The European Commission has formally charged TikTok with failing to adequately protect minors on its platform, a move that could result in fines reaching €9.8B—equivalent to 6% of the company's global annual revenue. The preliminary finding, delivered to ByteDance on July 24, 2026, marks a critical test of Europe's Digital Services Act (DSA) and shifts enforcement focus squarely onto how social networks design their products for adolescent users.
Why This Matters:
• Fines of up to 6% of global turnover could be imposed if violations are confirmed, potentially the largest penalty yet under the DSA.
• Default privacy settings for minors aged 16–17 remain optional, not mandatory, exposing teens to cyberbullying and predatory contact.
• Proposed EU-wide age limits for social media access are expected after the summer, potentially restricting use for under-16s across the bloc.
• Italy-based families and educators now have regulatory backing to demand stricter controls from platforms accessible to children.
The Core Allegation: Design That Exposes, Not Protects
Brussels contends that TikTok's current account architecture violates Article 28 of the DSA, which mandates that platforms accessible to minors provide a high level of privacy, security, and data protection by default. The Commission's investigation, launched in February 2024, drew on platform audits, internal documents, interviews with law enforcement, and consultations with child protection experts and neuropsychologists.
The Italy Ministry of Innovation, like its counterparts across the EU, has expressed concern that even well-intentioned safety features can be circumvented with minimal effort. TikTok automatically sets accounts for users aged 13–15 as private, a step the Commission acknowledges as progress. But for those aged 16–17, the platform leaves the decision to the user—offering a public profile option at sign-up that can make content visible to anyone, including non-account holders.
Even when minors select a private account, the Commission argues, vulnerabilities remain. Profile images stay publicly accessible, and user profiles can be easily located via the "following" and "follower" lists of other accounts. Most critically, content from older teens can be amplified through TikTok's algorithmic "For You" feed, the engine of the platform's engagement and growth model—a design choice Brussels sees as fundamentally at odds with child safety obligations.
What This Means for Residents
For families, teachers, and policymakers across Italy, the enforcement action represents a shift in accountability. The burden of safeguarding children online is moving from individual households to the platforms themselves. Henna Virkkunen, the EU's technology chief, framed the issue bluntly: "A high level of protection should not be an option to activate, but the default setting. This is our responsibility to present and future generations of European children."
The Italy Data Protection Authority and consumer advocacy groups have long urged stronger age verification and content moderation. The Commission's preliminary finding now offers legal leverage for national regulators to demand compliance. If confirmed, TikTok would be required to:
• Restrict default visibility of minor-generated content to approved followers only.
• Exclude minors from algorithmic recommendation systems such as the "For You" feed.
• Prevent external access to content published by users under 18.
These changes would fundamentally alter how the platform operates for millions of European teens, including those in Italy, where TikTok has become a dominant social media channel among secondary school students.
TikTok's Defense: Security by Design, With Room to Improve
A TikTok spokesperson responded that the platform already equips younger users with "over 50 pre-set privacy and security features" developed in consultation with child safety experts. The company emphasized that users under 18 cannot use direct messaging or have their content surfaced in the "For You" feed without explicit consent.
"Child protection online is a goal we share, and we remain committed to continuously improving the measures we adopt to protect them," the spokesperson said, adding that TikTok would review the preliminary conclusions and continue constructive engagement with the Commission.
However, senior EU officials remain unconvinced. One high-ranking source told reporters that while TikTok's measures represent "a step in the right direction," they are "too easy to circumvent." The official pointed to the platform's business model as the underlying tension: limiting content distribution for minors would undermine the recommendation algorithm that drives user engagement and advertiser revenue. "There is a business case behind these choices," the source noted. "These are gaps in the safety net that should be designed with adolescent accounts in mind."
The Broader Regulatory Landscape
The TikTok case is one of several high-profile DSA enforcement actions targeting major social platforms. In May 2025, the Ireland Data Protection Commission fined TikTok €530M for inadequate data protection and unauthorized transfers of European user data to China. In October 2025, the Commission preliminarily found both TikTok and Meta in violation of transparency obligations, specifically the duty to grant researchers access to public data for studying user exposure to illegal or harmful content.
In December 2025, TikTok closed one investigative track by accepting binding commitments on advertising transparency. But separate proceedings continue, examining the platform's use of addictive design features—such as infinite scrolling, autoplay, and push notifications—and its age verification mechanisms.
Meta faces parallel scrutiny. In October 2025, Brussels issued preliminary findings that Instagram and Facebook's recommendation systems pose risks to minors. The Commission is also investigating whether Meta's platforms employ design tactics that foster compulsive use among children and adolescents.
Meanwhile, X (formerly Twitter) was fined €120M in December 2025 for non-compliance with DSA rules, marking the first formal enforcement decision under the law. AliExpress received an even steeper penalty—€550M—for failing to prevent the sale of illegal, counterfeit, and dangerous products.
Global Momentum Toward Age Restrictions
Europe is not alone in tightening controls on minors' social media access. France became the first EU member state to legislate an outright ban, prohibiting users under 15 from accessing certain platforms starting July 2026. The law requires platforms to delete existing accounts by late 2026 but leaves the choice of age verification technology to the companies.
The United Kingdom's Online Safety Act 2023, in force since July 2025, mandates highly effective age verification systems to block children from accessing pornography and content promoting self-harm, suicide, or eating disorders. The UK government has also signaled its intention to introduce a 16-year minimum age for social media access by early 2027.
Australia implemented similar restrictions in December 2025, requiring platforms to take "reasonable measures" to prevent users under 16 from creating or maintaining accounts, with penalties of up to A$49.5M for systemic non-compliance. Canada followed suit in June 2026 with the Safe Social Media Act (Bill C-34), setting a baseline age of 16 unless platforms can demonstrate robust safeguards.
Italy, through its participation in EU-wide policy, is expected to align with any new bloc-wide standards. The Commission has indicated it will table a formal proposal after the summer to establish a harmonized European age limit and verification framework for social media access.
The Privacy Paradox: Verification Without Surveillance
One persistent challenge in age enforcement is balancing accuracy with privacy. Traditional verification methods—such as uploading identity documents—raise concerns about data security and misuse. The European Union's Digital Identity Wallet (EUDI Wallet), set to roll out by the end of 2026, offers a potential solution. The wallet will allow minors to present an age attestation issued by a public authority, which platforms can verify using zero-knowledge proof (ZKP) technology—confirming age without accessing the user's full identity.
Ireland has begun piloting a government-backed digital wallet that sends platforms a simple "yes/no" confirmation of age eligibility, without sharing sensitive personal data. Similar systems are under consideration across the EU, including in Italy, where privacy advocates have long opposed invasive data collection by private companies.
What Happens Next
TikTok now has the opportunity to review the Commission's case file and submit written observations. The investigative process, which includes multiple tracks beyond minor safety—such as algorithmic amplification, data access for researchers, and the "rabbit hole" effect of recommendation systems—remains ongoing.
If the preliminary findings are upheld, the Italy Revenue Department and other national authorities could enforce collection of fines. The 6% cap would apply to TikTok's worldwide turnover, with the maximum penalty reaching €9.8B based on the company's global revenue—a figure that would significantly exceed previous DSA sanctions.
For Italy-based users, parents, and educators, the case underscores a broader regulatory shift: the expectation that digital platforms, not families alone, bear primary responsibility for creating safe online environments. Whether that principle translates into enforceable, effective protections will depend on how rigorously Brussels—and national regulators—hold the world's largest social networks to account.
