{"id":"30e3d34e-5924-48f3-ad38-fd040fa93cc9","arxiv_id":"2505.01122","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"TikTok's current research data access is insufficient to study election-related systemic risks under the EU Digital Services Act, based on a case study of the 2024 Romanian presidential election.","lead":"This paper examines the EU Digital Services Act's researcher access to platform data, using the 2024 Romanian election interference on TikTok as a case study. It finds that currently available TikTok data via the Research API and data donations are too limited to study systemic risks like platform manipulation and hidden advertising.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table 1's data-donation inventory is based on the authors' own accounts and selected API probes; 'No' entries may reflect the tested configurations rather than the access mechanisms generally.","rationale":"The reader's weakest assumption—that Table 1 is an accurate and complete representation of data accessible through the Research API and data donations—is indeed the most load-bearing point. The paper's central claim that existing mechanisms leave the research questions unanswerable, and therefore that Article 40 access is necessary, depends entirely on the completeness of the availability classification. My analysis sharpens the reader's point: the data-donation column is derived from a small, self-selected set of accounts, and TikTok's data-donation output is known to be heterogeneous across account types and regions. The same applies to the Research API column, which is based on the authors' own probes rather than an exhaustive enumeration of documented fields. This is not a manufactured concern; the paper itself discloses that the donations came from the authors' own TikTok research accounts but draws universal 'No' conclusions from that limited sample. The concern is also directly relevant to the policy recommendation because DSA Article 8(6) DA requires applicants to show that data cannot be obtained through alternative means; if any field is in fact obtainable through a different data-donation configuration, the 'necessity' argument for Article 40 is weakened. The paper has real strengths: the legal synthesis is careful, the data-needs taxonomy is useful, the Romanian case study is timely, and the authors are transparent about their methodology. Those strengths do not, however, eliminate the representativeness problem in the audit. Because the reader's verdict was already CONDITIONAL on this same issue, I do not propose changing the verdict; the condition should be specified as 'verify the completeness of Table 1 across account types, regions, and API endpoints before treating the unanswerability claim as established.' The secondary issues (empty cross-references, placeholder citations) further support the need for revision but are not the central load-bearing concern. Overall, the paper's argument is plausible and valuable, but its strongest empirical claim is not yet fully supported by the reported evidence.","tokens_in":18843,"tokens_out":4175,"duration_ms":44169,"concrete_test":"Obtain TikTok 'Download your data' archives from at least ten accounts spanning personal, creator, and business types, EU and non-EU regions, and different creation dates, then compare the exported fields field-by-field against Table 1's 'Data Donation' column, focusing on the entries marked 'No' (e.g., Account Gender, Account type, GPPPA status, Historical engagement metrics, Algorithmic parameters, Suggested search terms). In parallel, enumerate every documented Research API endpoint and issue requests with the full 'fields' parameter against several public videos and users from the Romanian election corpus, recording whether any Table 1 'No' field is returned.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central conclusion—that existing mechanisms (Research API and data donations) are insufficient and Article 40 access is necessary—rests on Table 1, which classifies each data need as available, limited, or not available. The data-donation column appears to derive from the authors' own TikTok research accounts, but the paper does not report how many accounts were used, what account types (personal, creator, business) or regions they had, or when the downloads were performed. TikTok's 'Download your data' exports are known to vary by account type, region, app version, and over time: for example, creator and business accounts can expose fields such as account type, monetization status, and analytics that personal accounts do not, and EU data exports can include inferred attributes and ad-interest categories. Consequently, the 'No' entries (e.g., Account Gender, Account type, GPPPA status, Historical engagement metrics, Algorithmic parameters, Suggested search terms) may be false negatives—artifacts of the specific accounts probed, not of the data-donation mechanism as a whole. The Research API column is similarly based on the authors' own calls to selected endpoints rather than a systematic enumeration of all documented API fields, and TikTok's API supports a 'fields' parameter that can return additional data if specified. Because DSA Article 8(6) DA requires researchers to demonstrate that the data cannot be obtained through alternative existing means, the claim that the research questions are 'unanswerable' without Article 40 is overstated if even one 'No' field can be obtained through a different account configuration or a different API call. This is a representativeness problem, not a question of author intent. Secondary but relevant: the manuscript contains empty cross-references ('Section '), placeholder references ('Unknown 2020', 'Commission 2024' with a bracketed title), which hamper verification of the legal and factual framework.