Design as Harm: The EU’s Case Against Addictive Platforms

The European Commission just told Meta that the way its apps are built—not the data they hoard, not the ads they sell, but the actual shape of the thing—is illegal. I’ve been reading privacy enforcement news for something like fifteen years now, and I had to read the July 10 findings twice. Not because they were confusing. Because I didn’t quite believe a regulator had finally said the quiet part out loud.

Here’s the personal confession: I check Instagram in the bathroom. I check it in line at the grocery store. I checked it once, I am not proud of this, at a stoplight. I know infinite scroll is engineered to do exactly this to me, and knowing hasn’t helped even a little. So when I read that the Commission had specifically flagged infinite scroll and autoplay as systemic risks under the Digital Services Act, my first reaction wasn’t policy analysis. It was something closer to relief. Somebody with subpoena power finally noticed the thing was designed to eat my afternoon.

The short version is that the Commission concluded Meta’s core engagement machinery violates the DSA. The longer version matters more, because the specifics are what make this different from every fine that came before. Previous actions against Big Tech went after what companies collect and how much market power they wield. Data handling. Antitrust. This one goes after architecture. The Commission’s preliminary findings singled out infinite scroll, autoplay, push notifications, and personalized recommendation systems, and it framed them under the DSA’s concept of systemic risk—the idea that a very large platform’s design can deliberately undermine user autonomy. Not leak your data. Not lock out competitors. Just quietly override your intention to put the phone down.

And then the Commission did the thing that should make Meta’s product team lose sleep. It recommended remedies that touch the product directly: disable autoplay and infinite scroll by default, build in screen-time breaks that actually work, and redesign the recommendation algorithm to weigh user wellbeing against engagement. Read that last one again. A regulator is recommending changes to the objective function of the feed. I don’t think we’ve ever been here before.

Is this a done deal? No. These are preliminary findings, and Meta gets to respond, appeal, and drag it out. But preliminary findings from the Commission are not idle threats. They’re the opening move in a sequence that tends to end with a formal decision and a number attached.

For twenty-odd years, the regulatory question about tech has essentially been what did you take from me? Your location. Your contacts. Your browsing history. The whole privacy apparatus—GDPR included—was built around collection and consent. This flips it. The question the Commission is now asking is what did you do to me? Not what you took, but how you shaped my behavior. That’s a different category of harm, and honestly I’m not sure our vocabulary is ready for it. We have decades of law about property and information. We have almost nothing about attention.

A privacy fine says pay us and tighten your data practices. You write the check, you adjust some backend policies, the app looks exactly the same to me the next morning. I’ve watched that cycle play out a dozen times. The fines got big. The apps never changed. What the Commission is recommending here can’t be satisfied with a check and a press release. If Meta has to turn off autoplay by default and detune the recommendation engine, I would feel it. The app in my pocket would behave differently. That’s the part I keep turning over. For the first time, the remedy is visible from the couch, not buried in a compliance report I’ll never read. Whether that actually happens—whether it survives the appeals and the lobbying and the inevitable “but innovation” chorus—I genuinely don’t know. I’ve been disappointed before.

Let’s not be naive about why this is a fight. Meta’s revenue is engagement converted into ad impressions. Time-on-app is the raw material. If you legally require the app to hand me fewer reasons to keep scrolling, you’re not tweaking a feature. You’re reaching into the revenue model and turning a dial the company would very much prefer you didn’t touch.

The reported exposure is a €1–6 billion fine plus the cost of mandatory redesign, and there’s even chatter about forced structural changes if non-compliance drags on. The fine, honestly, Meta can absorb—it’s a rounding error against annual revenue, and I’d bet the finance team has already provisioned for it. The redesign is the real threat. You can pay a fine and move on. You can’t pay your way out of a rule that says the engagement engine itself has to change.

Here’s my hesitation, and I want to be honest about it rather than sell you a clean ending. I don’t fully trust regulators to design my software either. “Retune the algorithm for wellbeing” sounds great until you ask whose definition of wellbeing, enforced how, measured by whom. There’s a version of this that helps, and a version that just swaps one set of opaque incentives for another. I’ve read enough well-intentioned tech policy to know the gap between the press release and the outcome can swallow you whole. So I’m hopeful. I’m just not naive about it. You can read the Digital Services Act overview and the DSA legal text yourself, and I’d encourage it, because the framing of “systemic risk” is doing a lot of quiet work here.

Not yet, and not everywhere, and probably not in the tidy way that headline implies. What’s true is narrower and, I think, more interesting: a major regulator has formally declared that a specific set of engagement mechanics can constitute an illegal systemic risk, and it’s willing to prescribe product-level fixes. That’s a precedent, not a ban. Precedents are how these things start.

Will California or the UK or Australia pick up the thread? The brief I’m working from suggests they’re all watching, and I believe it—regulators copy each other’s homework constantly. Will Meta comply, or litigate until the sun goes out? I don’t know. I’ve stopped predicting how these fights end. But something shifted on July 10, and I don’t think it shifts back. The idea that design is just design—neutral, apolitical, nobody’s business but the company’s—took a real hit. And I’ll admit, checking Instagram at that stoplight, that I’m rooting for the idea to keep losing.