The Ministry of Youth and Childhood asks to provisionally suspend TikTok in Spain for the dissemination of child sexual abuse material

The Spanish Data Protection Agency (AEPD) must distinguish between suspending the processing of personal data and blocking access to a platform. A suspension request does not by itself determine that the service should be shut down: first, the Agency's jurisdiction, the reported risk, and the proportionality of the measure must be examined. The following outline explains the issues that must be resolved, without assigning specific deadlines or procedures whose regulation could not be verified in the consulted sources.

1. Identify what is requested and why

The first step is to specify the request: which platform is affected, who processes the data, which operations are questioned, and what harm is intended to be prevented. It is advisable to differentiate between stopping data collection, preventing certain communications, suspending a functionality, or blocking the entire service. These are different actions and cannot automatically be justified with the same arguments.

It must also be identified whether the request accompanies a complaint for a possible infringement or seeks urgent intervention. The request should provide facts, documents, and an explanation of the risk; a generic complaint that the platform is dangerous does not replace this justification.

2. Verify jurisdiction

Before deciding, it must be determined whether the issue falls within the scope of data protection. Not every platform non-compliance corresponds to the AEPD: judicial authorities or other competent bodies in different matters may intervene.

If there are cross-border elements, it must also be examined which authority can act and what coordination is necessary. It should not be assumed that offering a service in Spain allows the Agency to take any measure against all its international activity.

3. Obtain information and assess urgency

The decision requires a sufficient basis regarding the challenged processing and its consequences. The categories of data, affected persons, continuity of processing, and the possibility that the harm may increase during the investigation must be clarified.

To justify a precautionary intervention, the analysis must explain why it is not enough to wait for the final resolution. It must also consider whether there is a less restrictive alternative: limiting a specific operation may be sufficient without paralyzing the entire platform.

4. Issue a reasoned decision and preserve guarantees

The eventual decision must identify its legal basis, the established facts, the risk, and the relationship between that risk and the chosen measure. Its scope must be delimited: affected operations, recipients, territorial scope, compliance conditions, and duration or review.

The platform must be able to know and discuss the reasons for the action. The form and timing of the hearing, as well as any exceptions due to urgency, depend on the applicable procedure and require specific authorization; they should not be presumed. The complainant's request also does not replace the authority's own assessment.

5. Differentiate the administrative order from the effective blocking

Ordering the data controller to stop processing data is not equivalent to ordering operators or intermediaries to block access to the service. If blocking is intended, jurisdiction, legal coverage, and necessary guarantees must be separately identified, especially when it may affect legitimate communications or content.

It cannot be stated that all blocking always requires judicial authorization, nor that the AEPD can always execute it alone. That conclusion requires examining the specific measure and its legal basis.

6. Notify, review, and allow appeal

Finally, the resolution must communicate what is required and how it can be challenged. The precautionary measure does not replace the decision on the merits: it must be reviewed if its assumptions change. Appeals, deadlines, and possibilities of judicial suspension must be checked in the applicable regulation before acting.

The Minister of Youth and Childhood exercises the top-level direction of the state policy on youth and the protection of minors. It is advisable to distinguish her leadership powers from the execution functions assigned by regulations to the State Secretariat, the Undersecretariat, and other Ministry bodies.

1. Scope of responsibility and direction

Article 1 of Royal Decree 211/2024, of February 27, assigns to the Ministry "the proposal and execution of the Government's policy on youth and the protection of minors." Its second paragraph establishes that these functions are carried out under the superior direction of the head of the department.

The Minister therefore directs the Ministry's actions through two main bodies: the State Secretariat for Youth and Childhood and the Undersecretariat for Youth and Childhood. She also has a support and immediate assistance cabinet with the organizational level of a general directorate.

2. Subjects covered by this direction

Articles 2 and 3 of the royal decree specify the department's material scope. Under the Minister's authority, its bodies develop the following lines of action:

• Rights of children and adolescents: promotion and comprehensive defense of their rights, special protection, and prevention of situations of need, within the constitutionally attributed competencies of the State.
• Youth policies: promotion of the free and effective participation of young people in political, social, economic, and cultural development.
• Child poverty: promotion of measures to eradicate inequality and child poverty, in coordination with other ministries.
• Planning: strategic planning of the department's policies and promotion of the State Strategy on the Rights of Children and Adolescents.
• Cooperation: collaboration with other administrations, associations, and non-governmental organizations of childhood, adolescence, and youth.
• International dimension: participation in international and European Union bodies and supervision of international youth programs.

3. Distribution of powers

These subjects do not mean that the Minister personally exercises all administrative functions. The State Secretariat is assigned the promotion, development, and coordination of these policies. The Directorate General for the Rights of Children and Adolescents depends on it, and through it, the Youth Institute is attached.

The basic structure is also set out in Article 22 of Royal Decree 1009/2023, of December 5. The Undersecretariat oversees the Technical General Secretariat. The Undersecretariat directs, promotes, and coordinates common services and assists the Minister in the preparation and approval of action plans.

