Brussels told TikTok its feed design must change, and named dropping viewing time as a recommendation signal among its examples. In the same week, reports said India was reviewing safe harbour for social media platforms, with New Delhi asking whether an algorithm makes a platform an editor. The same doctrine is moving through both capitals, and the enforcement record behind it is thinner than the headlines suggest.
On 6 November 2026 the European Commission issued preliminary findings that TikTok is in breach of the Digital Services Act because its For You feed drives users into “rabbit holes” of similar content, including material about sadness, isolation and body image. The Commission’s examples of the change it wants are unusually specific: TikTok should rely more on users’ explicit preferences and, in its words, “disable viewing time as an indicator to recommend content.”
On 4 and 5 November, reports said India’s Ministry of Electronics and Information Technology (MeitY) had begun exploratory discussions on withdrawing safe harbour from social media platforms. No decision has been taken. As reported, the idea is to confine legal immunity to services that only transmit or carry information, such as internet service providers, telecom operators and peer-to-peer messaging, and to exclude platforms that, officials say, determine what users see through algorithmic ranking and amplification.
Those are the same argument in two different legal systems. A platform that ranks and recommends is not a passive carrier, so it should not be treated as one. What Brussels is enforcing against a foreign platform, New Delhi is considering applying to all of them, Indian companies included. The doctrine has arrived. The machinery to enforce it has not.
The short answer
- Brussels preliminarily found TikTok’s For You feed in breach on two counts. Inadequate risk assessment of how the algorithm creates rabbit holes, and mitigation measures that the Commission judged ineffective. The Commission’s examples of the fix reach into algorithm parameters, not only into outcomes.
- India is considering the same doctrine. The IT Ministry’s review of safe harbour for social media, reported on 4 and 5 November 2026 and still exploratory, would treat algorithmic curation as editorial control. It would require an amendment to the Information Technology Act and parliamentary approval.
- The DSA has issued two non-compliance decisions, and neither concerns a recommender system. The first was a €120 million fine on X in December 2025 for transparency failures: deceptive blue checkmarks, a deficient ad repository, blocked researcher access. The second was a €200 million fine on Temu in May 2026 for failing to assess the systemic risks of illegal and unsafe products.
- Every algorithmic-design case is still preliminary. TikTok’s addictive design, protection of minors and rabbit holes have all reached preliminary findings. None has reached a decision.
- If the TikTok finding is confirmed, it would be the first substantive design mandate on a recommender system in a major democracy. That matters more than the 6 per cent of turnover fine ceiling attached to it.
What Brussels actually found
The Commission preliminarily found that TikTok did not adequately assess how its recommendation algorithm may lead users into rabbit holes, and that the measures it had in place were not effective. Diversified-content recommendations do not sufficiently reduce how often similar content appears, and control tools do not work — the “not interested” button may not change the feed, because the algorithm prioritises viewing time over the user’s stated choice.
The finding splits into two limbs and both matter. Under the risk-assessment limb, the Commission’s preliminary view is that algorithm design may play an important role in the rabbit holes: a feedback loop where engagement signals interest and interest generates more of the same. Under the mitigation limb, the case is that the measures TikTok has put in place are not effective. The second limb is the harder one for any platform to answer, because it turns on effectiveness, not intent.
The evidence base is documented. The Commission cites an analysis of TikTok’s risk assessment reports, internal data and documents, responses to multiple requests for information, a review of the scientific literature, and interviews with experts in recommender systems, psychology and psychiatry. Ireland’s digital services coordinator, Coimisiún na Meán, supported the investigation.
TikTok now has the right of defence. It may examine the investigation file and reply in writing, and the European Board for Digital Services will be consulted. The Commission states that its preliminary views “do not prejudge the outcome.”
One structural detail deserves attention. This is one tranche of a single proceeding that has already produced preliminary findings on researcher data access in October 2025, addictive design in February 2026 and protection of minors in July 2026, and was closed on advertising transparency through binding commitments in December 2025. Brussels is building a case file across five separate issues, not pursuing a single violation.
