01The algorithm as a rabbit hole
In December 2022 the Center for Countering Digital Hate (CCDH) created new accounts registered as 13-year-olds and measured how quickly harmful content appeared. The result: suicide content within 2.6 minutes, eating-disorder videos within 8 minutes, and content about body image and mental health every 39 seconds. Accounts with usernames such as "loseweight" received 12 times more self-harm recommendations. 56 identified eating-disorder hashtags had a combined 13.2 billion views. Three months later, another 1.6 billion had been added.
Amnesty International confirmed the findings in two reports (November 2023, and October 2025 with Northeastern University): the first depressive content appeared after 5 minutes, and after 15 to 20 minutes the feeds consisted "almost entirely" of it. After 45 minutes came videos about suicidal thoughts, after 3 to 4 hours videos that romanticised suicide or showed methods. Ten automated test accounts confirmed that the pattern is systemic. TikTok's recommendation system doubles the share of depressive content as soon as similar videos appear in the viewing history.
What the research says
Jain et al. (2025) analysed 26 studies with 11,462 participants: frequent TikTok use correlates with increased symptoms of anxiety and depression, especially among under-24s. Prevalence of use: 80.19%.
Conte et al. (2024) published a review of 20 studies with 17,336 participants from ten countries in European Child & Adolescent Psychiatry and identified four categories of effect: general harm to mental health, behavioural addiction, body image and self-esteem, and the spread of pathological behaviours. The authors stressed that most studies show correlation, not causation.
US Surgeon General Vivek Murthy: adolescents who spend more than 3 hours a day on social media face double the risk of symptoms of depression and anxiety. Average use rose to 4.8 hours a day by 2024. In 2024 Murthy called for warning labels on social media, similar to those on tobacco.
The addiction mechanism: dopamine and internal documents
TikTok's addictive potential rests on documented neurobiological mechanisms: changes in dopamine pathwaysDopamineA neurotransmitter in the brain linked to reward and motivation. TikTok's endless stream of videos causes constant dopamine release. The brain gets used to it and wants more. and structural shifts in the prefrontal cortexPrefrontal cortexThe part of the brain behind the forehead responsible for impulse control and rational decisions. Not yet fully developed in adolescents, which is why they find it harder to control screen time. and the amygdalaAmygdalaThe brain's fear centre. It processes emotions and stress. Long-term social media use can change the amygdala structurally. through long-term use (PMC review, 2025). The endless stream of short videos creates a constant expectation of reward: intermittent reinforcementIntermittent reinforcementThe principle behind slot machines and TikTok: unpredictable rewards (one good video after three boring ones) create stronger dependence than constant rewards.. The TikTok Addiction Scale (TTAS), developed in 2025, found that TikTok appears to be more addictive than other social media apps.
The most damning evidence comes from leaked internal TikTok documents (October 2024), which became public through a lawsuit by the Kentucky Attorney General that had been redacted incompletely by mistake:
260 videos
= the threshold for forming a habit. With 8-second videos it is reached in theory within 35 minutes. Internal document: "minors do not have executive mental function to control their screen time."
- Average daily use by teenagers (internal): 108.5 minutes
- The 60-minute limit (March 2023) reduced use by 1.5 minutes a day
- Internally, the limit's success was measured by how it was "improving public trust in the TikTok platform via media coverage", not by any reduction in use
- Executives rejected a hard time limit: less scrolling means less advertising revenue
- Children under 13 were described internally as a "critical target group" (our translation)
The internal leakage ratesLeakage rateThe percentage of content that breaks the rules but stays online despite moderation. At 100% leakage not a single violation is removed. For fetishisation of minors, that is the case at TikTok., meaning content that violates the guidelines but is not removed:
Deaths from the Blackout Challenge
The Blackout Challenge (children choking themselves until they pass out) has cost the lives of at least 15 to 20 children, according to documented cases.
