Safety by default meets platform enforcement
The European Commission has preliminarily found that TikTok failed to ensure an appropriate level of privacy, safety and security for minors under the Digital Services Act. The findings focus on young users’ ability to set accounts public and the recommendation of content posted by older minors through the For You Feed.
What it could improve
The case applies child-safety duties directly to product defaults and recommendation systems. The Commission’s preliminary view is that content posted by minors should be visible only to accepted users by default. It also considers that older minors may choose broader sharing, but their content should not become globally accessible outside the platform or be recommended through the For You Feed.
What remains unresolved
Safer defaults on one platform are important, but they still depend on the service recognising the user as a child and do not create continuity across the wider Internet.
- A child using an inaccurate, borrowed or unchecked account may not receive the intended protections.
- A service needs only enough assurance to activate safeguards; it should not routinely receive the child’s identity documents or complete identity.
- Account settings do not resolve all risks from unwanted contact, persuasive design, commercial profiling or harmful recommendation patterns.
- Protection attached to one TikTok account does not automatically follow a child to another platform, game, AI service, website or signed-out experience.
- Regulators need evidence that changed defaults reduce exposure and harm in practice, including for older teenagers who exercise greater choice.
- Children need understandable controls and the ability to correct inaccurate age decisions without losing legitimate access or participation.
The Child-Friendly Internet perspective
The preliminary findings demonstrate Safe by Design in practice because they ask the platform to change its defaults, rather than requiring each child to protect themselves. The next step is a privacy-preserving way for participating services to recognise relevant child context consistently. A short-lived, purpose-limited assurance signal could activate appropriate settings without revealing identity or enabling tracking across services.
- Make child-protective settings the default and test their real-world effects.
- Use the minimum assurance needed to activate safeguards, not repeated identity collection.
- Prevent assurance signals from becoming common identifiers across platforms.
- Support increasing choice as children mature while retaining strong privacy and safety defaults.
- Connect platform duties with a wider ecosystem so protection does not end at one account boundary.
The central question
Can services apply safer defaults to the child actually using them without repeated identity checks and without limiting protection to one account or platform?