India Is Reportedly Reviewing Safe Harbour for Social Media Platforms
India’s IT Ministry has reportedly begun exploratory discussions on safe harbour for social media: restricting it to intermediaries that merely transmit or carry information and excluding platforms that use algorithms to rank, recommend and amplify content. Officials are reported to characterise such practices as exercising editorial control. Stripping safe harbour would require amending the Information Technology Act, 2000, and approval by Parliament.
The Indian debate arrives with a long history behind it. TikTok was among 59 mobile apps blocked on 29 June 2020 under Section 69A of the Information Technology Act and the 2009 Blocking Rules. A PIB feature of 4 July 2020 gave the grounds as threats to the sovereignty and integrity of India, defence, security of the State and public order, and said one stated reason was intelligence that some apps were transmitting users’ data to servers outside India.
India was the platform’s largest market at the time, with more than 200 million users. A second round in September 2020 took the total past a hundred applications, and the restriction on TikTok was made permanent in January 2021.
The ban still stands. The IT and Information and Broadcasting Minister said in September 2025 that there was no proposal under consideration to lift it. The Cabinet’s March 2026 relaxation of the Press Note 3 investment rules for land-border countries changed the investment framework and left the prohibition untouched.
That experience explains why the safe harbour rethink matters. Section 69A blocks a service. The IT Rules, as updated to 10 February 2026, add some finer instruments: labelling and metadata duties for synthetic content, user declarations for significant social media intermediaries, and a periodic review of their own automated tools for bias and accuracy. What the IT Ministry is reportedly exploring would put a condition on ranking and amplification, which none of those does.
The doctrine they share
Both jurisdictions are rejecting the legal fiction that a platform which ranks content is a passive conduit. The Digital Services Act attaches obligations to recommender system design and requires risk assessment of the algorithm itself. India’s reported proposal would make the same conceptual move by treating algorithmic amplification as editorial control, which is the trigger that removes intermediary immunity.
The Digital Services Act reaches this through Article 34, which requires very large platforms to assess systemic risks arising from the design or functioning of their services, including algorithmic systems, and Article 35, which requires reasonable, proportionate and effective mitigation measures. The Commission has already enforced both articles once, against Temu in May 2026, though on illegal products and not on recommender design. TES reads its TikTok case as aimed at the feedback loop, not at any individual video.
India’s route is different in form and identical in substance. Intermediary immunity under Section 79 of the Information Technology Act was built for services that did not know about, or could not control, third-party content. A platform that decides what a user sees next is doing something else, and the government’s emerging view is that this amounts to editorial control that the immunity was never designed to cover.
Where they diverge is in what happens next. Brussels has a dedicated regulator, a technical investigation capacity, a statutory remedy menu and a fine ceiling of 6 per cent of worldwide turnover. India has blocking power under Section 69A, a takedown regime under rule 3(1)(d) of the IT Rules, and a safe harbour condition that would operate as a liability exposure. The first two remove a service or an item of content. The third would change how a platform is built. Building the third requires the audit capacity the first two never needed.
India’s IT Rules Already Test for an Editorial Role, but Not for Ranking Platforms
India’s IT Rules, 2021 already use the test the Ministry is now said to be considering, but only for publishers. A news aggregator or a publisher of online curated content is defined by the “significant role in determining” what users see, and falls under a separate code of ethics administered by the Ministry of Information and Broadcasting. Social media platforms that rank and amplify are not covered by that definition.
The wording sits in rules 2(1)(o) and 2(1)(u) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Part III then applies a three-tier structure to those entities: self-regulation by the publisher, self-regulation by a body of publishers, and oversight by the Central Government. Rule 3(1)(e) shows the idea is older than the proposal. It says transient storage involving no human, automated or algorithmic editorial control does not amount to hosting, and TES reads that as the rules already recognising that algorithmic editorial control bears on an intermediary’s obligations.
Two other provisions show how the mechanism would work. Rule 7 says an intermediary that fails to observe the rules loses the protection of Section 79(1) of the Act. Rule 6 lets the Ministry, by reasoned order, extend the additional duties of significant social media intermediaries to any other intermediary whose services create a material risk of harm to sovereignty, security or public order. That is the nearest Indian counterpart to the DSA’s systemic-risk test, with one difference: the Ministry makes the assessment itself.
