled.

The Commission’s preliminary view goes further than asking whether a private default exists. It focuses on what happens when a minor selects a public account.

According to the Commission, content from a public minor account can be viewed by people who do not have a TikTok account. Posts from 16- and 17-year-olds can also be recommended to other TikTok users through the For You Feed. The Commission says that breadth may increase risks including unwanted contact, cyberbullying and predatory behaviour.

Even a private account does not disappear from view. The Commission says it can still be found through other users’ follower and following lists, while the profile photo remains visible to people outside the platform.

Those are the allegations now in the case. They should not be restated as findings by a court or as proof that a particular child was harmed.

For an adult account, “public” is often treated as a single switch: content is either restricted or open. The Commission is effectively testing whether that binary model is appropriate for minors.

Its stated position is that content on a minor’s public account should initially be visible only to TikTok users the minor has accepted. Older minors could still be offered a wider sharing option within TikTok, the Commission says, but their content should not be available to a global audience outside the service. It also says TikTok should refrain from recommending minors’ content through the For You Feed.

That separates three functions that platforms often bundle together:

1. **Account discoverability:** whether strangers can find a profile or see its photo. 2. **Post visibility:** whether a person outside the accepted audience can open the content. 3. **Algorithmic distribution:** whether the platform actively sends that content into recommendation feeds.

A setting labelled public can govern all three, or it can be designed as a set of narrower permissions. The Commission’s case is therefore less about the wording on one button than about the reach the platform attaches to it.

Article 28 of the DSA requires online platforms accessible to minors to use appropriate and proportionate measures that ensure a high level of privacy, safety and security. It does not prescribe one universal interface.

The Commission’s 2025 guidelines on protecting minors explain how it interprets that obligation. They recommend strong protections by default, but also say a minor’s account should remain safe if those defaults are changed. The guidelines are not a substitute for the legal test, and following them does not automatically settle every DSA question. They do, however, show the design standard the Commission used in this investigation.

The current case began as part of formal proceedings opened in February 2024. The Commission says its account-setting analysis included TikTok’s interface, internal data and documents, plus interviews with law-enforcement officials and child-protection experts.

In a statement reported by Eunews, TikTok said young people’s accounts start with more than 50 privacy and safety features. The company said it shares the goal of protecting children, will examine the preliminary findings and will continue engaging with the Commission.

The European Board for Digital Services will also be consulted. After TikTok responds, the Commission could revise its view, accept commitments or remedies, or issue a final non-compliance decision. If it ultimately confirms an infringement, any fine must be proportionate and cannot exceed 6% of the provider’s global annual turnover. That ceiling is not a prediction of the amount and no fine has been imposed in this account-settings case.

For users, the immediate point is just as important: a preliminary finding does not itself change an app setting. The practical signals to watch are an announced TikTok redesign, binding commitments, or a final Commission decision that specifies what must change.

The broader regulatory idea is that a default is only the first layer of safety. If a young user can move from private to globally visible in one step, or if visibility automatically activates recommendation, the platform still has to justify the resulting design under the DSA.

TikTok is the company in this proceeding, but the product question is general: should “public” mean searchable, viewable outside the service and algorithmically promoted all at once for a minor? The Commission has stated its preliminary answer. The remaining process will determine whether that answer becomes an enforceable one.