Brussels Draws a Line: EU Finds Meta’s Infinite Scroll and Autoplay Breach the DSA

Brussels Treats the Feed Itself as the Violation

For most of the platform-regulation era, enforcement has targeted what companies say or fail to remove — disinformation, illegal content, fake reviews. On 10 July 2026, the European Commission shifted the target to how a platform is built. The Commission announced it had preliminarily found that Meta’s Facebook and Instagram breach the Digital Services Act because the company “did not adequately assess the risks of its addictive design on the physical and mental wellbeing of users, including minors and vulnerable adults.”

The features named are not exotic. TechCrunch reports the Commission’s list covers infinite scroll, autoplay, push notifications, Reels and Stories, and Meta’s “highly personalized recommender systems” — the ordinary mechanics of every major consumer feed built since 2015. What changed is the legal framing: the Commission now argues these mechanics, individually mundane, “fuel the user’s urge to keep scrolling and shift the brain into autopilot mode,” as The Register summarized the Commission’s language, and that Meta failed to properly assess or mitigate that effect before shipping it to hundreds of millions of EU users.

The exposure is real money. The Commission can impose fines of up to 6% of Meta’s total global annual turnover if the preliminary finding is confirmed — a ceiling The Register put at roughly $12 billion at Meta’s current revenue scale. Meta disagreed with the findings and told MacRumors it had “taken significant steps to protect teens,” but the case now moves into a formal response period before any final decision.

This is not Meta’s first 2026 collision with the Commission. TechCrunch notes it is the second EU enforcement action against Meta this year; the Commission had already found Meta failing to prevent under-13s from using its platforms. The addictive-design case, though, is broader — it does not target a single failure to enforce an age limit, it targets the core engagement loop of the product.

The Legal Theory Behind “Addictive Design”

The Commission is not inventing a new law — it is applying two existing DSA obligations to a category of harm that has mostly lived in academic papers and congressional hearings until now. Legal analysis from Slaughter and May traces the theory to Articles 34 and 35 of the DSA, which require Very Large Online Platforms to identify systemic risks arising from the “design, functioning and use” of their service — including risks to users’ physical and mental wellbeing — and to put in place “reasonable, proportionate and effective” mitigation measures.

Crucially, Meta is not the first platform to be tested against this theory. The same law firm’s analysis notes that the Commission issued an equivalent preliminary finding against TikTok in February 2026 for the same cluster of features — infinite scroll, autoplay, and engagement-tuned recommendations. Meta’s case is the second major application of the theory, and the first against a platform of Facebook and Instagram’s combined scale, which is what makes it a heavier precedent than the TikTok case alone: if it survives Meta’s response and any subsequent appeal, “addictive design” becomes a standing compliance category for every VLOP operating in the EU, not a one-off action against a single company.

The Commission did not stop at flagging the problem — it specified what it wants changed. Per the Slaughter and May analysis, the Commission expects Meta to disable autoplay and infinite scroll by default, build in real screen-time breaks, and make the recommender system “less engagement-oriented.” The Commission separately criticized Meta’s existing time-management tools as “easily dismissed” and its parental controls as requiring too much technical knowledge to use effectively — meaning cosmetic settings buried three menus deep will not satisfy the risk-mitigation requirement.

5Rights Foundation, a child-safety advocacy group whose research fed into the original investigation opened in May 2024, framed the stakes bluntly. Executive Director Leanda Barrington-Leach said: “Young people deserve digital services that are safe by design, not with half-measures bolted on afterwards.” The organization’s position — that opt-out tools cannot counteract a product deliberately engineered for maximum engagement — is close to becoming EU regulatory doctrine rather than an advocacy talking point.

What Platform Compliance and Product Teams Should Do About It

1. Audit every engagement mechanic against the Article 34 systemic-risk test, not just your safety-feature checklist

Most VLOPs already run risk assessments for illegal content, disinformation, and election integrity because those are the harms DSA enforcement has focused on since 2023. The Meta case establishes that infinite scroll, autoplay defaults, notification cadence, and recommender tuning now belong in the same documented risk-assessment process, with the same evidentiary bar: you need a written record showing you evaluated the mental-wellbeing impact of the mechanic and can justify why the mitigation you chose is “reasonable, proportionate and effective,” per the Article 34/35 language cited in the Slaughter and May analysis. A settings page is not a risk assessment.

2. Replace dismissible nudges with real circuit breakers before a regulator tells you to

The Commission specifically called out Meta’s time-management tools as “easily dismissed” and its parental controls as too technical to use. If your product’s answer to engagement concerns is a one-tap-dismiss popup or a toggle buried in account settings, that is precisely the pattern Brussels just rejected as inadequate mitigation. Building default-on breaks and non-dismissible pacing cues now — even outside the EU — is cheaper than retrofitting them under a compliance deadline later.

3. Prepare a “less engagement-oriented” recommender fallback before it becomes a mandate

The Commission’s remedy list explicitly asks for a recommender system tuned toward something other than maximum engagement. Teams that wait for a final decision to start this work will be building it under a court-imposed timeline with regulators reviewing the output. Running an internal A/B test now — a recommender variant optimized for session-length caps rather than watch-time — gives product and legal teams real data to negotiate from if a mitigation order arrives.

4. Price the 6% turnover ceiling into product roadmaps, not just legal reserves

A fine of up to 6% of global annual turnover is not a line item legal can absorb quietly — at Meta’s scale, The Register’s estimate puts that near $12 billion, larger than many platforms’ entire annual R&D budget. Compliance and product leadership should model the fine exposure against the cost of the design changes the Commission is asking for; in most cases, disabling autoplay-by-default or capping notification frequency costs a fraction of a percent of that ceiling, which reframes “addictive design compliance” from a growth-metrics fight into a straightforward risk-adjusted budgeting decision.

Where This Fits in the EU’s 2026 Enforcement Wave

Meta’s case does not stand alone. It follows TikTok’s February 2026 preliminary finding on the same features, and it lands in a year when the Commission has also pursued Meta over under-13 access controls and pressed other marketplaces and platforms on separate DSA risk-assessment failures. Read together, the pattern is a shift from content-moderation enforcement — which dominated the DSA’s first two years — toward interface-design enforcement, where the violation is not a piece of content the platform failed to remove but a product decision it made on purpose.

That shift matters beyond Meta and TikTok. Article 34 and 35 obligations apply to every service the EU designates a Very Large Online Platform, and the remedies the Commission is asking Meta to adopt — default-off autoplay, real screen-time breaks, engagement-neutral recommenders — read like a template rather than a one-company settlement. If the finding is confirmed, any VLOP with an infinite feed, an autoplay default, or a notification-driven retention loop should expect the same risk-assessment bar to be applied to it next, whether or not the Commission has opened a formal case yet.

Frequently Asked Questions

Sources & Further Reading

• Commission preliminarily finds addictive design of Instagram and Facebook breach the Digital Services Act — European Commission
• EU threatens Meta with fines over addictive features on Facebook and Instagram — TechCrunch
• EU: Facebook and Instagram break digital rules — MacRumors
• EU puts addictive design of Facebook, Instagram under the DSA microscope — The Register
• Meta preliminarily found in breach of the DSA over addictive design — 5Rights Foundation
• Meta Joins TikTok in the Commission’s Crosshairs Over “Addictive Design” Under the DSA — Slaughter and May