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper analyzes the operationalization of Article 40 of the EU Digital Services Act (DSA), which grants vetted researchers access to very large online platforms' internal data for studying systemic risks. It argues that two obstacles impede this mechanism: the legal uncertainty of the systemic-risk concept and an information asymmetry between researchers and platforms, which the authors call the 'standoff problem.' Using the 2024 Romanian presidential election interference incident as a case study, the paper derives a set of research data needs from prior computational social science literature on platform manipulation and hidden advertising, then compares these needs against what TikTok makes available through its documentation, its Research API, and data donations. The central conclusion is that existing data-access mechanisms are insufficient to investigate the identified systemic risks and that access through Article 40 is therefore necessary. The paper is conceptual and interdisciplinary, combining legal analysis, platform governance, and computer science perspectives, and its empirical core is a detailed table (Table 1) classifying each needed data point as available, limited, or not available through the two existing access mechanisms.","tokens_in":19102,"tokens_out":4576,"duration_ms":46155,"significance":"If the Table 1 classification is reliable, the paper makes a useful and timely contribution: it provides a concrete, case-driven template for how researchers might frame Article 40 DSA data-access requests, and it highlights real gaps in TikTok's researcher-facing transparency tools. The combination of legal analysis with computational data-needs mapping is valuable for the platform-governance community, and the paper is honest about several limitations, including the cross-platform scope and the opacity of platform data inventories. The work does not present a formal model or machine-checked proofs, but for a conceptual contribution the clarity of the case study and the explicit mapping between research questions and data fields are strengths. The main significance, however, is conditional: the policy conclusion that Article 40 access is 'necessitated' depends on the completeness and accuracy of the availability classification in Table 1, and the methodology behind that table is currently under-documented.","major_comments":[{"comment":"The paper's central claim that existing mechanisms 'provide insufficient means' to study the identified systemic risks rests entirely on the availability classification in Table 1, but the methodology behind the data-donation column is under-reported. The text states only that 'data donations ... was obtained by the authors from their own TikTok research accounts' and does not report the number of accounts, account types (personal, creator, business), regions, app versions, or the dates on which downloads were performed. TikTok's 'Download your data' exports are known to vary by account type, region, app version, and over time, so the 'No' entries for fields such as Account Gender, Account type, GPPPA status, Historical engagement metrics, Algorithmic parameters, and Suggested search terms may be artifacts of the particular accounts probed rather than properties of the data-donation mechanism as a whole. Because Article 8(6) DA requires researchers to demonstrate that data cannot be obtained through alternative existing means, this completeness claim is load-bearing; the paper should report the exact donation procedure, account characteristics, dates, and any validation against platform documentation, or soften the conclusion accordingly.","section":"Data Availability as a Platform Governance Narrative; Table 1 (Appendix)"},{"comment":"The Research API column of Table 1 is likewise presented without a systematic enumeration of the API endpoints and fields queried, the number and frequency of calls, or the dates on which the calls were made. TikTok's Research API supports an explicit 'fields' parameter that returns additional data when specified, so a 'No' entry may reflect an incomplete request rather than documented unavailability. To support the conclusion that certain data are 'not available' through the Research API, the paper should either document that every relevant endpoint and field combination was checked against current API documentation, or reclassify the affected entries as 'not examined' and adjust the central insufficiency claim accordingly.","section":"Data Availability as a Platform Governance Narrative; Table 1 (Appendix)"},{"comment":"The data-requirements taxonomy is derived almost exclusively from studies of Twitter, Facebook, and Instagram, yet the Romanian case study itself identifies TikTok-specific mechanisms—notably livestream gifting and search-recommendation amplification—that are not mapped to any data category in the summaries. For instance, 'livestream gifting' is discussed in the case-study overview and