Regulation / AI Governance / Privacy
European Commission preliminarily finds TikTok's 'For You' algorithm breaches the DSA over 'rabbit holes'
The Commission says TikTok did not adequately assess how its feed pulls users into repeated content on sadness, isolation or body image, and that its safeguards do not work. A confirmed breach could bring a fine of up to 6% of worldwide turnover.
The European Commission has preliminarily found TikTok in breach of the Digital Services Act over the “rabbit hole effect” of its ‘For You’ feed, it announced on 6 November 2026. The more a user watches or likes a type of content, the more similar content the algorithm recommends. When that content concerns sadness, isolation or body image, the Commission says, it can harm users’ mental health, especially that of vulnerable adults and minors.
The Commission found that TikTok did not adequately assess this risk and that its mitigation measures are not effective. Measures to diversify content do not sufficiently reduce repeated recommendations, and controls such as the “not interested” button may not change the feed, because the algorithm prioritises viewing time over users’ choices. TikTok should rely more on users’ explicit preferences, stop using viewing time as an indicator for recommendations, make user controls easier to use and regularly test its algorithm.
The findings are preliminary: TikTok can examine the file and reply in writing, and the European Board for Digital Services will be consulted. A non-compliance decision could bring a fine of up to 6% of worldwide annual turnover. The same proceedings produced preliminary findings on addictive design in February 2026 and on the protection of minors in July.
Why it matters
The Commission is challenging the design of a recommender system, not the removal of content: it found the risk assessment inadequate, the mitigations ineffective and named engagement signals such as viewing time as part of the problem. Teams running personalisation or ranking systems should check that the risks in their assessments lead to mitigations that are tested and shown to work. They should also be able to show which signals drive recommendations, implicit ones such as viewing time or explicit user preferences, and that user controls actually change what is shown.
Status: Investigation. Preliminary DSA findings; TikTok can review the evidence and respond
What to check
- Check whether risks named in your recommender or personalisation risk assessments each have a documented, tested mitigation.
- Inventory which ranking features rely on implicit signals such as dwell time versus explicit user preferences, and assess the effect on minors.
- Test whether user controls such as a 'not interested' button actually change what the system goes on to recommend.
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Enforcement
- Action
- Investigation
- Authority
- European Commission
- Concerning
- TikTok
- Law
- Digital Services Act
Case status: Open
Enforcement trackerInstitutions
Who should care
- Legal & compliance
- AI governance lead
- DPO
- Product and data science leads