ARTICLE
23 March 2026

Major Platform Hit With DSA Breach – What Could This Mean?

BD
BDO Malta

Contributor

Forming part of BDO’s Global Network, BDO Malta is a professional services and advisory firm, assisting companies in accelerating business growth through exceptional client service. Established in 1978, BDO Malta provide a wide portfolio of services including regulatory advisory, outsourcing, audit and assurance, tax & technology regulatory compliance to assist clients across different industries in growing their businesses efficiently.
On the 6th of February 2026, the European Commission issued preliminary findings indicating that a major social media platform's design, specifically its use of infinite scroll, autoplay, push notifications and a highly‑personalised recommender system, may breach the Digital Services Act (DSA). This through fostering compulsive use and undermining users' mental and physical wellbeing, with particular concern for minors and vulnerable adults.
Malta Technology
Lara Borg Bugeja’s articles from BDO Malta are most popular:
  • within Technology topic(s)
  • in United States
BDO Malta are most popular:
  • within Government, Public Sector and Employment and HR topic(s)

On the 6th of February 2026, the European Commission issued preliminary findings indicating that a major social media platform's design, specifically its use of infinite scroll, autoplay, push notifications and a highly‑personalised recommender system, may breach the Digital Services Act (DSA). This through fostering compulsive use and undermining users' mental and physical wellbeing, with particular concern for minors and vulnerable adults. The Commission considers the platform's current safeguards insufficient and signals that design‑level changes, such as meaningful screen‑time breaks could be required, while noting the company retains its' right to respond and these views do not prejudge the outcome.

The focus on minors aligns with the EU's broader push on child online safety, illustrated the same week by an EU‑wide action plan against cyberbullying, however, the explicit recognition of vulnerable adults widens the enforcement lens and may shape future expectations for advertising, engagement design, and software features across sectors, not only for very large platforms, but also for businesses that market to, or are accessible by, at‑risk users. In practice, companies should anticipate tighter platform policies, greater scrutiny of "sticky" UX patterns, and higher proof burdens for effective risk mitigation where vulnerable groups are in scope.

Failures alleged under the DSA

Two central shortcomings are highlighted:

Risk assessment: The platform allegedly failed to adequately assess how the above features could harm users (e.g., not sufficiently considering night‑time use by minors, session frequency or maintaining records of any other indicators of compulsive use).

Risk mitigation: The Commission says current safeguards, such as screen‑time tools and parental controls, appear ineffective (too easy to dismiss, or too complex for parents to configure), suggesting that deeper, design‑level changes may be required (e.g., disabling infinite scroll over time, introducing meaningful screen‑time breaks, including at night).

A Regulatory Shift with Wider Implications

The Commission's preliminary view that certain design features may foster compulsive use, particularly among minors and vulnerable adults, highlights a regulatory position with implications extending beyond large social‑media platforms. In sectors where user vulnerability, psychological triggers, financial exposure, or youth engagement are inherent characteristics of the service, digital‑design scrutiny may intensify significantly. This perspective is reinforced by the Commission's broader digital‑safety agenda, including the EU‑wide cyberbullying action plan published in February 2026, which underscores the Union's heightened focus on online risks affecting children.

Simultaneously, the Commission's preliminary findings describe how features such as infinite scroll, autoplay, and personalised recommender systems may create "autopilot" patterns of behaviour, potentially reducing self‑control in both minors and vulnerable adults.

Behavioural Design Features as Emerging Risk Factors

Within this context, high‑risk digital verticals, such as gambling services, fintech applications, health and wellness tools and educational or youth‑oriented platforms, may be positioned for closer examination under the DSA's risk‑assessment framework. Services built around reward cycles, financial incentives, behavioural nudges or rapid‑decision mechanics could be evaluated with greater attention to how their engagement design interacts with user psychology. For instance, platforms offering betting or rapid‑transaction features may be viewed through the same lens as addictive engagement loops, given the parallels in behavioural reinforcement patterns.

Similarly, fintech tools that spur high‑frequency trading or encourage recurring micro‑interactions could be scrutinised for the friction, or lack thereof, embedded in their design. Health and wellness applications that rely on persuasive notifications or streak‑based prompts may also face questions about how they balance motivation with potential overuse.

Intensified Scrutiny for High‑Risk Digital Services and Vulnerable Users

The emphasis on vulnerable adults could broaden the regulatory concern to individuals experiencing cognitive impairments, financial hardship, addiction recovery, or other circumstances reducing resilience to persuasive technologies, an inclusion that may shape expectations across high‑risk markets that rely on constant user engagement. This shift, combined with the Commission's 2026 legislative priorities focusing on safeguarding citizens and strengthening digital protections, suggests a trajectory in which system‑level design choices, not only content or advertising practices, become central to compliance expectations across the EU's digital economy.

What could this mean?

Although this is, for now, the only case in which the Commission has articulated such a position, its eventual outcome and the public reaction that follows, may prove highly influential. Should the Commission's reasoning be upheld, it could set a persuasive precedent that shapes future enforcement patterns under the DSA and beyond. In turn, this may encourage the EU to explore wider regulatory initiatives that more explicitly address the behavioural and design‑driven risks highlighted in this investigation. As policymakers, industry stakeholders, and civil society continue to scrutinise the role of persuasive digital environments, this moment may well become an early signal of a broader shift in how the EU approaches system‑level design governance across the digital economy.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More