in the preliminary evidence, but no corresponding data need (e.g., live-stream metadata, gift/coin transaction logs) appears in the 'Summary of Data Requirements' lists or in Table 1. Since the paper's conclusion is that election-related systemic risks on TikTok specifically cannot be studied with existing access mechanisms, the taxonomy should either incorporate these TikTok-specific data needs or explicitly argue that they are subsumed under the existing categories.","section":"Platform Manipulation and Election Interference; Political Influencer Marketing as Hidden Advertising (Summary of Data…"},{"comment":"The paper's conclusion that Article 40 access is 'necessitated' relies on the premise that scraping is not a viable alternative means, but the paper dismisses scraping only by stating that it 'focus[es] on these two mechanisms that comply with the terms of service of the platform.' Article 8(6) DA requires a demonstration that the research project 'cannot be carried out with alternative existing means such as using data available through other sources,' and the paper itself notes that investigative journalists in the same case study scraped TikTok data externally. The paper should engage with the possibility that scraping or third-party tools, despite terms-of-service concerns, constitute an 'alternative existing means' for at least some of the research tasks, or explain why they are not sufficient for the scientific purposes described.","section":"Data Availability as a Platform Governance Narrative; Article 8(6) DA"}],"minor_comments":[{"comment":"Two section cross-references appear as empty 'Section ' placeholders in the text; these should be replaced with the appropriate section titles or numbers.","section":"Platform Manipulation and Election Interference; Political Influencer Marketing as Hidden Advertising"},{"comment":"The reference list contains placeholder-like artifacts, including 'Unknown 2020', '[Title of the Press Release]' for the European Commission press release, and 'Title Unknown' for an Electrochemical Society journal reference; these must be completed or removed.","section":"References"},{"comment":"There is a typo in the final section: 'prevalant' should be 'prevalent.' Also, in the section on systemic risks under the DSA, the phrase 'content content' appears and should be corrected.","section":"Conclusion"},{"comment":"The caption describes colors from green to purple, but the text also refers to 'intermediate shades'; please ensure the figure legend is explicit enough for color-blind readers and that the caption matches the actual color mapping used in the figure.","section":"Figure 1"},{"comment":"The text refers to 'Sections 3.2 and 3.3' but the manuscript uses unnumbered section headings; update the in-text references to match the published formatting.","section":"Section numbering"}],"recommendation":"major_revision","confidential_remarks":"The manuscript contains a number of placeholder-like references (e.g., 'Unknown 2020', '[Title of the Press Release]', 'Title Unknown') and relies heavily on the authors' own prior work to define both the data needs and the availability assessment. This is not disqualifying, but the editor should ensure the reference list is cleaned and that the Table 1 methodology is reported in sufficient detail before publication. The central scientific claim is conditional on an under-documented audit, and the authors either need to strengthen the methodology or soften the conclusion; the paper is otherwise within the journal's scope and has clear interdisciplinary value."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is worth reading for its case study: it takes the 2024 Romanian TikTok election interference and maps, point by point, what data researchers would need to study platform manipulation and hidden advertising under the DSA, then checks what TikTok's documentation, Research API, and data donations actually expose. That mapping—Table 1—is the real contribution, and it is genuinely useful as a template for Article 40 applications. The legal framing of the 'standoff' and the Article 8(6) requirement to show alternative means are well explained. The recommendations on data inventories are sensible.\n\nThe soft spot is that Table 1 carries more weight than its method can bear. The data-donation column comes from the authors' own TikTok accounts, but the paper does not say how many accounts, what types (personal, creator, business), which regions, or when the exports were made. TikTok's 'download your data' output is known to vary along all those axes, so a 'No' entry in that column may simply mean the tested configuration did not include the field. The Research API side is similarly under-documented: we don't learn which endpoints were probed, whether all documented fields were enumerated, or how the 'limited' vs 'no' distinction was calibrated. TikTok's API supports a fields parameter, and it is easy to get false negatives if you don't ask for every possible field. The paper then states that the research questions are 'unanswerable' with existing mechanisms. Given the audit's representativeness problem, 'not answerable with the configurations we tested' would be more defensible. That is a load-bearing difference, because the whole policy argument rests on showing that Article 40 access is needed precisely because alternative means are insufficient.