Can the EU Make TikTok Take Responsibility for Its Rabbit Holes?

Last Friday, the European Commission published its preliminary findings concerning TikTok, according to which the platform had failed to comply with the Digital Services Act (DSA) by inadequately assessing and mitigating the so-called “rabbit hole effect” associated with the recommender system powering its For You feed.

The announcement marks the latest chapter in the Commission’s growing scrutiny of the architecture of online platforms. Earlier in February, the Commission had already raised concerns about TikTok’s addictive design, including infinite scroll, autoplay and its highly personalized recommender system. Further preliminary findings concerning the protection of minors followed in July.

The latest findings concern, in particular, the risks arising from the repeated recommendation of similar content based on users’ previous interactions, which may expose them to harmful sequences of videos concerning mental health struggles, sadness, isolation or body image.

According to the Commission, TikTok failed to adequately assess how the design and functioning of its recommender system may generate or aggravate these risks, contrary to the obligation of diligent risk assessment under Article 34 DSA. The Commission further concluded that TikTok had failed to implement reasonable, proportionate and effective mitigation measures, as required under Article 35 DSA.

The Commission’s preliminary findings also have implications for other VLOPs with similar feeds. Under Articles 34 and 35 of the DSA, providers must assess how their recommender systems may lead users from an initial viewing to a sequence of potentially harmful videos, and whether their safeguards interrupt that sequence. The forthcoming Digital Fairness Act may complement those duties by requiring traders to give consumers accessible and effective controls to disable features that can encourage excessive or compulsive use, such as autoplay and infinite scroll.

Rabbit holes in TikTok’s risk assessment

The term “rabbit hole” is commonly used to describe a process whereby users are progressively drawn into an increasingly narrow, and sometimes more extreme, stream of content through successive online interactions and recommendations. Rabbit holes may occur on platforms such as TikTok, Instagram, Facebook and YouTube, where recommender systems personalize what users see. Recommendations are not inherently problematic. Concerns for users’ well-being can arise when the interaction between their behavior and the way recommendations are personalized leads to particular patterns of exposure.

The Commission’s preliminary findings focus specifically on the risks that arise when TikTok repeatedly recommends potentially harmful content, particularly material relating to mental health and body image. Harm may arise from cumulative exposure even when the individual videos comply with the platform’s rules.

TikTok addresses the risks stemming from repeated exposure to what it terms “Concentrated Content” (Section 6 of its 2025 DSA Risk Assessment Report). The report acknowledges that recommendations calibrated to users’ interests and past engagement may narrow the range of content to which they are exposed, and that repeated viewing may adversely affect well-being even where the material complies with TikTok’s Community Guidelines. Section 6 of the report further recognizes that recommender systems may contribute to extended use.

Section 15 of the report situates Concentrated Content within the broader category of “Online Engagement Risks” and differentiates between minors and adults in its account of how those risks materialize. As regards minors, TikTok focuses on “Younger Users,” defined as users with a declared age of 13 to 17. The report identifies risks associated with the creation and publication of content and with interactions with other users. It also considers the potential impact of extended use, repeated exposure to Concentrated Content and social comparison on minors’ mental well-being, together with the risk of physical harm arising from dangerous online trends or challenges. As regards adults, TikTok states that risks to well-being may arise from “the way some Adult Users use the Platform,” and identifies extended use, exposure to Concentrated Content and social comparison as potential sources of harm.

Whether, and how, the risk posed by rabbit holes is reflected in the ratings depends on how TikTok assessed the role of the recommender system in generating repeated exposure. Article 34(2)(a) DSA requires providers to take into account whether and how the design of their recommender systems influences systemic risks. TikTok, however, assigns a single set of ratings to the Online Engagement Risks category as a whole. Overall severity is assessed as Medium-High and probability as Likely, yielding an inherent risk of Medium-High and a residual risk, following mitigation, of Medium (Section 15, pp. 61 and 64).