Deaths documented by name
Arriani Jaileen Arroyo (9, Milwaukee, Feb. 2021) · Lalani Erika Walton (8, Texas, 2021) · Joshua Haileyesus (12, Colorado, 19 days on life support) · Nylah Anderson (10, Pennsylvania, Dec. 2021) · a 10-year-old girl in Palermo (Jan. 2021, first documented case) · Isaac Kenevan (13, Essex, UK) · Archie Battersbee (12, Essex, UK, 4 months on life support, August 2022) · Julian "Jools" Sweeney (14, UK, 2022). In France: Marie Le Tiec (15, 2021) and Charlize Dapui-Parkiet (15, November 2023). In February 2025 four British families sued together. 11 French families are bringing a group action.
In August 2024 the Third Circuit Court of Appeals ruled in the Nylah Anderson case that Section 230Section 230A US law that exempts platforms from liability for user-generated content. In 2024 a court ruled that this protection does not cover algorithmic recommendations, setting a precedent. does not apply to algorithmic recommendations, a precedent with far-reaching consequences for platform liability.
Senate hearings and lawsuits by attorneys general
On 31 January 2024 TikTok CEO Shou Zi Chew appeared before the Senate Judiciary Committee under subpoena. Senator Lindsey Graham told the tech CEOs: "You have blood on your hands." Mark Zuckerberg stood up and apologised publicly to the parents of children who had died.
On 8 October 2024, 14 attorneys general (New York, California and others) filed lawsuits: addictive design through infinite scroll and autoplay, knowingly misrepresenting the app as safe for children, years of knowledge about the harm, and thousands of underage users in paid LIVE streams.
The FTCFTCFederal Trade Commission, the US consumer protection agency. It sued TikTok over systematic violations of children's privacy law. sued on 2 August 2024 over systematic COPPACOPPAChildren's Online Privacy Protection Act, the US law protecting the data of children under 13. It prohibits collecting personal data without parental consent. violations: data from millions of children under 13 collected without parental consent, and known children's accounts not deleted. According to internal communications, TikTok's own child safety officer warned that the company had actual knowledge of underage users and was doing nothing.
EU action and GDPR fines
In February 2025 TikTok discovered that EEA user data had in fact been stored on servers in China, contrary to sworn statements given to the DPC. On 6 February 2026 the European Commission found provisionally that TikTok's design has addictive features that breach the Digital Services ActDSAAn EU law in force since 2024 that obliges large platforms to provide transparency, carry out risk assessments and protect minors. Violations: up to 6% of global turnover.: an "autopilot mode" created by endless scrolling. The possible fine: up to 6% of global annual turnover (about 9.3 billion dollars).
Focus 2: sale, privacy & censorship02The forced sale
The critical point
ByteDance keeps the intellectual property in the recommendation algorithm under a licensing model, with no full transfer. Lawmakers from both parties criticise this as a possible breach of PAFACAAPAFACAAProtecting Americans from Foreign Adversary Controlled Applications Act, a 2024 US law forcing the sale or ban of TikTok in the US., which prohibits any "cooperation with respect to the operation of a content recommendation algorithm" between ByteDance and a successor company.
Project Texas: 1.5 billion dollars for security, or for marketing?
Project Texas was TikTok's security programme, costing about 1.5 billion dollars, developed during negotiations with CFIUSCFIUSCommittee on Foreign Investment in the United States. It reviews foreign investment for security risks. It negotiated with TikTok for years but never approved a solution.. All US user data is stored on Oracle cloud servers in the US; Oracle monitors data flows and reviews source code. The independent auditors HaystackID and OnDefend (commissioned by TikTok USDS itself) found no evidence of unauthorised data access after six months.
At the congressional hearing, committee chair Cathy McMorris Rodgers called Project Texas a marketing scheme. CFIUS never formally approved the arrangement. Congress finally concluded that no technical measure short of a full sale would be enough, and passed PAFACAA.
