Commission preliminarily finds TikTok’s ‘For You’ feed breaches the DSA

The European Commission has preliminarily found that TikTok breaches the Digital Services Act (DSA) because of the so-called ‘rabbit hole effect’ of its recommender system. It matters because the focus is no longer on individual items of content but on the design of the algorithm. This is set out in the Commission’s announcement of 6 November 2026 (reference IP/26/2361).

What the Commission has found

According to the Commission, the ‘For You’ feed serves a continuous stream of personalised videos, including ones about mental health struggles and body image. The more a person engages with a type of content, the more similar content they receive. Repeated exposure, for example to sadness, isolation or body image, can harm mental health, especially for minors and vulnerable adults.

The preliminary findings cover two areas: risk assessment and mitigation measures. The Commission considers that TikTok did not adequately assess how its system can draw users into these spirals, and that the safeguards it introduced are, at this stage, ineffective. It also questions whether users have meaningful control over their feeds, and takes the view that TikTok needs to change the feed’s design.

What happens next

These are preliminary findings and do not prejudge the outcome. TikTok can examine the case file and reply in writing, and the European Board for Digital Services will be consulted. Ireland’s Digital Services Coordinator, Coimisiún na Meán, supported the investigation. If the findings were confirmed, the Commission could adopt a non-compliance decision and a fine of up to 6% of worldwide annual turnover. Press reports say TikTok rejects the findings, arguing that they distort its architecture and its safety record. Formal proceedings were opened on 19 February 2024 and already covered this effect.

What it means for other platforms

The practical message is that systemic risk assessments must examine how the recommender works, not only how content is moderated. An assessment that ignores how interactions shape the feed, or mitigation that is not tested in practice, may be judged insufficient. User controls matter too: they must be understandable and effective, not merely available.

Our view at CEA Digital Law

At the Euro-American Committee of Digital Law - CEA Digital Law we see this case as a chance to clarify standards. We suggest three lines of work. First, the final decision should spell out what evidence of effectiveness is expected from mitigation, giving legal certainty to the whole sector. Second, platforms should already document how they measure the cumulative effect of recommendations on minors and vulnerable people.

Third, for Latin America and the Caribbean and for Africa, where several countries are debating platform regulation, the European approach offers a useful model: requiring design risks to be assessed and mitigated, under independent oversight and with rights of defence, rather than focusing only on removing content. Open questions remain, such as balancing personalisation, user autonomy and freedom of expression, and how to measure harm to mental health. They are best addressed with scientific evidence and civil society participation.

Sources

• European Commission, Shaping Europe's digital future
• European Commission, Press corner IP/26/2361
• PPC Land
• Greek City Times

CEA Digital Law