EU Says TikTok's For You Algorithm Breaches Digital Services Act Over 'Rabbit Holes'

The preliminary findings, dated November 6, go further than the Commission's earlier action against the platform. A senior EU official told AFP that February's findings on addictive design dealt with features such as notifications, while Friday's case is about the algorithm itself. The official also acknowledged that the Commission was targeting TikTok's engagement-based business model. The remedies Brussels suggests would change how a recommendation system that ranks videos by watch time decides what users see.

In its press release, the Commission said the algorithm reads engagement signals such as watching and liking as positive signs of interest. A user who repeatedly watches or likes potentially triggering content, such as videos about weight loss or body image, is shown more of the same. The Commission said repeated exposure of this kind may lead to "increased feelings of sadness or anxiety, body dissatisfaction, lower self-esteem, or worsening of existing eating disorders and mental conditions", with vulnerable adults and minors most at risk.

The findings make two charges. The first is that TikTok did not adequately assess how its recommendation algorithm could lead users into rabbit holes. The second is that the safeguards it did put in place do not work. Measures meant to diversify recommendations do not reduce how often similar content appears enough, the Commission said. Its user controls are also weak: pressing the "not interested" button may not be enough to change the feed, because the algorithm gives viewing time priority over a user's choice to see less of something.

The Commission said that, at this stage, TikTok needs to change how the feed is built. Its examples were relying more on users' explicit preferences, no longer using viewing time as a signal for recommending content, making user controls easier to find and use, and testing the algorithm regularly.

"Every time a user scrolls or likes a video on TikTok, the algorithm serves more of the same leading users down rabbit holes they cannot easily escape from," Henna Virkkunen, the Commission's Executive Vice-President for Tech Sovereignty, Security and Democracy, said in a statement. She said the findings "show again that TikTok needs to step up its efforts to protect users' well-being, including those of minors."

TikTok rejected the findings. A spokesperson called them "fundamentally inaccurate" and said they "distort our platform's architecture and our commitment to user safety", according to Al Jazeera.

The Commission said its view rests on TikTok's risk assessment reports, internal data and documents, the company's answers to several requests for information, a review of scientific research, and interviews with experts in recommender systems, psychology and psychiatry. Ireland's digital services regulator, Coimisiún na Meán, supported the investigation.

The rabbit-hole case is one strand of wider formal proceedings into TikTok's compliance with the DSA. The Commission issued preliminary findings on researchers' access to public data in October 2025, on addictive design in February 2026 and on the protection of minors in July 2026. A separate strand on advertising transparency was closed in December 2025 after TikTok made binding commitments. In July the Commission also told Meta to change the feeds of Facebook and Instagram under the same law. Brussels is separately preparing rules that would bar children under 13 from social media and allow only limited, supervised access until 15.

TikTok faces similar pressure in the United States. In September it avoided a trial by agreeing to pay Alabama at least $100 million and to introduce time limits and other restrictions for teenage users.

TikTok can now examine the Commission's investigation file and reply in writing, and the European Board for Digital Services will be consulted in parallel. If the Commission confirms its view, it can issue a non-compliance decision with a fine set according to the nature, gravity, recurrence and duration of the breach. The Commission said the preliminary findings do not prejudge the outcome, and it gave no timetable for a final decision.