The European Commission has formally accused TikTok of failing to protect minors from online predators, cyberbullying, and lasting reputational harm—a decision that could trigger fines reaching 6% of the platform's global revenue and force sweeping changes to how millions of young users in Malta and across the continent interact with the app.
Why This Matters:
• Default public profiles for teens aged 16-17 expose them to anyone online, even without a TikTok account
• Minors aged 13-15 can easily flip private accounts to public, bypassing safety controls
• Profile photos and follower lists remain visible even when accounts are set to private
• Violations of the Digital Services Act could result in penalties exceeding hundreds of millions of euros
The preliminary findings, issued by Brussels on July 24, 2026, center on TikTok's account visibility settings, which EU regulators say fall short of the Digital Services Act's (DSA) requirement that platforms accessible to children ensure a "high level of privacy, safety, and security by default." The investigation began in early 2024, drawing on internal TikTok documents, law enforcement interviews, and consultations with child protection experts.
The Core Accusations
Regulators identified three critical design flaws. First, TikTok permits minors to maintain public accounts, allowing their videos and profiles to be viewed by anyone—including non-users—and algorithmically promoted through the global "For You" feed. Second, even when minors set their accounts to private, their profile pictures and usernames remain publicly searchable via the follower lists of other users. Third, children aged 13 to 15 face minimal friction when toggling their accounts from private to public, despite those younger users being nominally subject to stricter protections.
The European Commission concluded that these defaults expose children to unwanted contact from predators, cyberbullying, and lifelong reputational damage from content that can remain online indefinitely. Under the DSA, which took full effect for very large platforms in 2024 and is being actively enforced in 2026, safety must be the starting point—not an opt-in feature buried in settings menus.
What This Means for Residents
For Maltese families, the ruling has immediate practical implications. If the Commission's preliminary findings are confirmed and TikTok is compelled to comply, default account settings for minors will shift so that their content is visible only to approved followers. Content posted by children will no longer be eligible for algorithmic promotion to strangers, and profile photos and follower lists will be shielded from public view.
What Maltese Parents Should Do Now:
While enforcement of these changes is expected to occur over the coming months as the Commission's formal decision process unfolds, parents in Malta shouldn't wait for mandatory compliance. Here are practical steps you can take today:
Review your child's current TikTok settings – Log in with your teen's account (with their knowledge) and check whether their account is set to private. For users aged 16-17, verify that your child understands their profile is currently visible to anyone online.
Manually lock down accounts immediately – Navigate to Settings & Privacy > Privacy > Who can view your videos and select "Private." Ensure profile photos and follower lists are not publicly visible by adjusting visibility settings accordingly.
Disable direct messaging for younger users – If your child is aged 13-15, check that direct messaging restrictions are active (TikTok already limits this by default for younger users, but verify your child's settings).
Discuss content sharing with your child – Have an age-appropriate conversation about what is and isn't safe to share online, and remind them that any content posted can potentially be shared or screenshotted.
Resources for Maltese Families:
For more guidance on managing children's online safety in Malta, you can contact:
• Malta's Office of the Commissioner for Children – which provides resources on child online safety
• Aġenzija Sapport – for digital wellbeing and family support services
• TikTok's own Safety Center (accessible at safety.tiktok.com) – which provides age-appropriate guidance and parental controls
When Will Changes Take Effect in Malta?
The European Commission is expected to issue a formal decision in the coming months. Once a binding order is issued, TikTok will have a defined compliance period—typically 90 days or longer, depending on the complexity of required changes. The company will be required to implement updated default settings for all minors' accounts across the EU, including Malta. During this transition period, platforms face periodic penalty payments if compliance is not met, creating strong incentive for rapid implementation.
Parents and educators in Malta should be aware that current TikTok accounts held by minors may still be operating under the contested settings. Until changes are enforced, users aged 16-17 retain the ability to broadcast to a global audience, and younger teens can easily bypass private settings. Schools and child advocacy groups have been urging parents to manually lock down accounts, but the EU's position is that this burden should not rest on families—platforms must engineer safety into their products from the start.
The investigation also carries weight for Malta's digital economy. As a hub for iGaming, fintech, and tech companies, the island has a vested interest in how the DSA is interpreted and enforced. Firms operating platforms accessible to minors will be watching closely to understand what "age-appropriate design" means in practice, and whether similar scrutiny will extend beyond TikTok to other social networks, messaging apps, and gaming platforms.
Addictive Design and Broader Enforcement
The child safety findings are not TikTok's only DSA headache. In February 2026, the Commission issued separate preliminary findings accusing the platform of deploying "addictive design" features—infinite scroll, autoplay, and algorithmic feeds—that prioritize engagement over the well-being of minors. Regulators argue these mechanics expose children to compulsive use patterns and harmful content, and that TikTok has failed to adequately assess or mitigate these harms.
The dual investigations signal a hardening stance from Brussels. The DSA grants the Commission unprecedented power to audit platforms, demand internal data, and interview both employees and external experts. TikTok is now navigating a multi-front compliance battle, with its parent company ByteDance facing potential penalties that could run into the hundreds of millions of euros.
TikTok's Defense and Prior Changes
In response to the preliminary findings, a TikTok spokesperson said the company would review the Commission's conclusions and "continue to engage constructively" with regulators. The platform emphasized that accounts for users under 18 are private by default, and that teen accounts come with over 50 preset privacy and safety features developed in consultation with child protection experts. TikTok also noted that users under a certain age cannot use direct messaging and that their content does not appear in the "For You" feed.
However, the EU argues these protections are incomplete. While accounts for children under 16 are indeed set to private by default, 16- and 17-year-olds are treated differently—and it is precisely this age bracket that the Commission says is being exposed to unacceptable risk. The ability for younger teens to switch settings with minimal friction also undermines the claimed safeguards.
In August 2023, TikTok disabled personalized advertising for users aged 13-17 in Europe as part of its DSA compliance roadmap. But the Commission's findings suggest that adjusting ad targeting is not enough; the architecture of account visibility itself must change.
Enforcement Timeline and Penalties
Following the issuance of preliminary findings, TikTok has the right to inspect the Commission's file and submit a written defense—a process that can span several months. If the response is deemed insufficient, the European Commission can adopt a formal decision, order mandatory changes, and impose periodic penalty payments until compliance is achieved.
The financial stakes are substantial. The DSA authorizes fines of up to 6% of a company's total worldwide annual turnover, measured against the parent group rather than regional subsidiaries. For ByteDance, which generated tens of billions of dollars in revenue in recent years, even a single-digit percentage penalty would represent a nine-figure sum.
Beyond TikTok, the case is being watched as a precedent. In July 2026, France became the first EU member state to ban social media access for children under 15, with enforcement expected by September. EU tech chief discussions have also floated the idea of an EU-wide prohibition for children under 13, alongside the rollout of a bloc-wide age verification app.
What Comes Next
The Commission has made clear what it expects: default private settings for minors' accounts, no global promotion of children's content via algorithmic feeds, and meaningful friction to prevent young users from inadvertently exposing themselves to harm. TikTok will need to decide whether to contest the findings through formal channels or negotiate a settlement that includes binding commitments and independent audits.
For residents of Malta, the outcome will shape the digital environment in which children grow up. The DSA represents the most assertive regulatory framework for platform accountability in the world, and its enforcement is now moving from theory to practice. Whether through fines, forced redesigns, or broader bans, the EU is signaling that the era of self-regulation for social media companies is over—and that children's safety online is no longer negotiable.
