170M EU Users Exposed: TikTok's Default Settings Fail Minors' Privacy, EU Says

For cybersecurity professionals, the EU's findings reveal a fundamental product security flaw: default privacy configurations designed for engagement rather than protection create an attack surface for grooming, cyberbullying, and predatory behavior. With 7% of children aged 12–15 spending 4–5 hours daily on the platform, the scale of exposure is vast, and the technical remedy—effective default privacy—is a clear indication of how design choices can either mitigate or amplify digital threats to vulnerable populations.

On July 24, 2026, the European Commission formally announced that TikTok had violated the Digital Services Act (DSA) by failing to adequately protect the privacy of minors on its platform. The findings center on privacy default settings that permitted adults to view the profiles and content of users under 17, directly contradicting the DSA’s mandate for robust safeguards for children online. Thomas Regnier, Commission spokesperson, was unequivocal: “Children’s content must never be visible to strangers.” The infractions are twofold: children aged 13 to 15 can “easily” switch their accounts from private to public, while the private accounts of 16- and 17-year-olds are visible to anyone on the internet. This systemic vulnerability, according to the Commission, exposed minors to grooming, cyberbullying, and predatory behavior—a failure deemed unacceptable under EU law.

“

While TikTok’s exact global revenue is not publicly broken out by the company, industry estimates place ByteDance’s 2025 revenue well above $100 billion.

The development is the latest in a series of aggressive enforcement actions by Brussels, which has positioned itself as the world’s leading tech regulator. Meta and Apple have faced their own DSA proceedings, but TikTok’s case now carries particular weight given its enormous user base in the bloc: an estimated 170 million users, the majority of whom are children. The Commission highlighted alarming usage patterns, noting that 7% of children aged 12 to 15 spend four to five hours daily on the app. This scale raises the stakes significantly; any penalty will be calculated as a percentage of the company’s global annual revenue, capped at 6%. For ByteDance, TikTok’s parent, this could translate into billions of dollars.

The earlier DSA ruling against TikTok in February 2026—targeting “addictive design” features like autoplay and infinite scrolling—set a precedent that the platform’s design choices prioritize engagement over user welfare. The current privacy findings deepen that regulatory arc, suggesting a pattern of systematic non-compliance with Europe’s digital safety framework. Regnier stressed that “putting default settings for minors is not a beauty contest under the DSA. It must be effective,” signaling the Commission’s intolerance for cosmetic fixes. The technical remedy required is straightforward: ensure that minors’ accounts are private by default, with no easy toggle to make them public, and that even private accounts are shielded from strangers’ views.

The potential financial penalty is formidable. While TikTok’s exact global revenue is not publicly broken out by the company, industry estimates place ByteDance’s 2025 revenue well above $100 billion. A 6% fine would therefore be a multibillion-dollar sanction, dwarfing many GDPR fines and rivaling the record penalties seen in antitrust cases. Beyond the monetary impact, a non-compliance decision could compel design changes that alter the platform’s virality and engagement mechanics, possibly affecting its commercial model.

TikTok’s immediate response has been conciliatory but guarded: “Protecting minors online is a goal we share, and we are committed to building on our strong track record of continuous improvement.” The company has the opportunity to present its defense before the Commission finalizes its decision. If the response is insufficient, the EU can issue a non-compliance decision and impose the fine. The procedural timeline remains fluid, but the findings themselves are a definitive regulatory statement that will influence how other platforms design age-appropriate experiences.