The DSA requires very large online platforms to identify and mitigate systemic risks, including those related to minors' safety, as the law's framing makes explicit. The Commission's preliminary finding was that TikTok had done neither adequately. Its "For You" feed algorithm, which TikTok describes as responding to signals like follows, likes, and watch time, was found to shift users into what the Commission called "autopilot mode," reducing self-control and encouraging compulsive use, JURIST reported.

The Commission's guidelines on what platforms owe minors were already in place before the finding landed. Last July, detailed guidance under Article 28(1) of the DSA set out the concrete steps platforms must take to ensure privacy, safety, and security for young users, with more than 12 pages dedicated to age assurance alone, according to Interface research. TikTok's breach finding was issued against a defined regulatory standard, not into a vacuum.

The proposed remedies go to the product itself. The Commission stated TikTok must "change the basic design of its service... by disabling key addictive features such as 'infinite scroll' over time, implementing effective 'screen time breaks', including during the night, and adapting its recommender system," JURIST reported. That is a different ask from adding a warning label. No final decision has been issued and no fine has been calculated, but the Commission's governing principle is explicit. Executive Vice-President for Tech Sovereignty Henna Virkkunen put it plainly: "Social media addiction can have detrimental effects on the developing minds of children and teens. The Digital Services Act makes platforms responsible for the effects they can have on their users," JURIST reported.

Running in parallel is a second preliminary breach finding, issued last October, concluding TikTok had blocked independent researchers from accessing public data, according to JURIST.

The Commission found TikTok's screen-time management features were too easy for users to dismiss and introduced insufficient friction, while its parental controls required time and technical skill that most parents lack in practice, JURIST reported. The tools existed. They just didn't work as protection.

Independent research supports that verdict. A 2025 preprint that audited TikTok using 20 sockpuppet accounts, ten registered as adults and ten as minors, across more than 7,000 videos found minimal differences in harmful content exposure between the two groups during passive scrolling. When accounts actively searched using harm-adjacent keywords, roughly 28% of surfaced content was classified as potentially harmful for both adult and youth accounts, the study found. The study's classification model carried a precision rate of around 59%, which introduces uncertainty into the exact figures. The directional finding is harder to dismiss: age-based moderation produced little measurable separation between what children and adults were shown.

The sign-up layer is equally porous. Empirical testing of eight platforms most commonly used by EU minors, including TikTok, Instagram, Snapchat, and YouTube, found every one relied on self-declaration alone when a new account is created. A test account using a 14-year-old's birth date on TikTok was created without triggering any additional check beyond an email verification code, Interface found. Beneath the technical failure is a structural one: platforms show systematic non-compliance, and enforcement authorities either lack the resources or the clear mandate to sanction it consistently.

Three categories of protection are worth keeping distinct, because the Commission's intervention targets only one of them. Age checks at sign-up are weak and bypassable. Behavioural nudges like time-limit prompts exist on paper but are easy to dismiss. Structural design changes, disabling infinite scroll, restricting overnight access, restructuring the recommendation algorithm, are what the Commission is actually asking for. No major platform has yet been compelled to deliver them.

The politically dominant response to child-safety failures has been mandatory age verification. Last June, 21 ministers from 13 EU member states declared the existing framework insufficient and demanded mandatory age verification across all social networks. French President Macron had threatened a national ban on social media for under-15s if EU-level action wasn't forthcoming, Interface reported.

The evidence for age-gating's effectiveness is not strong. The Interface testing found every major platform tested relies on self-declaration, and France's own 2023 law requiring parental consent for under-15s has never been enforced, the research noted. The gap is not only technical; stricter national laws have not closed it.

Age-gating also carries a structural liability. Requiring children to submit identity documents or biometric data to access protected services means exposing them to more personal data collection in the name of shielding them from harm, EDRi argued in April. At a European Parliament hearing, youth activist Leandra Voss stated it directly: "age restrictions shift the blame away from the harmful design of the platforms. Thus they simply delay when this harm is done to people," EDRi reported. The Commission's TikTok findings implicitly back that logic. Fix the product, not the gate.

The immediate sequence runs from TikTok's formal response and any remedial steps it offers, through Commission assessment of those steps, to a final decision that could include a binding order to change product design, a financial penalty, or both. The TikTok Digital Services Act child protection case is the first time this design-regulation theory has reached a preliminary finding; how TikTok responds will determine whether it gets tested in a final decision.

The case is already influencing what comes next. Commission officials confirmed the forthcoming Digital Fairness Act may introduce stricter rules on addictive design, obligations to switch off specific manipulative features, and higher baseline protections for children as consumers, going further than the DSA's current systemic-risk framework, EDRi reported earlier this year.

Running against that momentum is the Digital Omnibus, a regulatory simplification package that a coalition of networks representing over 300 civil society organisations warned could roll back the structural safeguards the DSA and GDPR provide, EDRi reported in April. Brussels is simultaneously building its most ambitious child-safety enforcement case and debating whether to weaken the legal architecture that makes enforcement possible.

The TikTok decision, when it arrives, will land in the middle of both debates. And the DSA's design-risk framework applies to every major platform operating in the EU, not just TikTok. That is what makes the compliance path TikTok ends up taking the one worth watching, well past whatever fine gets attached to it.