TikTok to withdraw the Rewards programme after the European Commission rules that it is addictive

On 5 August 2024, the European Commission (EC) made TikTok’s commitments, to permanently withdraw the TikTok Lite Rewards programme from the EU, binding. According to the EC, the Rewards programme was launched without prior diligent assessment of the risks it entails and without implementing mitigating measures. This decision is highly relevant, given that the EC has now closed formal proceedings against TikTok under the Digital Services Act (DSA) opened on 22 April 2024, and accepted commitments from the online platform, as a result of such formal proceedings.  

This article provides an overview of the TikTok Lite case and the steps TikTok should have followed to ensure compliance with the DSA. 

Designation as VLOPs/VLOSEs under the DSA and consequent obligations

As presented in one of our previous article, platforms/services with over 45 million average users (i.e., monthly active recipients) in the EU are designated as very large online platforms (VLOPs) or very large online search engines (VLOSEs) under the DSA. The providers of such services shall therefore ensure the application of more stringent rules set out by the DSA. As an example, prior to launching any new functionalities with potential critical impact on their systemic risks, the VLOP or the VLOSE should assess the risks stemming from such functionalities and adopt adequate mitigation measures, as presented in Articles 34-35 of the DSA.  

What TikTok Lite Rewards programme is and concerns raised by the Commission

On 25 April 2023, the Commission designated TikTok as a VLOP. TikTok is a social media platform that has gained considerable popularity among younger audiences. It offers users the opportunity to create personalised videos and to access frames of the creators’ everyday lives.  

Born as a separate version of the TikTok app, TikTok Lite was initially launched in France and Spain in March 2024. The TikTok Lite Rewards programme was designed to allow users to earn points (to be used, for example, for Amazon vouchers) while performing certain actions on the platform, such as watching videos, liking content, following creators and inviting friends to join TikTok.  

The programme generated several concerns for the EC, particularly in relation to the addictive effect it could have on users. According to the EC, the Rewards programme was “of particular concern for children, given the suspected absence of effective age verification mechanisms on TikTok”. In this regard, it should be noted that the first formal proceedings against TikTok, prompted by concerns about the effectiveness of the platform’s age verification mechanisms and its suspected addictive design, are still ongoing. In the EC’s view, before launching the TikTok Lite Rewards programme, the provider should have undertaken a more diligent risk assessment and applied more robust risk mitigating measures.  

As a result, the Commission has decided to make TikTok’s commitments to permanently withdraw the TikTok Lite Rewards programme from the EU binding. TikTok must also refrain from launching any other programme which might circumvent the withdrawal. Any breach of the commitments would immediately result in a breach of the DSA and could lead to fines. 

Which steps could TikTok have followed to ensure compliance with the DSA

In order to avoid any infringements of the DSA, prior to launching the TikTok Lite Rewards programme, the social network provider could have implemented a series of mandatory requirements, that could be summarised as follows: 

• Undertaking of a risk assessment, to identify, analyse and assess the systemic risks stemming from the design or functioning of the Rewards programme. The potential impact of the programme on users, especially minors, could have been critical, given the risk of addictive behaviour and its associated negative effects on the physical and mental health of users (see Article 34.1(d) DSA). Additionally, consideration of the influence of factors, such as the design of its recommender systems and any other relevant algorithmic system, on the systemic risks identified (see Article 34.2(a) of the DSA). 

• Implementation of specific mitigation measures, tailored to the systemic risks identified. This could have included testing and adapting their algorithmic systems, including their recommender systems (see Article 35.1(d) of the DSA). 

• Submission of a risk assessment report, to the EC, with the results of the risk assessment along with the specific mitigation measures put in place (see Articles 42.4(a-b) of the DSA). 

Conclusions 

The DSA requires social media providers to demonstrate a heightened level of transparency about the algorithms used to recommend content and products, as well as the potential addictive elements of their features. VLOPs/VLOSEs can foster a safe digital environment by proactively managing systemic risks and related mitigations. However, this activity may be challenging for the providers as it requires a synchronous collaboration across different areas of expertise to ensure a complete overview of the risks. Indeed, an adequate risk assessment should be approached not only from a legal perspective, but also from a technical, ethical and behavioural one. Taken this into account, it is useful to note that Article 35(2) DSA requires the European Board for Digital Services to publish an annual report which assesses and identifies the “most prominent and recurrent systemic risks” and best practices for mitigating such risks. In addition, Article 35(3) DSA permits the Commission, in cooperation with Digital Services Coordinators, to publish guidance on possible risk mitigation measures. 

Trilateral have longstanding expertise in undertaking risk assessments as well as Ethical AI assessment. Our team within the data protection and cyber risk advisory services (DCS) offer support as well as compliance assessments with an adaptable approach to digital service providers, among others. If you would like to find out more, please get in touch.