Spain’s TikTok CSAM Case: Why the AEPD Chose Targeted Blocking Over a Shutdown

Within three days, Spain went from a journalistic investigation to a ministerial demand that TikTok stop operating in the country, and then to a regulator’s careful answer about what the law actually allows. On November 9, 2026, the fact-checking foundation Maldita.es published an investigation alleging that it had found 1,183 explicit videos and images of child sexual abuse on TikTok. On November 10, Youth and Childhood Minister Sira Rego asked Spain’s data protection authority, the Agencia Española de Protección de Datos (AEPD), to suspend the platform as a precautionary measure. On November 11, the AEPD declined to go that far. Instead, it announced targeted steps and said it would send the case to the regulators that hold primary jurisdiction. The allegations haven’t been tested by any court or regulator. Still, the case is a useful lesson in how Europe’s enforcement tools fit together, and where they don’t.

What Maldita.es alleges

Maldita.es, a nonprofit foundation, says its team spent 35 days using TikTok the way an offender might: training the recommendation algorithm, using the search function, watching livestreams and following sellers to other messaging apps. It says it found more than 200 profiles openly posting abuse material, 12,068 Spanish-language comments from 7,725 profiles boasting about, requesting, swapping or advertising such material, and more than 26,000 profiles overall that it classifies as potential offenders. Its central claim isn’t just that illegal material was uploaded. It argues that TikTok’s own search and recommendation features led users toward it. Maldita.es also says it reported 50 videos through TikTok’s official reporting channels and that only five were removed. It has filed a criminal complaint with Spain’s cybercrime prosecutors.

These are findings by a private organisation, published as journalism. No authority has yet confirmed the figures or ruled on whether TikTok breached any law. TikTok told the Spanish news agency EFE that sexually explicit content involving minors is “categorically prohibited” and that it uses advanced detection technology and enforcement to remove it. It also urged Maldita.es to share its findings in full, saying the foundation’s refusal was preventing it from finding and removing the material and from reporting it to law enforcement. Maldita.es responded that emailing abuse material or links to it could itself amount to distribution. It says it reported a sample through TikTok’s own tools and has given its evidence to prosecutors instead.

The broader pattern isn’t unique to one platform. Ofcom’s global study of how perpetrators access and share abuse material describes similar routes, from public discovery features to private channels.

What the government asked for, and what the regulator did

On Monday, November 9, the ministry asked the Attorney General’s Office to consider “all necessary measures,” including interrupting TikTok’s service. On Tuesday, after meeting Maldita.es and then TikTok, Rego said publicly that if it had been up to her, TikTok would already be suspended in Spain. “Social media cannot be lawless territory,” she said, according to Reuters. Her ministry’s written request asked the AEPD to use Article 66(1) of the GDPR, which lets a supervisory authority take immediate provisional measures when there is an urgent need to protect people’s rights. Such measures can last no longer than three months, apply only in that country and must be reported to the European Data Protection Board and the Commission.

The AEPD’s November 11 statement (in Spanish; translations here are our own) condemned the alleged crimes in strong terms and praised investigative journalism, but it took a narrower path. It said investigating the facts belongs to the police, prosecutors and courts, and that the courts are the natural place to order general takedowns of criminal content or any restriction of access to a service. It cited Article 84.2 of Spain’s data protection law, which gives prosecutors the lead role when images of minors shared on social networks may unlawfully interfere with their fundamental rights. Within its own powers, the AEPD said it would:

1. ask Maldita.es for the list of links where, based on its reporting, unlawful processing of personal data appears to be happening;
2. require TikTok to provide specific information about what it has done to remove the reported content;
3. after analysing those responses, order access blocked to the specific links and content that amount to unlawful processing of minors’ data, a measure the agency called concrete and proportionate and respectful of freedom of expression and information.

That is narrower than early English-language summaries suggested. The AEPD didn’t order TikTok to explain its CSAM detection systems in general. It asked about the platform’s response to specific reported content. And it didn’t open a sanctions procedure against the company.

Why Ireland and Brussels hold the bigger levers

The main reason for the AEPD’s restraint is the GDPR’s one-stop-shop. TikTok has its main EU establishment in Ireland, so Ireland’s Data Protection Commission (DPC) is its lead supervisory authority for cross-border processing. Other national authorities can act alone only in limited, exceptional cases such as Article 66. The AEPD said it would send everything it learns to the DPC and, where relevant, to the EDPB and other EU data protection authorities. That cooperation system is under constant pressure, as the EDPB’s Dublin push for consistent cross-border enforcement shows. The DPC’s own independence has also drawn criticism from UN experts, criticism the DPC rejects.

