The European Commission has told TikTok it is preliminarily in breach of the Digital Services Act over the way it handles children's accounts. In findings issued on 24 July 2026, Brussels objects that the platform still lets minors make their profiles public, at which point their content becomes visible even to people without a TikTok account, and that clips from 16 and 17 year olds can be pushed into the For You feed of any user at all. The potential penalty is large, up to 6 percent of TikTok's global annual turnover. Cases like this also tend to end in the same place: tighter age checks, which reach far beyond minors and touch the privacy of every user.
What the Commission actually found
The preliminary findings are narrow and specific. The Commission's objection is not that TikTok has no safety features, but that its defaults do the wrong thing. According to Brussels, a minor can set an account to public, at which point anyone, including people without a TikTok account, can see their content. Older teenagers' posts can then be recommended platform-wide through the algorithm. Regulators also said even private accounts are too easy to surface, because they show up through other users' follower and following lists.
- The default problem: minors' accounts can be public, so strangers can view their content without an account.
- The reach problem: content from 16 and 17 year olds can be recommended to any user through the For You feed.
- The discovery problem: private accounts remain findable through follower and following lists.
The Commission's proposed fix is to flip the defaults: minors' content should be visible only to followers they have accepted, and it should not be recommended outside the platform. Executive Vice-President Henna Virkkunen framed it as a design duty, saying the law "requires platforms to build safeguards into the design of their services and to answer for it when those safeguards fail." Commission spokesperson Thomas Regnier put it more bluntly: "Children's content must never be visible to strangers."
This is preliminary, not a verdict
This is also the second front the Commission has opened against TikTok, separate from an earlier February proceeding that focused on addictive design features such as infinite scroll and autoplay. It is worth being precise about the stage, because headlines tend to skip it. These are preliminary findings, essentially a formal charge sheet. TikTok can now review the Commission's file and reply in writing before any non-compliance decision is taken, a phase that can run for months. Only after that can Brussels issue a formal decision, order changes and start imposing penalties. TikTok says child protection is "a goal we share", points to more than 50 teen safety features and private-by-default settings for under-18s, and contests the Commission's legal reading. The gap between "accounts can be public" and "private by default" is exactly what the two sides will now argue over.
Why a privacy case turns into an age-verification story
Here is the mechanism that matters for readers. When a regulator tells a platform its defaults for minors are unlawful, the platform's cheapest compliant answer is to know, with confidence, which of its users are minors. That means stronger age assurance, and age assurance means checking identity or estimating age for everyone, adults included. The same logic is already visible across the continent and beyond. The UK ran a consultation on age verification that even reached VPN services, and in the US, Missouri's age-check law was followed by a jump in VPN demand. Every time an age wall goes up, some users go around it.
That is not a loophole so much as a predictable human response, and it is why child-safety enforcement and VPN usage keep moving together. Once a service has to gate content by verified age, the people locked out, teenagers first, but privacy-minded adults too, reach for a tool that changes their apparent location and hides the check from their local network. This is the pattern behind the surge in interest in tools that bypass censorship and network-level filtering whenever a major platform tightens access.
The wider European picture
The TikTok case does not sit alone. It is one more move in a broad European push to make platforms responsible for who sees what, running alongside a growing list of outright national bans on social media for minors, from Australia to the EU. Some of those measures are aimed squarely at TikTok: Indonesia, for instance, moved to ban social media, TikTok included, for children under 16. Critics of the trend, Pavel Durov among the loudest, argue that child protection is becoming the packaging for broader control over the internet. The TikTok findings are a real safety case on their merits and a data point in that larger argument at the same time.
For a regular user, the practical takeaway is not about this one platform but about the direction of travel. Content rules for minors turn into verification rules for everyone, and verification rules turn into a quiet incentive to prove who you are before you can browse. A VPN does not verify your age and it is not a way to dodge legitimate protections for children, but it does put the encryption and location of your own connection back under your control at exactly the moment when more of the internet is asking you to identify yourself first.
