TL;DR

• Brussels ordered Meta to switch off Facebook and Instagram’s “infinite scroll” and “autoplay” by default under the EU’s Digital Services Act (DSA), with penalties up to 6% of global turnover at stake. The European Commission’s preliminary findings arrived on July 10, 2026. [1][2][3]
• The bigger risk than a fine is an EU product fork that slows Meta’s experimentation velocity and trims Reels watch time and ad impressions—the twin growth levers Meta highlighted in its FY2025 report. [4]
• TikTok Lite’s April 2024 EU intervention showed the playbook: the Commission pushes live product changes, not PR or warning labels, when it labels a feature “addictive.” [5]

What the source said

AP reported that on July 10, 2026 the European Commission issued preliminary findings that Facebook and Instagram deploy “addictive design” features—autoplay, infinite scroll, push notifications, and engagement‑maximizing recommendations—that risk users’ physical and mental health, including minors across the EU‑27. The Commission wants Meta to disable those features by default, strengthen break prompts, and reduce the primacy of engagement in recommendations; Meta pointed to “Teen Accounts,” nightly lockouts, and a parent‑set 15‑minute time cap option as safeguards. If the findings become a formal decision, DSA penalties can reach 6% of Meta’s global revenue, and Meta can submit a response before any order is finalized. [1][3][6]

Why it matters

• Stakeholders span EU teens and parents (default safety versus DIY controls), EU ad buyers (fewer impressions per euro if sessions shorten), Meta shareholders (compliance costs, slower growth), and every other “very large online platform” (VLOP) designated under the DSA as Brussels redraws the line between “engaging” and “manipulative” design. [2][3][7]
• A DSA decision that hard‑codes design‑by‑default changes travels fast: it becomes a template for the UK and Australia and a data point for US state attorneys general litigating engagement features. The fine is a one‑off; the product constraints become a standing EU baseline. [2][5]

Original analysis

EU demands Facebook and Instagram dismantle design features it calls addictive for users

Consensus view: This is an EU shot across the bow that ends in a manageable fine and cosmetic tweaks. Contrarian read: The Commission is trying to edit the engagement stack itself, not negotiate labels—its April 2024 TikTok Lite move in France and Spain froze a rewards feature in days, signaling that “addictive design” triggers product shutdowns, not disclosures. [5]

Meta’s exposure is twofold: fines and experimentation friction. Meta’s growth engine depends on high‑throughput A/B tests on feeds, Reels, and notifications; default‑off autoplay and non‑infinite feeds in the EU force region‑specific branches that reduce statistical power and slow ranking rollouts. That drag does not show up in a penalty headline, but it compounds quarter after quarter for EU audiences and any global models trained with EU data in the mix.

Back‑of‑envelope calculation (the fine versus recurring drag):

• Meta FY2025 revenue: $200.966 billion. [4]
• Max DSA fine: 6% of global annual turnover. [3]
• 6% × $200.966B = $12.06B (0.06 × 200.966).
• A 2% ongoing revenue drag from sustained EU design constraints would be ≈$4.02B per year (0.02 × $200.97B), which can outweight a one‑time hit if constraints persist across 2026–2028 as enforcement matures. [4]

Historical analogue (TikTok Lite, 2024):

• In April 2024, the Commission opened DSA proceedings against TikTok Lite’s “rewards for watch time” in France and Spain, signaled interim suspension, and TikTok paused the feature across the EU almost immediately. The lesson from Brussels: if a feature is framed as addictive, the remedy is to disable it by default, not simply warn or label it. [5]

Named‑stakeholder breakdown:

• Meta: In 2025, ad impressions rose 12% year over year and average price per ad rose 9%, both sensitive to session length and video continuity—precisely what autoplay and infinite scroll amplify. Expect an “EU mode” that preserves recommendation quality while trimming endless continuity. [4]
• European Commission: After designating Facebook and Instagram as VLOPs, this becomes a flagship DSA test; a soft settlement undermines the regime, while a hard remedy establishes that “addictive design” can trigger binding defaults across the bloc. [2][7]
• Advertisers in the EU: Shorter sessions and fewer seamless video handoffs mean fewer mid‑scroll and mid‑video impressions; media buyers will seek higher‑quality creative, tighter frequency caps, and may swing incremental short‑form video spend toward YouTube if its defaults remain friendlier—until the Commission looks there, too. [2]
• US regulators and AGs: State AG complaints have argued that engagement‑maximizing defaults harm minors; an EU design mandate—if finalized—becomes fresh evidence that “safe defaults” are technically and commercially viable at scale. [2]