\n\nThere are also copyediting issues: empty cross-references and placeholder references ('Unknown 2020', 'Commission 2024' with a bracketed title, and a Chong & McIntyre cite about the music industry that looks misplaced). These hamper verification but are fixable.\n\nNone of this sinks the paper. The central argument is not circular; the data needs are derived from prior literature, and the combination of legal and computational perspectives is something we don't see enough of. The paper deserves a serious referee and will be useful to anyone working on DSA data access, platform transparency, or election integrity. But it should be revised to either document the audit methodology in enough detail to be replicated, or soften the conclusions to match the evidence. I'd engage with it, with that caveat.","headline":"Useful case-study mapping of DSA data needs for the Romanian TikTok election, but the 'unanswerable' claim leans on an under-documented audit.","tokens_in":19731,"tokens_out":3256,"would_cite":true,"duration_ms":28354,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Existing TikTok data access cannot answer the key questions about the 2024 Romanian election interference, so the DSA's Article 40 route is necessary.","keywords":["Digital Services Act","Article 40 data access","TikTok","election interference","systemic risks","platform manipulation","hidden advertising","data donations"],"falsifier":"If a researcher with vetted access to TikTok's Research API and a donated data package from an account involved in the Romanian election could retrieve any data point the paper classifies as not available, such as algorithmic parameters, moderation flags, inferred account demographics, account type, historical engagement metrics, or suggested search terms, the central claim would lose its factual basis. A documented Article 40 request that is refused for one of these points would support it.","tokens_in":18677,"feed_emoji":"🗳️","tokens_out":7491,"duration_ms":68561,"temperature":0.7,"pith_summary":"This paper uses the 2024 Romanian presidential election interference case to test whether the data access promised by Article 40 of the EU Digital Services Act can actually be operationalised. It argues that the two existing researcher-facing mechanisms, TikTok's Research API and user data donations, leave out precisely the data needed to study the two systemic-risk factors it identifies: platform manipulation and hidden advertising. Because recommendation and moderation data are entirely absent and other necessary data points, such as inferred account demographics and historical engagement metrics, are missing, the paper concludes that researchers cannot answer its example research questions through existing means and must turn to Article 40. It also shows that even that route is blocked by a standoff: researchers must specify data they cannot know exists, while platforms demand specificity. The paper's practical contribution is a data-requirement map derived from prior computational election research and checked against TikTok's documentation, API, and data donation exports.","feed_headline":"TikTok's data tools can't answer key election-interference questions","feed_subtitle":"The paper maps what researchers need to study Romania's 2024 election case against what TikTok actually exposes.","key_machinery":"The central mechanism is the Article 40 DSA data-access pipeline, combined with the paper's availability audit. The standoff problem is the information asymmetry at the heart of the argument: researchers must request specific data without knowing what a platform collects, while platforms expect specificity and can deny that invisible data exist. The audit, summarised in Table 1, is the load-bearing instrument: each data point needed for the Romanian election case is matched against three sources, platform documentation, the TikTok Research API, and data donations, and labelled available, limited, or not available. This classification carries the argument that Article 40 is needed, because it shows which gaps are real and which are merely undocumented.","core_discovery":"The paper's central claim is that existing data access mechanisms provide insufficient means to investigate the systemic risks described in the Romanian election case study, and that access through Article 40 DSA is therefore necessary. Working from the known features of the incident, such as a coordinated network generating inauthentic engagement, undisclosed micro-influencer advertising, and livestream gifting that amplified one candidate, the paper derives concrete research tasks and the data categories they require: content, user, engagement, moderation, temporal, network, algorithmic, and geospatial data. It then classifies each data point against TikTok's privacy documentation, the Research API, and data donations obtained from the authors' own accounts. The audit shows that recommendation and moderation data are entirely inaccessible, and even within accessible categories, corresponding points such as account demographics, account type, and historical engagement metrics are missing, which the paper argues renders the research questions unanswerable through existing means.","pith_inferences":["A natural extension is to run the same documentation-to-API audit on other large platforms such as Instagram, YouTube, or X; if the same classes of data are missing, the gap is