Minor accounts need a private-default test

A minor’s account is not safe by default merely because it starts private. The product also has to control what happens after the young user changes a setting, publishes a post and meets the recommendation system.

On 24 July 2026, the European Commission sent TikTok preliminary findings that its accounts for minors do not meet the Digital Services Act’s safety standard. The immediate issue is narrow: minors can choose a public account, users outside TikTok may then see their content, and posts by 16- and 17-year-olds may enter other users’ For You feeds.

The findings are not a final decision and do not establish that every platform has copied TikTok’s design. They do expose a useful acceptance test for any service that knows a user is under 18: trace visibility, discovery and reuse together instead of treating the “private account” switch as the end of the review.

One toggle crosses several boundaries

TikTok’s public support page says accounts for 13- to 17-year-olds start private. It also says a teen can change the account to public. For users aged 16 to 17, a public profile and videos may then be visible and shareable by anyone on or off TikTok, appear in search engines and be reused through other product features depending on separate settings.

The Commission’s preliminary position is that a minor’s public account should, by default, remain visible only to TikTok users the minor has accepted. Older minors may have an option to share more broadly inside the platform, but their content should not become available to a global audience outside it. The Commission also says TikTok should stop recommending minors’ content through the For You Feed.

That analysis separates three boundaries that product screens often collapse:

• Account visibility: who can open the profile or follow the account.
• Content distribution: who receives a post through search, recommendation or sharing.
• Content portability: who can download, embed, remix or expose the post outside the service.

A setting labelled “public” is too broad if changing it silently moves all three. A teenager may understand “other users can see this” without understanding “a search engine can index this” or “the system can recommend this to strangers”.

The DSA asks for a high level, not one feature

Art. 28(1) DSA requires providers of online platforms accessible to minors to put appropriate and proportionate measures in place for a high level of privacy, safety and security. The Commission’s 2025 guidelines recommend private accounts by default, safer recommender systems, controls against unwanted contact and restrictions on downloading or screenshotting minors’ content.

The guidelines are non-binding. Following them does not automatically prove compliance, and choosing another measure is possible. They can still serve as a reference point when the Commission or a national regulator assesses whether the legal standard has been met.

The scope matters for smaller firms. The Commission says the guidelines apply to platforms accessible to minors except micro and small enterprises. That exception is not a reason to label every young company exempt without checking its legal status, service type and growth. It is also not a design argument for exposing young users. A small team can run the acceptance test without building a compliance programme.

Start with an age-and-audience matrix:

Product state	Question to answer	Safe evidence
Sign-up	Which age band and default audience apply?	Test account with age, default setting and policy version
Account change	What exactly becomes public?	Confirmation screen listing profile, posts, search and off-platform reach
Publication	Who can view this specific post?	Post-level audience stored with the content
Recommendation	Can the post be pushed to unknown users?	Age-aware recommender rule and a negative test
Reuse	Can others download, remix, embed or screenshot?	Feature matrix by age and account state
Reset	Can the user return to a safer state without losing control?	One-step privacy reset and visible result

Source: Regulation (EU) 2022/2065, Art. 28, and the Commission guidelines on protection of minors. Last verified 2026-07-25.

The matrix is more useful than a screenshot of the initial setting. It follows the content after the account changes and gives testers a result that can fail.

Recommendation is a separate publication decision

A user deliberately making a post visible to a wider audience does not answer whether the platform should amplify it. Recommendation is the platform’s decision to place content in front of people who did not request it.

The Commission’s preliminary finding draws that line for TikTok’s For You Feed. Product teams should therefore test recommendation independently from profile visibility. A public post may still need to stay out of trend pages, “people to follow” modules, notification campaigns or feeds delivered to unknown adults.

Use an explicit rule:

minor content / account state / eligible surfaces / excluded surfaces / reason / policy version

Then run negative tests. Create a minor account, publish content under every permitted audience, and try to surface it from unrelated adult accounts, logged-out browsers, internal search, external search and share previews. The test passes only when each surface matches the age-and-audience matrix.

Do not rely on the recommendation model to infer safety from engagement. The exclusion should be a product constraint that remains in place when ranking code, campaign tools or search indexes change.

Off-platform reach needs its own warning

The largest gap between interface language and actual exposure often appears outside the service. “Anyone” can mean registered users, logged-out visitors, search engines, embeds, link previews, downloads and copies that the original user can no longer control.

Before a minor can widen an audience, name those consequences in ordinary language. Avoid a single confirmation that bundles visibility, recommendation and reuse. The safer sequence is:

1. choose who can view the account;
2. choose who can receive a post;
3. keep recommendation to unknown users off by default;
4. keep download and remix functions restricted by age;
5. explain any off-platform access before it is enabled.

The confirmation should be reversible. Returning an account to private should clearly state what changes immediately and what cannot be recalled, such as a file someone has already downloaded.

This is also where supplier reviews fail. A community product may use separate services for authentication, content delivery, search, recommendations, analytics and moderation. The account setting must reach all of them. Ask each supplier which age and audience attributes it receives, how quickly a change propagates and whether cached or indexed content is removed.

Run six accounts, not six workshops

A bounded test can cover the core design:

• ages 13, 15 and 17 with the default private state;
• the same ages after every permitted audience change;
• an unrelated minor viewer;
• an unrelated adult viewer;
• a logged-out browser;
• an external search or share-preview request.

For each combination, check the profile, post, comments, recommendation surfaces, reuse controls and off-platform response. Save the policy version and the expected result beside the test.

The test should fail if “public” creates a boundary the interface did not name, if the recommender amplifies a minor’s post to strangers, or if switching back to private leaves the content exposed through an index or embed.

TikTok can now respond to the Commission’s preliminary findings, and the final outcome may change the legal picture. The product lesson does not need to wait: test every route from a minor’s post to an unknown viewer, and make the narrowest audience the state the system can prove.