EU Says TikTok’s For You Feed Digs Harmful Rabbit Holes Under the Digital Services Act

On November 6, 2026, the European Commission told TikTok that its signature product may be the problem. In preliminary findings under the Digital Services Act, Brussels said the For You recommender system can push users into harmful “rabbit holes” of mental health and body image content, and that TikTok’s own tools to break those loops do not work well enough. The case is not about illegal videos. It is about what happens when lawful clips, served again and again, become the design.

What Brussels says the For You feed does

TikTok’s For You page is a continuous stream of personalized videos. According to the Commission, the more a user watches or likes a type of clip, the more similar clips the algorithm serves. That loop can become harmful when the theme is sadness, isolation, or body image, especially for minors and vulnerable adults. Executive Vice-President Henna Virkkunen put it bluntly: every scroll or like can lead users down rabbit holes they cannot easily escape, and the DSA makes platforms responsible for negative effects tied to their recommender systems.

Officials stressed that investigators deliberately focused on content that was neither illegal nor against TikTok’s own community rules. Trends such as “what I eat in a day” and “SkinnyTok” can look ordinary in isolation. The harm, in the Commission’s theory of the case, comes from repetition at scale. That framing matters for every large platform: systemic-risk duties under the DSA are not limited to removing unlawful posts. They also cover how ranking and personalization amplify lawful material.

The Record and other outlets reported that Commission officials described the action as the first time EU regulators have aimed squarely at an engagement-based recommendation model of a major social network, and, to their knowledge, the first enforcement action of its kind worldwide. Politico quoted an official saying Brussels is “really tackling head-on the engagement-based recommender system model.” Those characterizations come from briefings around the press release; the formal document is a set of preliminary findings, not a final judgment.

Risk assessment and mitigation, not a content purge

The findings concentrate on two DSA pillars for very large online platforms: how risks were assessed, and how they were mitigated. Articles 34 and 35 of Regulation (EU) 2022/2065 require designated platforms to identify and reduce systemic risks, including negative effects on mental health and on the protection of minors. The Commission’s preliminary view is that TikTok did not adequately assess how its recommendation design can create rabbit holes, even though some related issues appear in the company’s own risk work, and that the safeguards it did deploy are not proportionate, reasonable, or effective.

Officials said TikTok’s “dispersion” techniques, meant to diversify the feed, do not sufficiently cut how often similar content returns. Refreshing the feed helps only briefly before the earlier pattern reappears. Tapping “not interested” loses force over time. Separately, Politico reported that only about 0.2% of TikTok users choose the non-personalized feed option the DSA envisages. The Commission’s remedy direction, as described in briefings and secondary reporting, is structural: weigh explicit user preferences more heavily than implicit engagement signals such as watch time; make user controls meaningful; and regularly test the algorithm’s effects.

Investigators said they spent roughly two and a half years building specialized testing capacity, obtained internal documents and data, and analyzed around 20,000 videos with psychologists, psychiatrists, and system-design experts. One official said the work did not require the exact algorithm source code. Methods remain partly confidential so platforms cannot game the tests. Ireland’s Coimisiún na Meán supported the probe; TikTok’s European headquarters sit in Dublin, a recurring venue for Irish platform supervision of TikTok and related services.

Preliminary means preliminary

This is not a fine and not a final non-compliance decision. TikTok may examine the investigation file and reply in writing. The European Board for Digital Services will be consulted. Only if the Commission later confirms its views can it issue a non-compliance decision, with a fine that must fit the nature, gravity, recurrence, and duration of the infringement and that may reach, but not exceed, 6% of the provider’s total worldwide annual turnover. TikTok does not publish global revenue, and parent company ByteDance likewise keeps consolidated figures opaque, so any eventual fine size is speculation until a decision exists.

TikTok rejected the narrative. A spokesperson said the Commission’s statements are “fundamentally inaccurate,” distort the platform’s architecture, and understate its commitment to user safety, adding that users already have “direct and intuitive control” over their experience. That defense will now be tested against the evidence file. Companies in this posture often try to negotiate design changes that avoid a formal finding; TikTok has previously closed a DSA advertising-transparency strand by agreeing fixes. Whether rabbit-hole design can be patched the same way is an open question, because the Commission’s critique goes to the engagement objective itself.

Friday’s announcement is the third set of preliminary findings against TikTok in 2026 in related proceedings: addictive design features in February, protections for minors’ accounts in July, and now the For You recommender. Politico noted a wider tally of DSA accusations against the company without fines yet. Either way, the pattern is escalation from interface features toward the ranking engine that decides what billions of sessions show next.