The report provides limited information on how TikTok examined the content served to users after an initial viewing, including the frequency of similar recommendations, any progression towards more extreme material, and whether such sequences prolonged engagement. This opacity makes it difficult to reconstruct how the probability and severity of harm arising from such sequences were assessed for minors and adults. It also makes it difficult to determine whether the mitigation measures adopted are reasonable, proportionate and effective within the meaning of Article 35 of the DSA.

The (in)effectiveness of TikTok’s mitigation measures

Article 35(1) DSA requires mitigation measures that are not only reasonable and proportionate but also effective, and tailored to the specific systemic risks identified under Article 34. For rabbit holes, effectiveness is a question of outcomes: whether the measures reduce how often, and for how long, users are served successive recommendations that are harmful because of their repetition.

TikTok’s report defines the target of its main measure but not its calibration. Dispersion models avoid recommending a series of similar videos on themes that do not violate the Community Guidelines but may become problematic if viewed repeatedly (Section 6, p. 21; Section 15, pp. 61-62). The report does not say how much repetition is tolerated. It states only that TikTok “adjusts risk tolerance based on the latest information” (p. 21), an internal and variable standard.

The evidence offered for the residual rating does not measure what the measure targets. The Medium rating is informed by removals of videos violating the policies on suicide and self-harm and on dangerous challenges (p. 64). Dispersion, however, operates on content below the removal threshold, so removal data say nothing about whether a user is still served a fifth video on the same theme.

The user-facing tools are measured by adoption, not effect.

In March 2025, 2,619,937 users in the EU had filtered keywords or hashtags (p. 21), roughly 1.6% of the 159 million average monthly active users reported for July-December 2024 (p. 7). The figure does not show whether those users saw fewer harmful sequences afterwards.

The report is also silent on the mechanism the Commission targets. Viewing time and the “Not interested” function appear nowhere in it. The Commission found that that TikTok’s diversification measures did not sufficiently reduce repeated recommendations of similar material, and that “Not interested” may have limited effect because the recommender gives greater weight to viewing time. The remedies it indicated, including regular testing of the recommender, correspond to Article 35(1)(a) and (d). The latter expressly refers to testing and adapting algorithmic systems, including recommenders. TikTok’s report describes no such testing for this risk.

What to expect next

TikTok now has the possibility to exercise its right to defense. It may examine the documents in the Commission’s investigation files and reply in writing to the Commission’s preliminary findings. In parallel, the European Board for Digital Services will be consulted. If the Commission’s views are ultimately confirmed, the Commission may issue a non-compliance decision, which can trigger a fine proportionate to the nature, gravity, recurrence and duration of the infringement and reach up to but not more than 6% of the total worldwide annual turnover of the provider.

At this stage, the Commission considers that TikTok needs to modify the design of its For You feed, notably by discontinuing the use of viewing time as a recommendation signal, giving greater weight to users’ explicit preferences, improving the accessibility and usability of user controls, and regularly testing its algorithm.

Beyond the outcome of these proceedings, however, the investigation raises broader concerns about the risk of merely formal (or “symbolic”) compliance with the DSA’s systemic risk governance framework. The identification and classification of systemic risks, together with the adoption of mitigation measures, cannot in themselves establish compliance with Articles 34 and 35 DSA. Their adequacy depends on the methodology employed, the evidence informing the assessment and the extent to which the measures adopted address the mechanisms generating or aggravating the identified risks.

The role of scientific evidence is particularly relevant in this respect. Although Recital 90 DSA requires risk assessments to be informed by the best available information and scientific insights, the Regulation does not prescribe specific criteria for identifying, selecting and evaluating the relevant literature. This leaves considerable methodological discretion to providers, particularly in interpreting scientific uncertainty and determining how external research should inform the assessment of risks arising from their own systems. The TikTok investigation thus brings into focus the substantive content of the duty of diligence under Article 34 DSA. Ensuring that systemic risk assessments do not become exercises in documenting compliance requires scrutiny not only of the procedures followed, but also of the evidentiary basis and methodological reasoning supporting the conclusions reached.

These questions are also relevant to the forthcoming Digital Fairness Act, expected to address addictive design, dark patterns and unfair personalization. Where Articles 34 and 35 DSA rely on open-textured due diligence, the DFA could set more determinate standards on which design practices are unfair.