A typology for “engagement engines” under DSA pressure:

• Continuity drivers: autoplay and infinite scroll keep users moving without choices; squarely targeted for default‑off. [2]
• Trigger drivers: push notifications pull users back; expect rate limits, quiet hours, or higher‑friction opt‑ins as defaults. [2]
• Targeting drivers: personalized recommendations steer attention; not banned, but likely tuned for diversity and “breaks,” not pure watch‑through. [2]
• Guardrails: teen accounts, time caps, and break nudges exist today; the Commission says current versions are easy to dismiss and wants enforced, stickier defaults. [1][2][6]

The bottom line: Meta can write a check; it cannot easily replace the automaticity that turns short sessions into long ones, and the DSA aims straight at that mechanic. [2][3]

What others are missing

Coverage centers on fines and teen settings, but the hidden cost is product velocity in the EU‑27. Default‑off autoplay and scroll force Meta to split core feed logic, notification cadence, and Reels playback into a region‑specific branch, which multiplies concurrent experiments, shrinks per‑variant samples, and stretches time to statistical confidence for ranking tweaks. That slows learning loops on video, where small watch‑time deltas drive big ad‑impression gains; Meta’s FY2025 numbers show it leaned on ad impressions (+12% YoY) to grow, so a slower release cycle hits the revenue engine more than a headline penalty. [4]

What to watch next

1. By Q4 2026, Meta pilots an “EU mode” on Facebook and Instagram with default‑off autoplay and infinite scroll plus stronger break prompts, and claims in earnings or a blog post that engagement impact is “limited”; independent trackers (e.g., IAB Europe AdEx or SMI) show at least a 2‑percentage‑point EU shift of short‑form video ad spend toward YouTube by Q1 2027 if Reels watch time dips.
2. By H1 2027, the European Commission issues a final DSA decision that includes binding design commitments and either a symbolic fine under 2% of FY2025 revenue or a suspended fine contingent on milestones. [2][3]
3. By June 30, 2027, at least one other VLOP with heavy video autoplay—TikTok or YouTube—receives a formal DSA action focused on default design settings, confirming that “addictive design” enforcement is cross‑platform. [5][7]

My take

If I ran Meta’s EU product, I would stop litigating defaults and start shipping excellent “opt‑in continuity.” Make autoplay a clear choice with value—“Play next with sound off + topic diversity”—and instrument those opt‑ins for ranking. Treat Brussels as a lab for “engagement without compulsion,” then export wins globally; waiting for courts risks a ~$12.06B headline (6% of FY2025 revenue) and, worse, months of frozen roadmaps while regulators draft your release notes. [3][4]

Sources

1. EU demands Facebook and Instagram dismantle design features it calls addictive for users — AP News (https://apnews.com/article/facebook-instagram-eu-regulators-teens-addictive-b2f0ffd5ffc90721cacef7937e5909d2) — Straight report on July 10, 2026 findings, targeted features, and Meta’s “Teen Accounts.”

2. Commission preliminarily finds the addictive design of Instagram and Facebook in breach of the Digital Services Act — European Commission (https://digital-strategy.ec.europa.eu/en/news/commission-preliminarily-finds-addictive-design-instagram-and-facebook-breach-digital-services-act) — Official description of infinite scroll, autoplay, push notifications, and requested default changes.

3. The enforcement framework under the Digital Services Act — European Commission (https://digital-strategy.ec.europa.eu/en/policies/dsa-enforcement) — Legal basis for fines up to 6% of global annual turnover and the response process.

4. Meta Reports Fourth Quarter and Full Year 2025 Results — Meta Investor Relations (https://investor.atmeta.com/investor-news/press-release-details/2026/Meta-Reports-Fourth-Quarter-and-Full-Year-2025-Results/default.aspx) — FY2025 revenue ($200.966B), ad impressions (+12% YoY), average price per ad (+9% YoY), and regulatory commentary.

5. Commission opens proceedings against TikTok under the DSA regarding the launch of TikTok Lite in France and Spain — European Commission (https://digital-strategy.ec.europa.eu/en/news/commission-opens-proceedings-against-tiktok-under-dsa-regarding-launch-tiktok-lite-france-and-spain) — Precedent for rapid EU intervention and product suspension tied to “addictive” mechanics.

6. Beyond the Headlines: Meta’s Record of Protecting Teens and Supporting Parents — Meta Newsroom (https://about.fb.com/news/2026/01/metas-record-protecting-teens-supporting-parents/amp/) — Meta’s description of teen safeguards, including nightly lockouts and a 15‑minute time cap option.