The AEPD is also referring the case to the European Commission because of its role under the Digital Services Act. As a very large online platform, TikTok has to assess and mitigate systemic risks, including the spread of illegal content and harms to minors, and it has to run working notice-and-action systems. Breaches can lead to fines of up to 6% of global annual turnover. The Commission already has open DSA proceedings against TikTok. On November 6 it issued preliminary findings that the For You feed creates harmful rabbit holes. A claim that recommendations surface criminal material would fit directly into the same questions about recommender-system risk.

Stopping short of suspension also had a legal logic. A Spanish technology lawyer quoted by ABC noted that the AEPD used Article 66 against Worldcoin in 2024, and that Italy’s Garante restricted TikTok in 2021. But he argued that a nationwide suspension of a service used by millions would probably be challenged in court as disproportionate and as a restriction on freedom of expression. Targeted blocking orders are much harder to attack.

The criminal track

On November 11, Attorney General Teresa Peramato signed a decree assigning the case to Elvira Tejada, the coordinating chief prosecutor for cybercrime. Maldita.es says it ratified its complaint that day and handed over about one terabyte of evidence. Prosecutors say they will examine whether there are signs of offences involving the production and distribution of abuse material and the corruption of minors. Any order to interrupt the service would ultimately be for a judge. Reuters noted that, months earlier, the Spanish government had asked for a probe into X, Meta and TikTok over alleged AI-generated abuse material.

What trust-and-safety and privacy teams should document

Every large platform should expect regulators, prosecutors and reporters to ask the same questions Spain is asking now. The answers depend on records that already exist, or that should.

• Takedown timelines for reports. Log when each report arrived, how it was triaged, what action was taken and when. A claim that five of 50 reports were acted on will be tested against those logs.
• Coverage of hash-matching and classifiers. Record which known-material hash lists you use, how fast they update, and how you detect new material and livestream abuse that hashes can’t catch.
• Search and recommendation safeguards. Document blocked search terms, how coded vocabulary and misspellings are handled across languages, and how the recommender is stopped from linking accounts that share abuse material.
• Channels for researchers and NGOs. Set up a lawful, secure way to receive evidence without anyone emailing illegal material. A route through prosecutors or hotlines is better than an argument in the press.
• A map of lawful bases and retention. Detection and reporting involve processing sensitive data. Keep a record of the legal basis for scanning, especially as the EU’s temporary CSAM scanning rules and the related push against deepfakes and abuse imagery keep changing, and record how long evidence is kept and who can see it.
• A regulator contact map. Know who your lead GDPR authority is, who your DSA regulator is, what each national digital services coordinator does and how you reach local prosecutors, so an urgent request doesn’t reach the wrong team.

Frequently asked questions

Could the AEPD have suspended TikTok on its own?

Article 66 lets a national authority adopt urgent provisional measures for up to three months, and the AEPD has used it before. The agency signalled that it saw a full suspension as outside what the European framework allows in this case, and chose specific blocking orders instead.

Is TikTok accused of breaking the GDPR?

No regulator has said so. The AEPD’s working theory is that the specific content may involve unlawful processing of minors’ personal data, which would justify blocking those items. Any assessment of TikTok’s systems would be for the DPC, and any assessment of systemic risk would be for the Commission under the DSA.

Why didn’t Maldita.es just send TikTok the links?

The foundation says that passing abuse material or links by email could amount to distribution. It reported a sample through TikTok’s own tools and gave its full evidence to prosecutors. TikTok says that without the full findings it cannot locate and remove the material.

What happens next?

Prosecutors will analyse the evidence, the AEPD will review TikTok’s answers before ordering any blocks, and the DPC and Commission will decide whether to act on what Spain sends them.

Child protection depends on systems that work

Spain’s response shows both the urgency of protecting children and the limits of a regulator’s powers. A minister can demand a shutdown, but only courts and the authorities with primary jurisdiction can impose the heaviest measures. The real test is whether a platform’s reporting, detection and recommendation safeguards work when someone finally checks. Maldita.es has published the ministry’s request and its demands of TikTok in English. Anyone running a trust-and-safety program should read it as a list of the questions their own logs may one day have to answer.