The February 2026 amendments went further on design. Significant social media intermediaries must now deploy technical measures to identify certain categories of content and review those automated tools periodically for accuracy, bias and effect on privacy, and they must ask users to declare synthetic content and verify the declaration. These are duties about how a platform’s systems behave, set by the Ministry and reviewed by the platform itself. As TES reads the consolidated text, none of them reaches the ranking of lawful content or provides for an independent audit.
The doctrine is therefore not new to Indian law. What is new in the reported proposal is the target: the ranking and amplification of other people’s content by platforms that are not publishers.
The enforcement gap
The Digital Services Act has produced two non-compliance decisions. On 5 December 2025 the Commission fined X €120 million for deceptive blue checkmarks, a deficient advertising repository and failure to give researchers access to public data, all transparency obligations. On 28 May 2026 it fined Temu €200 million for failing to assess the systemic risks of illegal and unsafe products sold on the platform. Neither concerns the design of a recommender system.
That record matters for how the TikTok finding should be read. The X decision was the first of its kind, and its subject matter was procedural: a paid checkmark that falsely implied verification, an advertising repository that failed accessibility requirements, and terms of service that blocked researchers from independent collection of public data. One academic assessment described it as a symbolic punch to establish authority, noting that blue checkmarks are not among the most pressing problems in digital policy.
The X fine has since been paid, a Commission spokesperson confirmed in March 2026. Meanwhile TikTok has twice chosen to settle instead of litigate: binding commitments in August 2024 to suspend the TikTok Lite reward features in the EU, and again in December 2025 on advertising transparency.
The pattern is not that Brussels is soft on Chinese platforms. It is that the DSA’s enforcement capacity has so far been exercised on transparency and on product-safety risk assessment, where the evidence is documentary or product-based and the remedy is disclosure or a corrective plan. Algorithmic design is a different order of difficulty: it requires proving that a system causes harm, prescribing a fix, and then verifying that the fix worked. The rabbit-hole case would be the first time the Commission attempts all three.
What India would inherit
If India adopts the algorithmic-curation doctrine, it inherits the enforcement problem, not the enforcement machinery. A condition on safe harbour for social media creates liability exposure, which requires a regulator able to audit recommender systems, a technical standard to audit against, and a remedy that is more granular than blocking a service.
The reach of such a change would be wider in India than in Europe, because the platforms affected would include domestic ones. Reels, Moj, Josh and ShareChat all run engagement-weighted recommendation feeds. A rule that treats algorithmic ranking as editorial control applies to a Bengaluru startup exactly as it applies to ByteDance, and a liability regime without an audit standard leaves every one of them exposed to a discretionary judgment about what their feed “determines.”
There is a sovereignty argument for doing it anyway, and it is the stronger one. A country that cannot inspect an algorithm is left with blocking the service that runs it, the instrument India used in 2020. A country that can inspect an algorithm can set conditions, require changes and verify them. The rethink of safe harbour for social media is the most direct attempt to build the second capability, and TES has tracked the wider logic in India’s sovereign AI doctrine, where the same shift from exclusion to control is visible.
The information domain is where this doctrine will be tested first, as TES argued in its analysis of why perception has become decisive terrain in modern conflict. An algorithm that shapes what a population sees is an instrument of influence before it is a product, and the regulatory question follows from that.
What India should avoid is importing the doctrine without process attached to it, and the process India already has was built for a different job. The IT Rules require a reasoned written intimation, naming the legal basis and the URL, from an officer of Joint Secretary rank or above before the three-hour takedown clock starts, with monthly Secretary-level review.
The Rules also require a hearing before liability is imposed on a significant social media intermediary, and notice and a chance to dispute when a platform removes content on its own. Those safeguards govern the removal of specific content. Nothing in them says what evidence would show that a ranking system is acting as an editor, who would decide, or what reply the platform gets.
The DSA supplies that: a right of defence, a set period to reply, consultation of a board of national regulators, a published evidentiary basis and a reasoned decision. A condition imposed through executive discretion without an equivalent would, in TES’s assessment, be weaker than the ban it replaces, because it would chill far more speech while proving far less.