7. Supervision of the designated very large online platforms and search engines under DSA — European Commission (https://digital-strategy.ec.europa.eu/en/policies/list-designated-vlops-and-vloses) — Confirms that Facebook and Instagram are designated VLOPs subject to enhanced DSA obligations.

When a Power Outage Looks Like Politics: TikTok’s U.S. Glitches and the Trust Test

A handful of spinning loading icons turned into a national conversation: were TikTok’s recent U.S. posting problems just a technical headache, or the first sign of politically motivated content suppression under new ownership? The short answer is messy — a weather-related power outage is the proximate cause TikTok and its data-center partner point to, but the timing and stakes make user suspicion inevitable. (investing.com)

Why people noticed — and why the timing matters

• TikTok users across the U.S. reported failures to upload videos, sudden drops in views and engagement, delayed publishing, and content flagged as “Ineligible for Recommendation.” Those symptoms arrived within days of the formation of a new U.S. joint venture that moved much of TikTok’s operations and data oversight stateside. (techcrunch.com)
• The company and Oracle (one of the new venture’s managing investors) say a weather-related power outage at a U.S. data center triggered cascading system failures that hampered posting and recommendation systems — and that they’re working to restore service. (investing.com)
• But because the outage overlapped with politically sensitive events — and came right after the ownership change — many users assumed causation: new owners, new rules, and sudden suppression of certain content. That leap from correlation to accusation is understandable in a polarized media environment. (wired.com)

The technical explanation (in plain language)

• Data centers host the servers that store content, run recommendation systems, and process uploads. When a power outage affects one, services can slow down, requests can time out, and queued operations (like surface-level recommendations) may be lost or delayed. (techcrunch.com)
• Complex platforms typically have redundancy, but real-world outages—especially weather-related ones affecting regional power or networking—can produce “cascading” failures where multiple dependent systems degrade at once. That can look like targeted suppression: a video suddenly shows zero views, a post is routed into review, or search returns odd results. Those are plausible failure modes of infrastructure, not necessarily evidence of deliberate moderation. (techcrunch.com)

The political and trust dimensions

• Ownership change matters. TikTok’s new U.S. joint venture — with Oracle, Silver Lake and MGX as managing investors and ByteDance retaining a minority stake — was explicitly framed as a national-security and data-protection fix. Because that shift was sold as protecting U.S. users’ data and content integrity, anything that looks like content interference becomes a high-suspicion event. (techcrunch.com)
• Political actors amplified concerns. State officials and high-profile voices raised alarms about potential suppression of content critical of political figures or about sensitive events. That political amplification shapes user perception regardless of technical facts. (investing.com)
• The reputational cost is asymmetric: one glitch can undo months (or years) of trust-building. Even if an outage is genuinely technical, the brand hit from a moment perceived as censorship lingers.

What platforms and users can learn from this

• Operational transparency matters. Quick, clear explanations from both the platform and its infrastructure partners — with timelines and concrete remediation steps — reduce the space for speculation. TikTok posted updates about recovery progress and said engagement data remained safe while systems were restored. (techcrunch.com)
• Technical resiliency should be framed as a trust metric. Redundancy, better failover testing, and public incident summaries help show that problems are infrastructural, not editorial.
• Users want verifiable signals. Independent third-party status pages, reproducible outage telemetry (e.g., Cloudflare/DNS data), or audits of moderation logs (where privacy and law allow) are examples of credibility-building tools platforms can use. (cnbc.com)

What this doesn’t settle

• An outage explanation doesn’t erase legitimate long-term worries about who controls recommendation algorithms, moderation policies, and data access. The ownership shift was built to address national-security concerns — but it also changes who sits at the control panel for the platform. That shift deserves continued scrutiny and independent oversight. (techcrunch.com)
• Nor does it mean every future suppression claim is a false alarm. Cloud failures and malfeasance can both happen; the challenge is designing verification systems that shrink false positives and false negatives in public trust.

A few practical tips for creators and everyday users

• If you see sudden drops in views or publishing issues, check official platform status channels first and watch for updates from platform infrastructure partners. (techcrunch.com)
• Back up important content and diversify audiences across platforms — creators learned this lesson earlier in the TikTok ban saga and during past outages. (cnbc.com)
• Hold platforms and new ownership structures accountable for transparency: ask for incident reports, moderation audits where possible, and clearer explanations about algorithm changes.