structural to the platform-researcher relationship, not specific to TikTok.","The paper's data-need checklist could be reused as a completeness checklist for Article 40 applications, with regulators asking applicants to show which of the eight data categories each systemic-risk factor requires and where each point is available.","A testable prediction follows from the paper's logic: if TikTok ever expands its Research API to include algorithmic parameters, moderation flags, or inferred account attributes, the unanswerable verdict on election-interference research questions should be revisited.","The standoff might be broken not by case-by-case requests but by requiring platforms to publish machine-readable data inventories, making invisible data visible before any request is filed."],"forward_implications":["Researchers preparing Article 40 applications will need to justify each data request against platform documentation, as the paper demonstrates, because the audit shows that even documented data may be absent from public APIs and donations.","Digital Services Coordinators and the European Commission must clarify data inventories under Article 6(4) of the Delegated Act, otherwise the standoff persists: researchers cannot request data they cannot see listed anywhere.","Election-interference research on TikTok cannot proceed through compliant external means alone; the paper's classification implies that studies of recommender amplification and moderation effects will require vetted access.","The systemic risk concept under Article 34(1)(c) DSA becomes operational only when tied to concrete data needs, as the paper does by linking electoral risk to platform manipulation and hidden advertising.","Cross-platform research remains an open challenge because the case study is limited to TikTok, while election interference typically spans multiple platforms."],"supporting_citations":[{"why":"Supplies the journalistic account of the Romanian election interference incident and the claim that one candidate benefited from TikTok amplification.","marker":"(Ross and Popoviciu 2024)"},{"why":"Identifies the incident as the first to trigger post-DSA systemic risk investigations by the European Commission, anchoring the case-study rationale.","marker":"(Commission 2024)"},{"why":"Provides the investigation of the bot network behind the candidate's TikTok amplification, used as preliminary evidence of inauthentic behaviour.","marker":"(Lut,ac 2024)"},{"why":"Documents the coordinated TikTok campaign supporting the candidate, used as preliminary evidence of platform manipulation.","marker":"(Snoop.ro 2025)"},{"why":"Establishes data donations as a terms-of-service-compliant research access mechanism that the paper audits alongside the Research API.","marker":"(Van Driel et al. 2021)"},{"why":"Introduces TikTok data donations as a source of personal data exports that the paper classifies for availability.","marker":"(Zannettou et al. 2023)"},{"why":"One of the prior election studies whose data requirements, including content, user, network, and temporal data, feed the paper's data-need list.","marker":"(Grinberg et al. 2019)"},{"why":"Supplies the data categories used to study false information during the 2016 US election, contributing to the paper's derived data requirements.","marker":"(Allcott and Gentzkow 2017)"}],"fun_headline_variants":["TikTok data gaps block election interference probes","DSA data access fails to expose TikTok's role in Romanian vote","Researchers hit a wall on TikTok data for election case","TikTok data limits leave election questions unanswered","Romanian election case exposes TikTok data blackout"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The audit treats the authors' own TikTok accounts, the API endpoints they selected, and public platform documentation as a complete and accurate picture of what the Research API and data donations can provide; if undocumented fields or account-dependent donation packages exist, the conclusion that the research questions are unanswerable would be too strong.","fun_headline_variants_meta":{"raw":{"variants":["TikTok data gaps block election interference probes","DSA data access fails to expose TikTok's role in Romanian vote","Researchers hit a wall on TikTok data for election case","TikTok data limits leave election questions unanswered","Romanian election case exposes TikTok data blackout"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00058,"raw_usage":{"total_tokens":2784,"prompt_tokens":1049,"completion_tokens":1735,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":665,"completion_tokens_details":{"reasoning_tokens":1659}},"tokens_in":665,"tokens_out":1735,"duration_ms":11194,"temperature":1.0,"reasoning_tokens":1659,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T04:25:10.865530+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"If a researcher with vetted access to TikTok's Research API and a donated data package from an account involved in the Romanian election could retrieve any data point the paper classifies as not available, such as algorithmic parameters, moderation flags, inferred account demographics, account type, historical engagement metrics, or suggested search terms, the central claim would lose its factual basis. A documented Article 40 request that is refused for one of these points would support it.","supporting_citations":[],"review_version":1}