Evidence of algorithmic censorship
The Network Contagion Research Institute (NCRI) at Rutgers University provides the most solid evidence: a study (December 2023) found that topics sensitive to the Chinese Communist Party (Tiananmen, Tibet, the Uyghurs, Hong Kong) were significantly under-represented on TikTok compared with Instagram. A follow-up study (August 2024) created 24 test accounts on TikTok, YouTube and Instagram and searched for the same terms:
A peer-reviewed study in Frontiers in Social Psychology (2024) confirmed that heavy TikTok use correlates with 49% more positive attitudes to China's human rights record compared with non-users. Documented individual cases: Feroza Aziz was blocked (Nov. 2019) after a video about the Uyghurs, Enes Kanter Freedom was blocked (March 2023, shortly before Chew's testimony), and videos by the Uyghur user Nefise Oguz were deleted (2024).
China's legal tools for access to data
ByteDance is headquartered in Beijing and has an internal Communist Party committee. China's legal framework creates the following obligations:
- National Intelligence Law (2017), Art. 7: every organisation shall "support, assist and cooperate" with intelligence work
- Cybersecurity Law (2017), Art. 28: network operators must provide technical support to security authorities
- Data Security Law (2021): applies extraterritorially to Chinese companies
- Counter-Espionage Law (2023): extended to data "related to national security and interests"
A BuzzFeed News investigation (2022) based on 80 internal meetings confirmed that China-based ByteDance employees had accessed non-public data of US TikTok users. Forbes reported in 2023 that American creators' Social Security numbers had been stored in China and were accessible to ByteDance employees.
Focus 3: data collection, influence & surveillance03What TikTok collects
TikTok's privacy policy explicitly lists: device IDs, IP addresses, screen resolution, battery status, audio settings, operating system, advertising identifiers, and explicitly "keystroke patterns or rhythms". TikTok says this refers to the timing of key presses for security purposes. Users cannot opt out.
In 2021 TikTok extended the policy to include biometric faceprintsBiometric dataUnique physical characteristics such as facial geometry and voice patterns. Unlike a password, they cannot be changed. TikTok has collected them since 2021. and voiceprints, after a 92-million-dollar settlement over violations of the Illinois Biometric Information Privacy Act. Since January 2026 the new policy under the US ownership structure allows precise GPS location data for the first time. Previously this had been explicitly excluded.
The keylogger finding (Felix Krause, August 2022)
TikTok's iOS in-app browser injects JavaScript code into every external website. The code subscribes to every keystroke, potentially passwords and credit card numbers. Krause: "From a technical perspective, this is the equivalent of installing a keyloggerKeyloggerSoftware that records every keystroke: passwords, credit card numbers, messages. TikTok's in-app browser injected code that makes this technically possible. on third party websites." TikTok was the only one of the seven apps tested to behave this way. TikTok then said it no longer logged key events. Krause warned, however, that Apple's WKContentWorld system allows invisible JavaScript execution, which makes future detection practically impossible.
Ad tracking: TikTok Pixel, Events API and Advanced Matching
TikTok's advertising ecosystem is designed to get around tracking blockers:
- TikTok Pixel: JavaScript code on advertisers' websites tracks what users do after clicking a TikTok ad
- Events APIEvents API / CAPIConversion API: a server-to-server connection between advertisers and TikTok. It bypasses ad blockers and cookie restrictions completely, because the data does not pass through the browser. (CAPI): a server-to-server connection that bypasses ad blockers and cookie restrictions entirely: 13% more events captured and up to 60% more tracked conversions
- Advanced Matching: links anonymous website visits to TikTok profiles using email addresses and phone numbers
Under the new US ownership structure, TikTok has expanded its advertising network to use collected user data for ads outside TikTok across the web.
