Meta has been found in breach of EU law after the European Commission concluded that the tech giant failed to prevent children under 13 from signing up to Facebook and Instagram.
The preliminary findings, issued on Wednesday, cap a nearly two-year investigation under the Digital Services Act (DSA) and mark the first time the Commission has levelled this specific charge – a platform-level failure to enforce its own minimum age – against a mainstream social media company. Despite Meta’s own terms and conditions setting 13 as the minimum age for safe use, the Commission said the company did not have effective measures in place to stop under-13s from accessing its services.
“The DSA requires platforms to enforce their own rules: terms and conditions should not be mere written statements, but rather the basis for concrete action to protect users – including children,” said Henna Virkkunen, the Commission’s lead official on tech policy.
DSA Requirements and Meta’s Failures
Under the DSA, platforms such as Facebook and Instagram must “diligently identify and mitigate the risks” of minors under 13 using their services. The Commission’s evaluation used the 2025 DSA Guidelines on the protection of minors as a benchmark, which identify age estimation and age verification as appropriate methods. Yet the investigation found that Meta’s risk assessment methodology was incomplete and arbitrary, and appeared to disregard scientific evidence indicating the particular vulnerability of younger children to platform-related harms.
EU officials estimate that roughly 12% of children under 13 in the European Union use Instagram and Facebook. The Commission found that children could bypass age restrictions simply by entering a fake birthdate, with no effective controls to verify the self-declared information. Meta’s tool for reporting underage users was deemed “difficult to use and not effective,” with no proper follow-up, meaning underage users could continue to use the service unchallenged.
Virkkunen told reporters that the company’s “poor mitigating measures” were exposing children under 13 to dangers such as cyberbullying, grooming or “age-inappropriate experiences.”
Potential Fines and Meta’s Response
Meta will now have the opportunity to examine the Commission’s investigation file and mount a defence. If the preliminary finding is upheld, the Silicon Valley company could face a fine of up to 6% of its global annual turnover. Meta reported revenue of $201 billion (£148 billion) for 2025.
A Meta spokesperson said the company disagreed with the preliminary findings. “We’re clear that Instagram and Facebook are intended for people aged 13 and older and we have measures in place to detect and remove accounts from anyone under that age. We continue to invest in technologies to find and remove underage users and will have more to share next week about additional measures rolling out soon,” the spokesperson said. The company described understanding the age of users as “an industry-wide challenge, which requires an industry-wide solution” and said it continued to “engage constructively” with the Commission.
The broader investigation into Meta, opened in May 2024 under the DSA, continues on other strands, including whether the company does enough to protect the physical and mental health of young users. EU officials are also examining the potentially addictive impacts of Meta’s platforms, notably “rabbit hole” effects where algorithms feed young people negative or extreme content. Meta has previously stated that it has spent a decade developing more than 50 tools and policies designed to protect young users.
Broader Regulatory Push Across Europe
In a separate announcement, the Commission urged EU member states to have a privacy-preserving, open-source EU age verification app in operation by the end of the year. The app would enable users to prove their age online without sharing other personal details with the platform they wish to access, and could be used as a standalone app or integrated into national government “digital ID wallets.” However, some member governments have been lukewarm about the EU-wide app, preferring their own national versions, and a cybersecurity expert reportedly claimed to have hacked a demo version in under two minutes, saying it would expose users to risks. The Commission told Politico that the hacked version was a demo and that a vulnerability had been fixed.
The findings come as governments across Europe consider restricting children’s access to social media. Spain wants a ban for under-16s to protect children from what its prime minister called the “digital wild west.” French lawmakers have approved a bill banning social media for children under 15, set to take effect in September, and including a ban on mobile phones in high schools. The UK government said this week it was looking at “age or functionality restrictions” on social media for children under 16. Greece announced a ban on social media for children under 15 from 1 January 2027. Poland and Slovenia are drafting legislation for similar bans for under-15s, and Portugal has approved a bill requiring parental consent for children aged 13–16 to access social media. In November 2025, the European Parliament passed a non-legally binding resolution calling for a ban on social media for children under 16 unless parents decide otherwise.
The Commission’s action against Meta applies the same legal framework that it previously used against four pornographic platforms – Pornhub, Stripchat, XNXX and XVideo – for allowing minors to access their services. That precedent now extends to a mainstream social media platform where children actively sign up, underscoring the regulator’s determination to enforce age protections across the digital landscape.
