Maldita.es, a credible European fact-checking organisation, documented thousands of child abuse images served by TikTok’s recommendation algorithm. Accounts on TikTok were also being used to advertise and sell CSAM, directing buyers to dark web and Telegram channels. TikTok employees had reportedly warned management about these failures four years ago, according to an NPR investigation published in October 2026. This is Maldita.es’s third investigation on this specific topic. TikTok has not taken effective action.
What Maldita.es Found
Maldita.es says the investigation team encountered thousands of images and videos depicting the sexual abuse of children across the course of this research , described as one of the most difficult investigations the newsroom has conducted.
The journalists documented and analysed hundreds of videos that TikTok’s own recommendation algorithm delivered directly into accounts they created for the investigation. They also examined the comments sections and traced the accounts posting the content to understand how the platform was being exploited.
The critical finding is what these TikTok accounts were being used for beyond simply hosting illegal content. Many of them were functioning as storefronts , advertising the availability of CSAM and directing interested parties toward external channels, including dark web marketplaces and Telegram groups, where material was available for purchase.
In plain terms: TikTok was being used as a publicly visible catalogue and marketing channel for child sexual abuse material. The actual transactions were happening elsewhere. TikTok was the shop window.
This is a distinct threat model from what most people assume when they think about CSAM distribution. The common assumption is that this material exists only in the most hidden corners of the internet , accessible only to those who know specific dark web addresses and can verify their credentials. Maldita.es’s investigation shows that in 2026, one of the world’s most widely used social media platforms is serving as the discovery layer for a commercial CSAM market.
As we’ve covered in looking at how Operation Alice dismantled 373,000 dark web child abuse sites, the investigators identified 440 people who had attempted to purchase CSAM through those platforms , people who reached those sites through some initial discovery mechanism. TikTok appears to have become one of those discovery mechanisms.
This Is the Third Investigation , and Nothing Has Changed
Maldita.es is explicit about this in their own reporting. This is their third investigation into child abuse and exploitation on TikTok. Their previous two investigations raised exactly these concerns. TikTok did not take effective action.
The journalists write: “Following our previous investigations, we had hoped TikTok would take action and that this content would no longer be quite so readily accessible on a social media service where children around the world spend so much of their time.”
The fact that they are now publishing more evidence, more extensively documented, is a statement about TikTok’s response , or the lack of one. The investigation’s framing makes this explicit: they are publishing further evidence “because we believe it is necessary to make visible and clear that what is happening on TikTok is not acceptable.”
The TikTok Whistleblower ReportsTwo weeks before the Maldita.es investigation published, NPR reported on accounts from TikTok employees who say they warned the company’s senior management about serious failures in content moderation and child protection , four years ago. And over a period of several months. The company, according to these employees, failed to take effective action in response.
The NPR report adds institutional context to what Maldita.es documented in the feed. The failures weren’t unknown inside TikTok. People who worked there identified them and raised them. They were not addressed.
This combination, documented external evidence from investigative journalists plus internal whistleblower accounts from employees , creates a picture that regulators will find very difficult to dismiss.
The EU Digital Services Act Context
TikTok operates in the European Union under the Digital Services Act (DSA), which imposes specific obligations on very large online platforms , including systematic risk assessments for child safety and mandatory reporting of CSAM to law enforcement and to the European Centre for the Detection and Removal of Online Content. TikTok has significant compliance obligations that did not exist when earlier investigations on this topic were published.
If TikTok has been aware of these failures , as the ,whistleblower accounts suggest the DSA creates direct regulatory and legal exposure.
The connection to the broader dark web intelligence market is also relevant. Platforms like TikTok generating the discovery layer for dark web CSAM markets is precisely the kind of cross-platform threat signal that dark web monitoring services are expanding to track , monitoring is no longer only about what happens on hidden networks, but about how surface-web platforms funnel traffic toward them.
What Parents Need to Know Right Now
TikTok is used by hundreds of millions of people, including children and teenagers. The practical implications of this investigation for parents are significant.
Children using TikTok independently are potentially being served this content by the algorithm without any deliberate search or action on their part. The investigation documents that it was served directly into feeds during the research process.
Regardless of parental controls, age verification, or account settings, the investigation shows the platform’s algorithmic recommendations can reach this content. Parents who allow children to use TikTok need to understand this finding is not about edge cases or deliberate searching by children. It is about what the platform’s own recommendation system delivers.
The safest approach for young children is supervised use or avoidance. For teenagers, open conversation about what to do if they encounter disturbing content is more important than any technical control.
How to Report Child Sexual Abuse Material Online
If you encounter CSAM online , including on social media platforms , please report it immediately through these channels.
In the UK, the Internet Watch Foundation (IWF) accepts reports of online child sexual abuse material and works with platforms and law enforcement to remove it. The Child Exploitation and Online Protection Command (CEOP) handles reports of online grooming and exploitation.
In the United States, the National Center for Missing & Exploited Children’s CyberTipline is the national reporting mechanism for CSAM. Reports are routed to law enforcement.
Globally, INHOPE operates a network of national reporting hotlines covering 46 countries.
Do not share the material, download it, or attempt to investigate the account yourself. Report it through official channels and let law enforcement handle the response.
Frequently Asked Questions
What did the Maldita.es investigation find?
Thousands of child sexual abuse images and videos served directly by TikTok’s recommendation algorithm, plus accounts using TikTok to market CSAM and direct buyers to dark web and Telegram markets.
Is this TikTok’s first warning about this problem?
No. This is Maldita.es’s third investigation on the topic. TikTok employees reportedly warned management about these failures four years ago, according to NPR reporting from October 2026.
How is TikTok connected to dark web markets?
Accounts on TikTok were functioning as a visible catalogue and storefront for CSAM sales, directing potential buyers to external channels including dark web markets and Telegram groups where material could be purchased.
What should parents do?
For young children, supervised use or avoidance of TikTok is the safest approach. For all ages, open conversation about what to do when disturbing content appears is important — including reporting immediately through IWF, CEOP, or NCMEC.
How do I report child abuse material found on TikTok?
Report directly to the Internet Watch Foundation (UK), CEOP (UK), or NCMEC CyberTipline (USA). Do not share or save the content.
