Summary

• The European Commission has preliminarily found Meta in breach of the Digital Services Act over addictive design on Instagram and Facebook.
• The case pushes platform regulation into product design, risk assessment, and user safety engineering.
• Although the services are consumer facing, the enforcement action has wider consequences for platform governance and compliance operations in Europe.

Meta is facing a preliminary European Commission finding that the design of Instagram and Facebook breaches the Digital Services Act, opening another test of whether platform regulation can reach directly into product mechanics.

The Commission has not issued a final decision, and Meta will be able to respond. Even so, the preliminary finding is notable because it treats addictive design as conduct that can fall inside the DSA’s risk management regime. That takes enforcement beyond illegal content and moderation systems into the design choices that shape user behaviour.

The DSA requires very large online platforms to identify, assess, and mitigate systemic risks, including risks to minors, public health, mental and physical wellbeing, civic life, and fundamental rights. In that context, recommender systems, engagement loops, notifications, frictionless sharing, default settings, and interface patterns are no longer merely product optimisation tools. They can become evidence in a regulatory case.

The Commission’s DSA guidance says very large online platforms must assess systemic risks and put mitigation measures in place, including changes to service design or recommender systems where needed. The Meta case pushes that logic towards one of the most commercially sensitive parts of the platform economy: engagement.

The commercial tension is obvious. Advertising funded platforms rely on attention, retention, targeting, and interaction. If regulators judge that certain design patterns create unacceptable systemic risk, compliance moves into the same room as revenue design. Product managers, designers, engineers, data scientists, trust and safety teams, lawyers, and risk specialists will need to build evidence that features are not only effective, but defensible.

Although Instagram and Facebook are consumer services, the precedent reaches wider. Marketplaces, social platforms, app stores, AI powered feeds, content networks, and large digital intermediaries all operate systems that shape user choice through design. European regulators are increasingly asking how those systems behave, not only what policies sit above them.

The case also sits alongside the Digital Markets Act, AI Act, Data Act, and GDPR as part of a broader European move towards operational regulation of digital systems. The approach is administratively heavy, and it will be contested by companies that argue regulators are becoming too involved in product design. However, Brussels is now moving from legislative architecture into concrete enforcement.

Regulators will need to be precise. Addictive design is a contested concept, and enforcement becomes weak if companies cannot understand which patterns cross the line or how mitigation should be measured. At the same time, it is no longer credible to treat product architecture as neutral. Infinite scroll, recommender optimisation, notification timing, and engagement prompts are intentional systems with measurable effects.

The internal governance challenge for platforms is therefore substantial. Risk assessments cannot sit in a compliance document after a feature is built. European product launches may need safety evidence, design review, user impact analysis, and audit trails before features reach scale.

The Commission’s preliminary finding against Meta shows how the DSA is changing the regulatory venue. In Europe, the design room is becoming part of the compliance perimeter.