TikTok provisionally found to have failed to protect children
The European Commission has provisionally concluded that TikTok’s arrangements for protecting minors fall short of the requirements of the EU Digital Services Act. Its preliminary findings focus on the visibility and discoverability of children’s accounts and content, including through TikTok’s recommendation system and the follower and following lists of other users.
The Commission considers that public accounts operated by minors may expose children to unwanted contact, cyberbullying, grooming and other predatory behaviour. It is also concerned that children’s content can be recommended to unknown users through the “For You” feed. Even where an account is private, aspects of a child’s presence on the service may reportedly remain discoverable through other accounts.
The findings are preliminary, and TikTok will have an opportunity to examine the Commission’s evidence and respond. However, the case provides a wider compliance lesson for providers of online services used by children: protective measures should form part of the service’s default design and should not depend principally on young users understanding and adjusting privacy settings.
Although the investigation concerns the DSA, the Commission’s approach closely reflects the privacy-by-default expectations found in the ICO’s Children’s Code. UK organisations should test the experience provided to children in practice, including account creation, discoverability, profiling, recommendations, location settings and contact from other users. They should also consider whether children can readily weaken protective settings and whether any resulting friction, warning or age-assurance measure is proportionate to the risk. The development is relevant beyond conventional social-media platforms. Gaming services, video-sharing platforms, messaging applications and AI chatbot providers may all need to consider whether their services are likely to be accessed by children and whether their default settings give young users a genuinely age-appropriate level of protection.
For more information, see our course on Children’s Data – Practical Compliance for Organisations.