A relevant update is Royal Decree 945/2025, of October 21: it transferred from the State Secretariat to the Undersecretariat the functions of National Authority for the youth and sport chapters of Erasmus+ and the European Solidarity Corps.

4. Coordination and limits

The Ministry has attached the Sectoral Conference on Childhood and Adolescence, the Interministerial Commission for Youth, the Advisory Council on International Adoption, the State Council for the Participation of Children and Adolescents, and the Childhood Observatory. Attachment does not mean that the Minister automatically chairs all of them: the royal decree expressly assigns the presidency of the Observatory and the Sectoral Commission to the State Secretariat.

Finally, Article 1.3 requires exercising these competencies in coordination and without prejudice to those of other ministries. It also does not assign the department all regional actions for the protection of minors: its functions are limited by state competencies and territorial cooperation.

The General Data Protection Regulation (GDPR) does not specifically regulate the AEPD by name, but it does set the general framework that all national supervisory authorities (including the AEPD) must respect when adopting provisional measures. These powers are mainly found in Articles 58 and 66 GDPR, and are supported by principles such as necessity, proportionality, and effective protection.

1. Legal basis for provisional measures

The GDPR foresees two main levels:

• General power to impose measures (Art. 58.2): supervisory authorities may impose a series of corrective measures, including the temporary or definitive limitation of processing, including its prohibition. When adopted as precautionary measures before resolving the substance of the matter, they act as provisional measures.
• Urgency procedure (Art. 66): allows a supervisory authority, if it considers urgent action is needed to protect individuals' rights and freedoms, to adopt provisional measures with effects in its own territory for a maximum period of three months, even when a cross-border matter is pending European coordination.

2. Substantive requirements

Although the GDPR does not list "requirements" as a closed list, several substantive demands can be inferred from its articles and principles:

• Significant risk to rights and freedoms: provisional measures are only justified when there is sufficient indication that the processing may cause relevant or immediate harm to data subjects. Article 66 explicitly mentions the existence of an "urgent need to act".
• Necessity: the measure must be strictly necessary to prevent or limit that harm while the main procedure is resolved. If the risk can be addressed with less intense actions (e.g., a simple information request), a severe precautionary measure such as a total prohibition of processing would not be justified.
• Proportionality: the authority must choose the least burdensome measure that is effective to protect individuals' rights. For example, temporarily limiting certain processing or blocking data may be more proportional than an absolute ban on all controller activity.
• Temporality: by its nature, provisional measures are temporary. Article 66 GDPR sets a clear limit when used in urgency procedures: a maximum of three months. Beyond that period, a substantive decision must exist (either by the authority itself or the European Data Protection Board, as applicable).
• Grounding in the GDPR: the precautionary decision must be supported by a reasoned assessment of the possible GDPR infringement (e.g., violation of the principles in Art. 5, lack of legal basis, failure to inform, etc.).

3. Formal and procedural requirements

The GDPR also imposes certain procedural guarantees that condition the adoption of provisional measures:

• Authority competence: the measure must be adopted by a competent supervisory authority according to GDPR rules (Arts. 55 et seq.). In cross-border contexts, this is coordinated with the one-stop-shop mechanism and the lead authority, except for the specific urgency case in Art. 66.
• Written form and motivation: corrective measures under Art. 58.2, when exercised, must be formalized in a reasoned decision explaining the facts, the possible infringement, and the reasons why the measure is necessary and proportionate.
• Respect for national procedural guarantees: the GDPR refers to national laws for procedural and sanction aspects (Arts. 58.4 and 83.8). In Spain, this is specified in the LOPDGDD, which regulates how the AEPD can agree on provisional measures (hearing procedure, ex parte adoption in cases of special urgency, deadlines, etc.).
• Right to effective judicial protection: Art. 78 GDPR guarantees that every legally binding decision of a supervisory authority, including those imposing provisional measures, is subject to appeal before the courts. This acts as an additional limit: the authority must issue sufficiently clear and reasoned measures so they can be judicially reviewed.

4. Specificity of the urgency procedure (Art. 66 GDPR)

When dealing with a cross-border matter involving several European authorities, Art. 66 allows an authority, such as the AEPD, to act without waiting for the conclusion of the consistency mechanism if these additional requirements are met:

• Existence of an urgent risk to individuals' rights and freedoms.
• Need to adopt a legally binding provisional measure with effects in its own territory.
• Clear temporal limitation: maximum validity of three months.
• Immediate information to other affected supervisory authorities, the European Data Protection Board, and the European Commission, explaining the reasons for the urgency.

In summary, the GDPR allows the AEPD to adopt provisional measures but requires that they respond to a relevant and urgent risk to individuals' rights, that they are necessary, proportionate, temporary, and duly reasoned, and that they respect procedural guarantees and appeal rights both under the GDPR itself and Spanish law.