Santander and Moeve withdraw their advertising from TikTok for ads alongside content of child sexual abuse

The Prosecutor's Office investigation into the dissemination of child sexual abuse material on TikTok is open and in an initial analysis phase. As of November 13, 2026, there is no formal accusation nor a general suspension order of the platform in Spain. The next steps focus on assessing the evidence and determining possible criminal liabilities, while the Spanish Data Protection Agency (AEPD) prepares actions regarding specific content.

What the Prosecutor's Office has already done

The Attorney General of the State, Teresa Peramato, ordered on November 11 to investigate the facts and assigned the proceedings to Elvira Tejada, coordinating Prosecutor of the Computer Crime Unit. The objective is to examine possible crimes related to the creation and dissemination of child sexual abuse material and corruption of minors, as reported by Demócrata.

The action stems from a complaint by Maldita.es, whose representatives have already ratified it and provided evidentiary material, according to El País. Additionally, the Ministry of Youth and Childhood sent a letter on November 9 requesting the intervention of the Public Ministry.

The journalistic investigation identified, over 35 days, 1,183 videos and images with 48 million views, as well as 12,068 comments from 7,725 profiles requesting, offering, or advertising exchanges or sales of this material. These are findings provided to the investigation, not facts proven by a court. Demócrata details the scope of the complaint.

What are the next steps

• Analyze the evidence. The Prosecutor's Office must assess the materials received, their authenticity, scope, and possible criminal relevance. It must also clarify the responsibilities of those who produce, distribute, or commercialize the content.
• Identify victims and responsible parties. Preserving digital evidence and identifying accounts and individuals are likely lines of investigation. Data may be requested from TikTok, but there is no public record that such specific requests have already been made.
• Decide whether to go to court. If sufficient indications appear, the Prosecutor's Office may initiate a judicial investigation and request protective or investigative measures. This is a procedural possibility, not a judicial referral already announced, according to information published by Diario de Sevilla.

No fixed schedule has been published to complete these actions nor a date to decide on possible criminal actions.

What Data Protection will do in parallel

The AEPD has announced a specific sequence: request from Maldita.es the detected links, require TikTok information about removals, and after analyzing the responses, order the blocking of specific links and content that involve unlawful processing of minors' data. This is stated in its November 11 statement.

It will also forward the information to the Irish data protection authority, responsible for the ordinary supervision of TikTok in this matter, and to the European Commission due to its competencies over digital services.

The Ministry has requested to study the precautionary suspension of TikTok, but a request is not equivalent to a decision. The measure announced by the AEPD affects specific content, not the entire platform. The Agency also reminds that criminal investigation and general access restrictions naturally fall under police, prosecutorial, and judicial authorities. Therefore, three actions must be distinguished: investigating crimes, blocking specific content, and suspending the entire service.

The Ministry of Youth and Childhood has functions of normative promotion, planning, prevention, and coordination to protect the rights of minors, including on the internet. It does not concentrate all competencies over platforms, personal data, or digital crimes: it acts alongside other departments and authorities. Sira Rego is the minister who has led this portfolio since November 2023.

Competencies and functions of the Ministry

The Royal Decree 211/2024, of February 27, assigns to the department "the proposal and execution of the Government's policy on youth and the protection of minors." Its article 1 specifies that these competencies are exercised in coordination and without prejudice to those corresponding to other ministries (BOE of February 28).

Digital protection falls within this general responsibility, not an exclusive competence of internet control. Its main functions are:

• Prepare and develop regulations on protection and promotion of childhood, and participate in proposals from other departments affecting their rights.
• Develop and monitor action plans, promote awareness campaigns, and coordinate policies with autonomous communities, other administrations, and social entities.
• Prevent violence and coordinate monitoring of Organic Law 8/2021, on comprehensive protection of childhood and adolescence against violence, known as LOPIVI.
• Promote participation, studies, and training: listen to children and adolescents, produce knowledge about their needs, and cooperate in training professionals.

These tasks mainly fall on the State Secretariat for Youth and Childhood and the Directorate General for the Rights of Childhood and Adolescence. They should not be confused with the management of the Ministry's own IT security, which protects its administrative services.

How it is implemented in the digital environment

The department participated in drafting the Organic Law Project for the protection of minors in digital environments, submitted to Congress on March 25, 2025. It was a shared initiative with the Presidency and Justice, Digital Transformation, and Social Rights and Consumption ministries, not an exclusive regulation of Youth and Childhood (project presentation).

Its work lines include protecting children's privacy and image; preventing access to harmful content; parental control; and digital literacy for minors and families. It has also promoted a national strategy and the work of an expert committee whose report gathered 107 proposals. These recommendations do not themselves equate to legal obligations (report and measures).