Why this case is different from content takedowns

Most DSA headlines still revolve around illegal content, advertising labels, or age gates. This one asks whether an engagement optimizer that works as designed can itself be a systemic risk. That is closer to product liability thinking than to classic notice-and-action. It also sits beside parallel debates in the United States, where senators have pressed TikTok over teen mental health, and where state and federal proposals increasingly target addictive or algorithmic feeds. Europe’s move gives those debates a concrete enforcement template: measure the loop, test the exit buttons, and treat ineffective mitigations as a compliance failure rather than a product quirk.

The case also foreshadows the Commission’s proposed children’s online safety legislation, often referred to as the KIDS Act, introduced in September 2026. Officials said the TikTok investigation inspired provisions that would stop platforms from relying solely on engagement signals when recommending content to children. In that sense, preliminary findings double as policy R&D. Compliance teams watching DSA scrutiny of algorithmic manipulation should expect similar questions to migrate beyond one app.

A six-point check for recommender risk programs

Platforms and product counsel that never touch TikTok still face DSA Art. 34/35 logic if they are designated VLOPs, and many non-EU products copy the same engagement architecture. A practical checklist, grounded in what Brussels attacked here:

1. Map the engagement signals. List every implicit input that moves ranking: dwell time, replays, likes, shares, follows, skip rate. Separate them from explicit controls such as “not interested,” topic mutes, and chronological or non-personalized modes.
2. Define rabbit-hole metrics. Measure consecutive same-theme recommendations, time-to-exit after a negative signal, and relapse rate after a feed refresh. A banner that says users are in control is not evidence those metrics move.
3. Stress-test sensitive themes. Run scripted journeys through mental health, body image, eating, isolation, and other high-risk clusters with clinical advisors, not only trust-and-safety generalists. The Commission’s ~20,000-video review is a signal of expected depth.
4. Prove mitigations work after day one. Dispersion, downranking, and refresh features must hold across sessions. If “not interested” decays, document it as a residual risk, not a solved ticket.
5. Align risk assessments with product reality. If internal risk reports already flag rabbit holes, the Art. 34 file must show analysis and residual risk treatment, not a restatement of community guidelines.
6. Connect EU exposure to global product roadmaps. Design changes forced in Europe rarely stay geo-fenced. Plan for explicit-preference ranking, weaker watch-time weight, and auditable A/B tests that regulators can reconstruct.

Those steps also interact with privacy programs. Recommendation systems live on behavioral data. European regulators have already examined TikTok’s cross-border data practices, including through AEPD guidance for TikTok users on EU data transfers, so DSA product findings and GDPR transfer files can land on the same executive desk.

Trade pressure and the wider DSA map

DSA enforcement does not happen in a vacuum. Washington has pressed Brussels to ease up on the DSA and DMA in trade discussions, a reminder that VLOP cases are geopolitical as well as technical. Coverage of how the United States presses the EU on DSA and DMA leverage shows why companies cannot treat a preliminary finding as a quiet legal side letter. It is a public product indictment that competitors, advertisers, and national regulators will read.

Courts and regulators are also reshaping what “platform responsibility” means beyond the DSA text alone. Recent European litigation over how online platforms must handle user rights and duties keeps expanding the compliance surface around ranking, transparency, and user autonomy. Separately, debates about privacy harm at platform scale show how engagement products and generative features now share the same risk vocabulary: scale, amplification, and weak user exit paths.

Frequently asked questions

Did the Commission fine TikTok?

No. These are preliminary findings. A fine is possible only after a later non-compliance decision, and only within the DSA’s capped turnover formula.

Is the Commission requiring TikTok to delete mental health videos?

Not on the facts emphasized Friday. Officials said the contested content was generally lawful and within TikTok’s rules. The critique targets repeated recommendation, not a category ban.

What would “effective” mitigation look like?

Commission messaging points to stronger weight on explicit preferences, less reliance on watch time, controls that keep working, and regular algorithmic testing. Exact commitments would appear in any eventual decision or settlement-style commitments.

Does this apply only to TikTok?

Formally, yes for this file. Officials acknowledged other platforms create rabbit holes and said the Commission is looking more widely, without naming targets.

The feed is the product

For a decade, social apps sold personalization as user benefit and engagement as a neutral metric. Brussels just treated that metric as a potential harm vector. Whether TikTok can rebut the file, redesign For You, or absorb a headline fine will decide more than one company’s 2027 budget. It will decide whether “the algorithm recommended it” remains an acceptable answer when the recommendation never stops.