Summary
We evaluated Instagram, YouTube, Snapchat, and TikTok against the European Commission's Article 28(4) DSA Guidelines, which set out recommendations for ensuring a high level of privacy, safety, and security for minors online. For each platform, we created test accounts across three age profiles (13, 16, and 21) and documented account and privacy settings immediately after registration, using a standardised checklist derived from the Guidelines' wording. Testing was conducted in May 2026.
Key Findings
- All four platforms set minor accounts to private by default - the most consistently implemented recommendation.
- Age verification relies almost entirely on self-declared date of birth.
- Most platforms lack accessible, age-appropriate safety information at sign-up.
- Autoplay cannot be disabled on 3 of 4 platforms; streaks, like counts, and read receipts remain active by default on most.
- Alignment ranks YouTube strongest, followed by TikTok and Instagram, with Snapchat weakest overall.
Beyond this shared baseline of account privacy, the platforms diverge sharply in how they handle age verification and registration transparency. Only YouTube, through mandatory parental involvement via a linked Google account, and TikTok, through a post-registration AI age-estimation system, go beyond self-declared date of birth. YouTube's registration flow also provides the most comprehensive safety information, while Instagram and Snapchat present only standard Terms of Service and Privacy Policy disclaimers.
Engagement-driving features present the most significant structural gap relative to the Guidelines. Autoplay cannot be disabled on Instagram, TikTok, or Snapchat, and features such as streaks, visible like counts, and read receipts remain active by default on most platforms - directly at odds with the Guidelines' recommendation that such features be off by default for minors.
YouTube shows the strongest overall alignment, due to its mandatory parental involvement structure and Family Link-mediated access, followed by TikTok, which applies the most systematic age-differentiated defaults among the conventional platforms, and Instagram, whose Teen Accounts framework covers privacy and messaging but little else. Snapchat shows the weakest alignment, with active defaults - streaks, read receipts, autoplay, appearance-altering filters - that work directly against the Guidelines' intent.
Recommendations
Give the Guidelines operational precision: The European Commission should clarify vague terms such as "friction mechanisms," "age-appropriate language," and "non-essential tracking" with sufficient specificity to support consistent assessment and enforcement.
Strengthen age verification beyond self-declaration: Platforms should implement age assurance measures that go beyond a self-declared date of birth.
Turn off engagement-driving features by default for minors: Platforms should disable autoplay, streaks, visible like counts, and read receipts by default for minor accounts.
DSA Monitor — funded by netidee.
This research was conducted as part of the “DSA Monitor” project, which was made possible by netidee funding from the Internet Foundation.