Additionally, Royal Decree 1086/2023 regulated subsidies to digitally empower vulnerable children and youth. The regulation included a ministerial goal of training 950,000 minors, not an accredited result figure (training program).

An example of the division of functions is TikTok: on November 10, 2026, Rego announced a request to the AEPD to provisionally suspend the platform due to dissemination of child sexual abuse material. This is a request to another authority, not a suspension decreed by the minister (Demócrata information).

Who is Sira Rego

Sira Abed Rego, born in Valencia in 1973, holds a diploma in Human Nutrition and Dietetics and is a member of Izquierda Unida. Her institutional career began in Rivas-Vaciamadrid: she was a councilor between 2007 and 2019 and first deputy mayor between 2015 and 2019. She then served as a Member of the European Parliament between 2019 and 2023, before assuming the Ministry of Youth and Childhood in November 2023 (official biography; European career).

Article 66.1 of the General Data Protection Regulation (GDPR) regulates the so-called "urgency procedure" within the consistency mechanism, for situations where there is an immediate need to protect the rights and freedoms of the data subjects. This provision sets both the material requirements to activate the procedure, as well as the procedural steps that the supervisory authority and the European Data Protection Board (EDPB) must follow.

1. Material requirements to activate article 66.1 GDPR

To use the urgency procedure, three elements must concur:

• Existence of an "urgent situation": refers to cases where delaying action could cause serious and immediate harm to the rights and freedoms of natural persons. A mere abstract infringement is not enough; there must be a relevant and current risk.
• Competence of a supervisory authority: the authority detecting the urgency (for example, a national data protection authority) must be involved in a cross-border matter where the one-stop-shop mechanism (art. 60 GDPR) would normally operate. Article 66.1 functions as an "exception" to that ordinary scheme.
• Need for provisional measures with effects in its territory: the authority understands it must adopt provisional measures (for example, suspension of processing, specific limitation, blocking order) with legal effects in its own Member State while the matter is processed at the European level.

In summary, article 66.1 is designed for cases where effective protection of data subjects requires acting before the coordinated normal procedure concludes, but without foregoing European coordination.

2. Provisional measures adopted by the supervisory authority

Article 66.1 authorizes the supervisory authority to:

• Adopt binding provisional measures intended to produce legal effects in its own territory, usually directed at the controller or processor.
• These measures must be proportionate and strictly necessary to address the detected urgency. They may include, among others:
  • Order temporary suspension of a specific data processing.
  • Limitation of certain operations (profiling, transfer, public dissemination).
  • Imposition of specific conditions while the substantive case is examined.
• The measures are strictly temporary: article 66.1 GDPR itself establishes a maximum limit of three months of validity, unless replaced earlier by the substantive decision resulting from the consistency mechanism.

Although provisional, these measures have mandatory character for the recipient, and non-compliance may lead to administrative sanctions under the rest of the GDPR.

3. Immediate notification and activation of the European mechanism

The use of article 66.1 is neither autonomous nor isolated: the authority acting in urgency must integrate into the framework of the consistency mechanism. The essential steps are:

• Immediate notification to the European Data Protection Board (EDPB): as soon as it adopts the provisional measure, the authority must communicate it without delay to the Board and to the other affected supervisory authorities, explaining:
  • The facts and context of the case.
  • The reason for the urgency and the risk to data subjects.
  • The specific content of the measures adopted.
• Request for urgent opinion or decision from the EDPB: together with the notification, the authority acting in urgency asks the Board to issue, under articles 66.2 et seq., a binding opinion or decision on the substance of the matter at the EU level.

Thus, the urgency procedure is not limited to "stopping" something at the national level, but triggers the rapid and coordinated intervention of the European body.

4. Deadlines and effects of the urgency procedure

The GDPR provides that, once article 66.1 is activated, the Board must process the matter with priority:

• Priority processing: the EDPB applies a faster timetable than ordinary consistency procedures, precisely due to the accredited urgency dimension.
• Decision or opinion at the European level: the result (whether a binding decision regarding the concerned authorities, or an opinion guiding the final decision of the lead authority) may:
  • Confirm the provisional measures adopted.
  • Modify them or replace them with others.
  • Revoke the measures if considered unnecessary or disproportionate.
• Expiry of provisional measures: if no substantive decision is adopted earlier at the European level, the measures issued under article 66.1 expire three months after their adoption.

In summary, article 66.1 configures an exceptional mechanism that balances two demands: on one hand, allowing an immediate reaction to serious risks to fundamental rights; on the other, ensuring that the final response is adopted in a coherent and coordinated manner within the European Union framework, through the European Data Protection Board and the GDPR consistency mechanism.