The DSA’s Blind Spot: Ads Teenagers Still See on TikTok

TikTok is that space now for a huge number of teenagers, most of them there for close to an hour a day, and almost nobody outside the company running it knows what actually happens during that hour. What gets served to a 16-year-old, and why?

That question took months to answer properly, and it needed more than one kind of expertise to get there. I spent a good chunk of that time in developmental psychology and neuroscience literature, trying to understand what actually changes in a teenage brain that makes it process an ad differently than an adult’s does. Our legal researchers traced the DSA line by line to find the exact point where its protections for minors stop applying. And our engineers built and ran the technical infrastructure that let us test all of it against the real platform, rather than argue about it in the abstract. Put together, that team work won Best Paper last month at FAccT, the ACM Conference on Fairness, Accountability, and Transparency, the leading international venue for research on algorithmic accountability, selected from hundreds of submissions by a review panel that spans computer science, law, and social science. It’s the kind of room where a purely technical paper or a purely legal one tends not to make it through, which is probably the point. It’s also the room I ended up standing in front of a few days later.

Presenting it in front of a room that size was a different test than getting it through review, and a different crowd too, machine learning researchers sitting next to data protection lawyers sitting next to people who used to build the systems we study, all asking questions from completely different angles. Most of what came my way wasn’t about TikTok specifically, it was about the method: how we kept the accounts from getting flagged as bots over ten days, how confident we actually were in the vision-language model’s judgment, whether four interest categories were enough to build on, and what it would take to run this on a different platform entirely. Fair pressure, and better to get it in the room than not get it at all. What stayed with me more than the presentation itself were the conversations after, with people working on recommender system design, on sycophancy and delusion in conversational AI, on child safety from angles I hadn’t considered, on the actual design choices platforms make and why. Getting an hour with someone whose entire research life is adjacent to yours, but not the same, is rare, and Montreal turned out to be a genuinely good place for it to happen. The city has that particular hum of somewhere young and multilingual and slightly chaotic in the right way, and it being my first time in Canada gave the whole week an edge of novelty that a conference alone usually doesn’t have. Back to what the paper actually found, though, because that’s the part worth sitting with.

Here’s why the age matters so much. A teenage brain runs hot on reward circuitry and is years away from finishing the wiring that recognises persuasion, purely as a matter of biology. The EU’s Digital Services Act tries to account for this: it bans platforms from showing minors ads based on profiling. The catch is in the fine print. The law only counts something as an advertisement if a brand paid the platform directly to distribute it. An influencer showing off a product a brand mailed her for free, a company promoting itself on its own account, a creator with a discount code in the caption, none of that legally counts as advertising, no matter how commercial it is or how precisely it’s aimed at what she already likes.

So we built pairs of TikTok accounts, a minor and an adult, identical interests, identical location, different age, and let them run in parallel for ten days, tracking and classifying every single video the algorithm chose to show each of them. The tricky part was catching the ads that don’t announce themselves. TikTok labels the ones it’s paid to show, but nothing labels a discount code dropped in a caption or a product mentioned mid-video. For that, we used a vision-language model, essentially an AI that can look at video frames the way a person would, and trained it to spot the visual and verbal cues of commercial content that carries no disclosure label at all: product placements, brand mentions, promo codes, the works. We checked its judgment against our own manual review of a sample of videos and it agreed with our human annotators about 90% of the time, which is what let us trust the numbers that came out the other end.

The number that matters: on the narrow category of ads the law actually reaches, we found close to no targeting toward minors, TikTok gets that part right. On the much larger category sitting just outside the legal definition, the ads minors received were personalised to their stated interests at rates five to eight times stronger than anything the law permits for adults. TikTok found the exact gap the rule never closed, and used it.

Picture it like this: a 16-year-old girl who likes makeup scrolls TikTok for ten days. 92 out of every 100 unlabelled ads she’s shown are about beauty. Compare that to adults looking at properly labelled ads, the ones the law actually regulates, where that kind of interest-matching sits at 10 to 16 out of 100. Her feed runs five to eight times hotter on personalization than the law even allows, and none of it carries a label that would let her, or a regulator, notice.

The fix sits with the platforms, but it also sits with the law that’s supposed to hold them to something. Right now “advertisement” only means content a brand paid the platform to distribute, which is why an unlabelled haul video with a discount code in the caption doesn’t legally count as one, no matter how targeted it is. We think that definition needs to shift from who paid for it to what it’s actually for, and the profiling ban needs to expand right alongside it, otherwise all we’ve done is move the loophole somewhere else. On the platform side, the recommendation system, the disclosure defaults, the way commercial content gets flagged before it ever reaches a feed, all of it should run on a different set of rules the moment a platform knows it’s dealing with a minor, built into the backend, not left to a toggle a creator can ignore. Our own detection model caught undisclosed commercial content at close to 90% accuracy using nothing but publicly visible video frames; a platform with actual access to its own data has no excuse not to catch it before it’s shown to anyone, let alone a child. Most platforms currently hang a sign at the door that says no advertising to minors and call the job done. Regulators and platforms both need a way to check what’s actually happening in that hour a day, independent of whatever the platform chooses to report, which is what audits like this one are for. That’s what this paper actually is: not a guess about what a teenager’s feed looks like, but a way of measuring it, and now, a peer-reviewed one.