The geopolitics, stated plainly
The finding sits inside a European project of tech sovereignty — the portfolio of the responsible Commissioner is literally titled Tech Sovereignty, Security and Democracy — and it runs in parallel to a different American settlement of the same platform. The United States resolved TikTok through ownership; the European Union is resolving it through design; India resolved it through prohibition.
The three instruments are worth comparing for what each actually bought. Washington’s TikTok USDS joint venture closed in January 2026 with Oracle, Silver Lake and MGX holding 15 per cent each and ByteDance retaining 19.9 per cent, per the consortium’s own announcement. The venture secured US user data in Oracle’s cloud and retrains the recommendation algorithm on US data. The algorithm itself was licensed, not sold.
That arrangement addresses custody. It does not address what the algorithm does, and it has no effect on the feed a user in Manila or Munich sees. Brussels is legislating precisely where Washington settled: the design of the recommender, not the nationality of its custodian. The two settlements are orthogonal, and neither substitutes for the other.
India’s contribution to this comparison is the oldest and the bluntest. Blocking 59 applications in 2020 removed the platform and, with it, an ecosystem of regional-language creators who had found their first audience there. The cost was real and it was borne by Indian users. What a rethink of safe harbour for social media offers is a way to exercise the same sovereign concern without repeating that cost — provided the audit capacity is built to match the ambition.
What to watch
- TikTok’s written reply and the Board’s opinion. If the Commission holds its position on disabling viewing time as a recommendation signal, the first design mandate on a recommender system in a democracy becomes real.
- Whether India publishes a draft amendment or a consultation paper. A published draft with a defined audit standard would be a serious instrument. An executive notification without one would be a liability regime with no evidentiary floor.
- Who audits, and against what. The DSA requires very large platforms to submit to independent audits and to give vetted researchers data access. The IT Rules, as updated to 10 February 2026, require significant social media intermediaries to review their own automated tools, but TES found no independent audit or researcher data-access provision. Watch whether the IT Ministry proposes one.
- Whether the domestic platforms are consulted. Reels, Moj, Josh and ShareChat would carry the same obligations as ByteDance under a design-based rule. Their absence from the debate so far is conspicuous.
- Whether a DSA decision is tested in court. A General Court ruling on the X or Temu decision would test how much deference the Commission’s evidentiary method receives, which matters for every case after it.
The useful reading of the past week is that two regulators were reported to be acting on the same idea about recommendation algorithms within days of each other, from different legal traditions and for different reasons. That convergence is the news. The European finding will generate the headlines because it names a company and carries a fine ceiling, and India’s review of safe harbour for social media will generate far fewer because it is a discussion, not a decision.
The doctrine is now in circulation in both capitals, and it is a sound one. An algorithm that decides what a billion people see next is not a conduit, and the law should stop pretending otherwise. What remains unresolved is the harder question the doctrine creates: once a state can regulate the shape of a recommendation, who decides what shape is acceptable, on what evidence, and with what right of reply for the company that built it?
Brussels has begun answering that with procedure, and has two fines to show for its first three years of enforcement. New Delhi is at the stage of asking the question. The temptation will be to answer it with a notification, because that is faster and because blocking under Section 69A is already done by executive direction. Resisting that temptation, and building the audit capacity the doctrine requires, is the choice that will decide whether India’s second attempt at platform sovereignty is better than its first.
Source note: EU findings from the European Commission press release IP/26/2361 of 6 November 2026. Enforcement record from Commission decisions of December 2025 and May 2026 and published case registers. India’s deliberations on safe harbour for social media from Indian Express and Business Standard reporting of 4 and 5 November 2026; the 2020 blocking action from a PIB feature of 4 July 2020 and contemporaneous reporting; India’s existing intermediary rules from the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as updated to 10 February 2026.
Note on scope: This article analyses regulatory doctrine and enforcement practice. It does not assess the merits of any pending investigation, and the European Commission’s findings remain preliminary and subject to the company’s right of defence. Statements attributed to officials are reported as their positions.
