EU Finds Meta Falls Short on Blocking Under-13s from Facebook and Instagram

The European Commission has issued preliminary findings declaring that Meta Platforms is breaching the European Union’s Digital Services Act by failing to enforce its own minimum age requirement of 13 on Facebook and Instagram. The announcement on Wednesday follows an investigation spanning nearly two years and reflects Brussels’ ongoing push to hold large technology companies accountable for how their services affect younger users. Yet the case also illustrates the practical difficulties of enforcing age limits in a digital environment where verification technology remains imperfect and personal responsibility often determines outcomes.

Commission officials stated that Meta does not adequately prevent children under 13 from creating accounts. During signup, users can simply enter any birth date they choose, with no effective controls to confirm accuracy. The EU further criticized the platforms’ reporting tools for suspected underage accounts, describing them as cumbersome and ineffective. Accessing the reporting form can require up to seven clicks, and even when reports are submitted, follow-up actions to remove the accounts are often absent or insufficient, according to investigators.

Henna Virkkunen, the EU’s lead on tech policy, emphasized the gap between Meta’s stated rules and actual practice. “Meta’s own general conditions indicate their services are not intended for minors under 13,” she said in a statement. “Yet our preliminary findings show that Instagram and Facebook are doing very little to prevent children below this age from accessing their services.” The Commission also described Meta’s internal risk assessments for protecting minors as “incomplete and arbitrary,” arguing they do not adequately reflect evidence from across the European Union that points to notable numbers of younger children on the platforms.

These shortcomings, the Commission contends, violate the Digital Services Act’s requirement that very large online platforms diligently identify and mitigate systemic risks, including those involving minors. The DSA, which took full effect in 2024, imposes obligations on companies to assess harms, implement safeguards, and demonstrate compliance or face potential fines reaching as much as six percent of global annual revenue. The preliminary nature of the findings gives Meta time to examine the Commission’s evidence and submit a defense before any final ruling.

Meta rejected the conclusions. A company spokesperson told reporters the platforms are explicitly intended for users 13 and older and that the company maintains systems designed to detect and remove underage accounts. “We disagree with these preliminary findings,” the spokesperson said. “We continue to invest in technologies to find and remove underage users and will have more to share next week about additional measures rolling out soon.” The company stressed that determining true age online remains an industry-wide problem that no single firm can solve alone. It pledged to continue engaging with regulators while pointing to its existing efforts.

The episode highlights deeper tensions in the debate over children and technology. Social media can expose young users to content or interactions for which they are unprepared, a concern supported by parental reports and some behavioral studies. At the same time, regulators in Brussels operate with limited visibility into the daily realities of product engineering and the trade-offs involved in age-estimation tools. Strong age verification often collides with privacy protections, user anonymity, and the simple fact that many children obtain phones and internet access through their parents’ decisions rather than corporate oversight.

Thomas Sowell’s writings on incentives, knowledge, and unintended consequences offer a useful lens here, even if not directly invoked by either side. Centralized authorities frequently underestimate the difficulty of dictating outcomes in complex systems, while assuming that more rules will automatically produce better behavior. In this instance, the Commission’s focus on Meta’s methodology risks overlooking the role of family choices and the limitations of what any company can realistically monitor across hundreds of millions of accounts. Parents who permit younger children to use these apps bear primary responsibility, yet regulatory language often frames the issue as one of corporate failure alone.

Meta’s position that age verification requires broader industry and societal solutions carries weight. Biometric checks, government ID mandates, or widespread device-level controls each carry costs in privacy, implementation, and potential exclusion of legitimate users. European regulators have signaled they want improved risk assessments that better incorporate local evidence of harm. Whether those adjustments will produce meaningfully safer experiences for children or simply add compliance layers that raise costs for European users remains an open question.

The Commission’s action fits a pattern of increasing European oversight of American technology firms, from content moderation to data practices. Meta now must decide how far to alter its signup flows, reporting systems, and internal evaluations to satisfy EU demands. For users and families, the practical test will be whether any changes actually reduce the presence of young children on platforms that were never designed for them, or whether determined kids and permissive parents continue to find ways around the rules. The preliminary ruling opens a formal dialogue, but it does not resolve the deeper challenge of aligning technological reality with regulatory ambition.