The European Commission has launched a formal investigation into TikTok's compliance with strict child safety requirements, with preliminary findings suggesting the video platform has failed to adequately protect minors using its service. The Brussels-based regulator disclosed on Friday that the company risks substantial financial penalties unless it demonstrates rapid remedial action, marking an escalation in regulatory pressure on the social media giant across the Atlantic.
At the heart of the European Union's concerns lies a fundamental design flaw in how TikTok configures user accounts for children and teenagers. The platform permits young users to maintain public profiles by default, meaning that individuals without TikTok accounts—including unknown strangers—can access and view the content posted by these minors. This architectural choice directly contradicts the protective standards mandated under the EU's Digital Services Act, a landmark regulation designed to safeguard vulnerable users and enforce transparency across major internet platforms operating within the bloc.
The exposure created by these public-by-default settings introduces genuine harm risks that extend beyond abstract regulatory concerns. The European Commission explicitly warned that unrestricted visibility of children's accounts could facilitate unwanted contact from potential predators and abusers seeking to exploit young users. Beyond this threat, the platform's design also creates conditions where harmful users can easily harvest content from minors for cyberbullying purposes, weaponising the same information streams that parents and guardians might reasonably assume remain within a controlled peer group.
TikTok's algorithmic recommendation system compounds these structural vulnerabilities. The platform actively promotes content created by teenagers aged 16 and 17 to other users across its network, amplifying the visibility and reach of young creators' videos far beyond what many of these content makers may have anticipated or desired. Combined with the default public profile settings, this algorithmic amplification creates pathways for inappropriate contact and exploitation that most parents would regard as unacceptable when entrusting platforms with their children's digital presence.
The discoverability mechanisms embedded within TikTok's infrastructure further undermine child protection. Even users who attempt to secure their accounts by switching to private mode find their profiles remain easily locatable through the platform's search and discovery functions, suggesting that privacy settings function more as cosmetic controls than genuine protective barriers. This gap between user expectations and actual technical protection represents a critical failure in the platform's commitment to child safety, particularly given that adolescents may lack the digital literacy to understand that nominally "private" accounts remain discoverable and potentially targetable.
TikTok now faces a formal response deadline to address these allegations. The company must submit written rebuttal and remediation proposals to the European Commission, providing an opportunity to demonstrate either that the Commission's interpretation misunderstands the platform's actual functionality or that corrective measures can be rapidly implemented. However, the specificity of the Commission's findings—encompassing default privacy settings, algorithmic promotion, and discoverability design—suggests that superficial adjustments will prove insufficient to satisfy regulatory requirements.
The potential financial consequences for non-compliance represent a significant deterrent to corporate negligence. EU regulations permit fines reaching six percent of a company's annual global revenue when regulatory breaches are substantiated. For a platform of TikTok's scale and revenue generation, such a penalty would constitute a punishment substantial enough to reshape corporate priorities and accelerate compliance investments across major tech companies operating within EU jurisdiction.
These developments carry implications well beyond European borders. TikTok operates globally, including across Southeast Asia where the platform enjoys enormous popularity among young users. Malaysia, Singapore, and other regional nations have watched with interest as the EU enforces child protection standards that significantly exceed existing regulations in many developing markets. The regulatory precedent established in Brussels may influence eventual policy directions across Asia-Pacific, as governments increasingly recognise that technology platforms have responsibility for protecting minors regardless of geographic location.
The investigation also reflects broader European regulatory philosophy that prioritises precautionary child protection over innovation claims and platform convenience. Unlike regulators in some jurisdictions that permit platforms substantial discretion in safety design, the EU's Digital Services Act embeds explicit requirements that protect minors, establishing that technological feasibility and implementation cost cannot justify inadequate safeguards when vulnerable populations face potential harm.
For Malaysian policymakers and parents, the European Commission's findings provide valuable documentation regarding TikTok's actual technical architecture and default settings. Rather than accepting corporate assurances that child safety receives adequate attention, the detailed allegations offer empirical evidence that popular platforms may prioritise engagement metrics and advertising reach over protection mechanisms, even when serving adolescent users whose developmental stage makes them particularly vulnerable to manipulation and exploitation.
The regulatory momentum in Europe signals to global technology companies that child safety failures will trigger significant consequences. Whether TikTok responds by genuinely restructuring its safety architecture or merely implementing cosmetic changes will test whether platform operators genuinely prioritise child welfare when such prioritisation conflicts with business models built around extensive user data collection and algorithmic engagement maximisation.
