The European Commission has issued preliminary findings that TikTok does not comply with requirements under the EU’s Digital Services Act (DSA) concerning minors’ privacy. The Commission says TikTok’s systems for accounts used by children are not effective at preventing strangers or adults from viewing minors’ profiles. According to the Commission, the practical effect is that default or easily changed settings can leave minors’ content visible to people they have not authorized.

The Commission links the privacy shortcomings to potential harms, including cyberbullying, unwanted contact, and grooming. It says children aged 13 to 15 can easily change their accounts from private to public, and that private accounts for older minors (16 to 17) can still be seen by anyone online.

TikTok has been given an opportunity to respond to the Commission’s findings. If the Commission is not satisfied with TikTok’s reply, it can issue a non-compliance decision and impose a fine of up to 6% of the company’s total annual revenue. The investigation follows earlier EU enforcement actions against TikTok, including a February finding related to “addictive design” features that could affect users’ and minors’ well-being.