The European Commission has launched formal proceedings against TikTok, accusing the ByteDance-owned platform of systematically failing to protect children from exploitation and harm. In findings announced on July 24, EU regulators detailed how TikTok's default account settings create multiple avenues for vulnerable young users to be targeted by predators, their personal content harvested for cyberbullying, or exposed to inappropriate contact from strangers across Europe.
At the heart of the Commission's complaint lies TikTok's permissive approach to profile visibility. The platform allows children to maintain public accounts by default, meaning anyone — whether they have a TikTok account or not — can view content posted by minors. This architectural choice stands in direct violation of the EU's Digital Services Act, which mandates robust built-in protections for child users. The Commission argues that this exposure creates a gateway for potential predators to identify and contact children, while simultaneously enabling malicious users to appropriate minors' content for bullying campaigns without restriction.
Beyond visibility concerns, TikTok's recommendation algorithm compounds the risk. The Commission specifically criticised the platform for using its powerful algorithmic engine to actively promote content created by users aged 16 and 17 to other accounts. This practice extends the reach of teenage creators beyond their intended audiences and amplifies their exposure on a global scale. Additionally, the Commission found that TikTok makes private accounts overly discoverable through its search and recommendation functions, undermining teenagers' ability to control who encounters their digital footprint even when they attempt to restrict visibility.
The regulatory action reflects mounting European concern about social media's impact on child safety and wellbeing. European Commission Vice President Henna Virkkunen underscored that protection standards should be embedded into platform design from inception, not offered as optional add-ons. She stated that minors deserve safe online experiences by default, and that companies must be held accountable when their systems fail to deliver this standard. This framing signals a fundamental shift in how Brussels views platform responsibility — moving from self-regulation towards mandatory design requirements with teeth.
For TikTok, the stakes are substantial. The Commission now expects a formal written response to its allegations, and if regulators ultimately conclude the platform has breached EU law, they can impose financial penalties reaching six percent of the company's global annual revenue. For a major technology firm, such fines represent severe consequences beyond the monetary impact, triggering operational reviews and potential forced redesigns of core features.
TikTok operates at an extraordinary scale within Europe, serving over 200 million users, with particularly heavy usage concentrated among adolescents and young adults. The platform's popularity among younger demographics amplifies the stakes in any child safety investigation, as does the timing. The Commission had already raised concerns in February about TikTok's potential to foster addictive behaviour through its design, suggesting a pattern of findings questioning the platform's approach to youth users.
This European investigation arrives alongside growing momentum across individual member states for more aggressive intervention. France pioneered a regulatory approach by becoming the first EU nation to legislate a blanket social media ban for users under 15. The French parliament enacted this law with overwhelming support on July 21, immediately before the Commission's TikTok findings were published. European Commission President Ursula von der Leyen has previously expressed support for age-based restrictions, signalling potential future harmonisation of such policies across the bloc.
For Malaysia and Southeast Asia, these European regulatory developments carry strategic implications. While EU rules do not directly apply in the region, they establish precedent and demonstrate feasibility of meaningful platform regulation. Regulators across Asia are watching closely as the EU implements the Digital Services Act framework, which imposes the world's most comprehensive obligations on social media giants. Malaysia's own regulatory conversations around child online protection and digital literacy may eventually draw on lessons — and potentially on template language — from European enforcement actions.
The investigation also reflects deeper tensions in the relationship between China and the West over technology governance. TikTok's parent company ByteDance faces increasing scrutiny in the EU, United States, and other Western democracies regarding data practices, algorithmic transparency, and content moderation. European regulators now frame child safety failures as evidence of broader governance problems, not isolated design flaws. This positions the ByteDance-TikTok relationship within a wider geopolitical contest over how digital platforms should be regulated and who controls the rules.
TikTok's response to the Commission's accusations points to the availability of privacy controls. The platform asserts that teenage accounts include over 50 pre-configured safety and privacy features automatically enabled when created. Additionally, TikTok notes that it restricts direct messaging capabilities for younger teenagers — a protection absent on many competing platforms. However, the Commission's complaint suggests these optional safeguards fail to meet the binding standards now required by European law, particularly regarding default visibility and algorithmic amplification of teen content.
The dispute underscores a fundamental philosophical divide about how digital platforms should balance user experience with child protection. TikTok appears to favour permissive defaults with available restrictions, allowing users to opt into privacy. The EU's Digital Services Act philosophy inverts this framework, requiring protection as the starting point with optional relaxation available only to users who affirmatively choose broader visibility. This shift from opt-out to opt-in protection represents a significant regulatory boundary that may reshape how all major platforms operate globally.