My take

Timing is everything. A power outage is an ordinary, solvable technical problem — but in the context of a freshly restructured, politically charged ownership story, ordinary problems become extraordinary trust tests. Platforms that want to keep their communities need to treat operational reliability and public trust as two sides of the same coin. Faster fixes matter, yes — but so do pre-committed transparency practices and independent verification so that the next outage doesn’t automatically become a geopolitical headline.

Sources

• Oracle says data center outage causing issues faced by US TikTok users — Reuters.
  https://www.investing.com/news/stock-market-news/oracle-says-data-center-outage-causing-issues-faced-by-us-tiktok-users-4469074

• TikTok attributes recent glitches to a power outage at a US data center — TechCrunch.
  https://techcrunch.com/2026/01/26/tiktok-attributes-recent-glitches-to-a-power-outage-at-a-u-s-data-center/

• TikTok says it’s still working to recover its U.S. infrastructure — TechCrunch.
  https://techcrunch.com/2026/01/27/tiktok-says-its-still-working-to-recover-its-u-s-infrastructure/

• TikTok Data Center Outage Triggers Trust Crisis for New US Owners — WIRED.
  https://www.wired.com/story/tiktok-ice-videos-censorship-allegations-algorithm/

• TikTok traffic bounces back as creators diversify amid shutdown fears — CNBC.
  https://www.cnbc.com/2025/01/31/tiktok-traffic-bounces-back-as-creators-diversify-amid-shutdown-fears.html

Microsoft Entra ID Flaw: A Wake-Up Call for Cybersecurity

In a world where digital security is paramount, a recent revelation has sent shockwaves through the tech community. A critical flaw in Microsoft Entra ID, the identity management service, has exposed a significant vulnerability that could have allowed hackers to hijack the tenants of any company relying on this platform. If you've ever thought your business was safe in the cloud, this news might just make you think twice.

What Happened?

According to a report from BleepingComputer, a combination of legacy components within Microsoft Entra ID inadvertently created a backdoor for cybercriminals. This flaw could have potentially granted attackers complete access to the Entra ID tenant of every company worldwide. Imagine the chaos if such a breach had been exploited: sensitive data, financial records, and personal information could have fallen into the wrong hands, leading to catastrophic consequences.

Microsoft Entra ID is designed to provide secure identity management and access control for organizations. As businesses increasingly transition to cloud-based solutions, the importance of robust security measures has never been clearer. However, this flaw serves as a stark reminder that even established tech giants are not immune to vulnerabilities.

Context and Background

Microsoft's identity management solutions are widely used across various industries, offering businesses streamlined access and management of user identities. However, the reliance on legacy components within such systems raises critical questions about the security architecture. Legacy systems often lack the agility and security enhancements of modern applications, making them prime targets for exploitation.

The Entra ID issue is not an isolated incident; it reflects a broader trend within the tech industry where older systems are integrated with newer technologies. As companies strive to innovate quickly, they sometimes overlook the security implications of these integrations.

Key Takeaways

- Critical Security Flaw: A flaw in Microsoft Entra ID could have allowed hackers to gain complete access to any company's tenant. - Legacy Components: The vulnerability stemmed from a combination of outdated systems, emphasizing the need for regular updates and security audits. - Widespread Impact: If exploited, this flaw could have compromised sensitive data for businesses globally, highlighting the universal risk of cloud services. - Need for Vigilance: Organizations must prioritize cybersecurity and remain vigilant about potential vulnerabilities within their tech stacks. - Ongoing Challenges: This incident underscores the challenges of balancing innovation with security in a rapidly evolving digital landscape.

Conclusion: A Call to Action for Businesses

The Microsoft Entra ID flaw serves as a crucial reminder that cybersecurity must be a top priority for every organization, regardless of size or industry. As we become increasingly reliant on cloud solutions, it’s essential to stay informed about potential vulnerabilities and invest in robust security measures. Regular audits, updates, and employee training can go a long way in safeguarding sensitive data against evolving threats.

In the ever-changing world of technology, staying one step ahead of cybercriminals is not just an option; it’s a necessity.

Sources

- "Microsoft Entra ID flaw allowed hijacking any company's tenant" - BleepingComputer [link](https://www.bleepingcomputer.com/news/security/microsoft-entra-id-flaw-allowed-hijacking-any-companys-tenant/) - "The Importance of Cybersecurity in the Cloud" - TechCrunch [link](https://techcrunch.com/2023/09/30/cybersecurity-cloud-importance/) - "Legacy Systems: The Hidden Risks in Your Organization" - Forbes [link](https://www.forbes.com/sites/forbestechcouncil/2023/10/01/legacy-systems-hidden-risks/?sh=4a6c3c1a7c45)

Stay informed and proactive to protect your business in this digital age!