State influence operations
Russia runs the most extensive documented influence operations on TikTok. A single "Doppelganger" campaign used around 13,000 accounts and achieved hundreds of millions of views. Daily engagement with Russian state-aligned TikTok accounts rose from 3 million (2022) to 13 million (2024). 78 Russian-funded media channels had more than 14 million followers.
The most serious case: interference in Romania's presidential election (November 2024). About 25,000 TikTok accounts stepped up their activity two weeks before the vote. On 11 November, 797 accounts dormant since 2016 were activated in a coordinated way via Telegram. The far-right candidate Călin Georgescu rose from 5 to 23% in three weeks. Romania's Constitutional Court annulled the election on 6 December 2024, the first EU election annulled because of social media manipulation.
China uses the Spamouflage network, according to Meta the largest covert influence campaign ever uncovered. It is active on TikTok too, with AI-generated newsreaders. A Chinese state company holds 1% of ByteDance with "golden sharesGolden shareA special shareholding with disproportionate control rights. A Chinese state company holds 1% of ByteDance but gets three board seats for it." that grant three board seats. Surveys showed that TikTok users in Taiwan held perceptions that closely matched Chinese propaganda.
Iran runs AI-assisted multilingual disinformation campaigns, documented in June 2025 in Farsi, Arabic, Hebrew and English with AI-fabricated images.
Political polarisation and radicalisation
By reverse-engineering the algorithm, Shin & Jitkajornwanich (2024) found that a large share of far-right content can be attributed to platform recommendations through radicalisation pipelinesRadicalisation pipelineAn algorithmic path that leads users step by step from moderate to extreme content. The algorithm recommends increasingly radical videos because they generate more engagement.. West Point's CTC Sentinel (2025) identified TikTok as a "soft entry zone" for the radicalisation of European lone attackers since October 2023. Li, Cheng & Gil de Zúñiga (2025) analysed 160,000 accounts and 16 million videos: right-wing communities on TikTok are more isolated from other political groups and mainstream media.
Douyin vs. TikTok: a deliberate decision
For Chinese children, ByteDance runs a fundamentally different version, Douyin, as a deliberate business decision.
| Safeguard | Douyin (China, under 14) | TikTok (international) |
|---|---|---|
| Daily limit | 40 min, cannot be bypassed | 60 min, can be bypassed |
| Curfew | 10 pm to 6 am, mandatory | None |
| Content for young people | Educational only (STEM, history, museums) | Same as for adults |
| Age verification | Real identity + face recognition | Self-declaration |
| Parents can lift limits | No | Yes |
| Algorithm optimised for | Educational value | Engagement and time spent |
Transparency reports: extensive, but with gaps
In 2024 TikTok removed more than 500 million videos (in Q3 2024 alone: 147 million videos, 1.3 billion comments, 214 million accounts). Monthly reports on influence operations document regular network takedowns. China submitted zero removal requests to TikTok, even though Chinese influence operations are extensively documented on other platforms. In February 2024 TikTok removed the view counts on hashtags after researchers had analysed them. Researchers have lacked this data source ever since.
Conclusion04Three key findings
① TikTok knew and did nothing
According to internal documents, the 60-minute limit was designed as a PR tool; its success was measured by public trust. Children were seen as a "critical target group". The gap between public promises and internal action is documented and is the subject of ongoing court cases in the US, in France and at EU level.
② The deal has not solved the core problems
ByteDance keeps 19.9% and the intellectual property in the algorithm (licensing model). Whether licensing instead of a full transfer meets the legal requirements of PAFACAA remains legally unresolved. Five executive orders suspending a law upheld by the Supreme Court have raised new constitutional questions.
③ TikTok acts as a vector for state influence operations
The annulment of Romania's presidential election in December 2024 marks the first time an EU election was annulled because of social media manipulation. The systematic under-representation of content critical of the Communist Party (whether deliberate manipulation or an algorithmic artefact) remains debated. China's laws oblige companies to cooperate with intelligence and security services, and ByteDance remains structurally tied to the Communist Party.