ByteDance gets 24 hours to show EU a DSA risk assessment for TikTok Lite

TikTok owner ByteDance is facing fresh questions about its compliance with the European Union’s Digital Services Act (DSA), an online governance and content moderation framework that puts a legal obligation on larger platforms to mitigate systemic risks in areas like youth mental health.

The EU’s latest concerns about TikTok’s DSA compliance center on the launch of TikTok Lite. This is a version of the video sharing app which recently launched (“test launched”, per TikTok) in France and Spain — letting users over 18 years old there earn points for certain in-app activities, such as liking content or following new creators. TikTok says these points can be redeemed for gift cards or “coins” that can be gifted to creators.

The reward-linked engagement feature looks to have triggered concern in the EU about potentially addictive design which could have a negative impact on young people’s mental health. The European Commission oversees platforms’ compliance with DSA system risk requirements.

In a press release announcing the request for information (RFI), the Commission said it’s asked TikTok for more details on the risk assessment it should have carried out before deploying the new app in the EU.

“This concerns the potential impact of the new ‘Task and Reward Lite’ programme on the protection of minors, as well as on the mental health of users, in particular in relation to the potential stimulation of addictive behaviour,” it wrote, adding that it’s also requesting info about the measures TikTok has put in place to mitigate such systemic risks.

TikTok has been given 24 hours to provide the risk assessment for TikTok Lite. It has until April 26 to provide other requested information, after which the Commission said it will analyse its reply and assess next steps, such as whether or not to open a formal investigation.

Reached for comment on the Commission’s RFI, a TikTok spokesperson said: “We have already been in direct contact with the Commission regarding this product and will respond to the request for information.”

ByteDance, which owns TikTok, is one of around two dozen larger online platforms that are subject to the strictest layer of DSA rules — requiring them to take steps to mitigate systemic risks use of their platforms could cause. Penalties for failing to comply with the regulation can reach up to 6% of global annual turnover which could lead to some hefty fines for TikTok for any confirmed compliance failures.

The wider impact of the pan-EU regulation is likely to be on platforms’ product design choices, with EU enforcers having powers that could potentially force the reform of entire business models if they’re found to have toxic impacts.

TikTok is already under investigation in the EU in relation to a number of DSA obligations, including in the area of protection of minors and the risk management of addictive design and harmful content, after the Commission announced a formal probe back in February. But the latest RFI suggests the EU is worried there are more issues of concern.

It’s particularly interesting to see the Commission intervening so swiftly after a tentative product release — as the TikTok Lite app only appears to have been live in the two markets for a very brief period. The Commission says it launched this month. (And here, for example, is a Spanish YouTube video on the reward feature which was posted just under a week ago where the vlogger says the program for earning money “just by watching videos” has only just been made available, and so far only on some Android devices.)

It’s not clear whether TikTok conducted a DSA risk assessment for the new reward program ahead of launching TikTok Lite in the two EU markets. A TikTok spokesman did not respond when we asked about that. But the regulation’s focus on systemic risk essentially makes such a step obligatory for features that are likely to appeal to minors.

TikTok did tell us it requires TikTok Lite users to verify that they are 18 or older in order to collect points through their use of the app. Asked about the robustness of the age verification technology it’s using, its spokesman said the processes involved can include things like “submitting a selfie with a photo ID (e.g passport or drivers license), credit card authorisations etc”.

Other restrictions on the reward program TikTok highlighted are a maximum limit on rewards it said is “roughly” equivalent to €1 per day. It also said there’s a maximum daily video time limit for rewards of one hour — so, presumably, you can only earn points for one hour’s worth of video watching, after which you won’t accrue any more points that day.

How clearly such limits are communicated to TikTok Lite users may be one area of interest to EU enforcers as they ask the platform about its design choices.

“VLOPs [very large online platforms] and VLOSEs [very large online search engines] are obliged to carry out risk assessments prior to deploying functionalities that are likely to have a critical impact on risks to, for example, the mental well-being of the users and send this assessment to the Commission without undue delay,” a Commission spokesperson told us.

Consumer groups in Europe have previously raised concerns about various aspects of TikTok’s platform design, including its use of virtual currency to create engagement incentives. Complaints raised back in 2021 were funnelled through the Consumer Protection Cooperation Network, with the Commission involved in encouraging a dialogue between the two sides. Then, in June 2022, the procedure culminated in TikTok offering a series of commitments — including pledging to boost transparency around its digital coins and virtual gifts.

However judging by the Commission’s oversight of TikTok’s approach to DSA compliance the platform may need to go further to satisfy enforcers of the rebooted EU Internet rulebook, which came fully into force this February — but with systemic risk elements expected to be respected as of late August 2023.

This report was updated with comment from the Commission