EU Finds Meta Falls Short on Blocking Under-13s from Facebook and Instagram

The European Commission has issued preliminary findings accusing Meta of violating the European Union’s Digital Services Act by failing to keep children under 13 off Facebook and Instagram, a determination that highlights persistent gaps between the company’s stated policies and the reality experienced by millions of young users. The ruling, released Wednesday after nearly two years of investigation, represents one of the most direct regulatory challenges yet to how the world’s largest social media company handles age restrictions and child safety.

At the core of the Commission’s case is the simple act of account creation. Both platforms set 13 as the minimum age in their terms of service, yet the sign-up process allows anyone to enter any birth date with no meaningful verification. A child can claim to be 15 or 18 without providing identification, uploading a document, or triggering any secondary check. Once on the platform, the systems designed to remove them are cumbersome and often ineffective. The Commission found that reporting an underage account can require up to seven clicks through poorly designed interfaces, and even successful reports frequently result in no follow-up action. Children flagged as too young often remain active.

European officials described Meta’s own risk assessments as “incomplete and arbitrary,” arguing that the company’s methodology does not properly account for evidence gathered across member states showing widespread underage use. Henna Virkkunen, the EU’s executive vice-president for tech policy, was blunt in her statement. “Meta’s own general conditions indicate their services are not intended for minors under 13,” she said. “Yet our preliminary findings show that Instagram and Facebook are doing very little to prevent children below this age from accessing their services.”

The decision lands amid a broader reckoning over social media’s documented effects on youth mental health. Researchers across Europe have linked early exposure to platforms like Instagram with heightened risks of anxiety, body-image issues, and compulsive use. By allowing children as young as 10 or 11 to create accounts with ease, Meta effectively outsources age decisions to the honesty of preteens and the vigilance of parents, an approach regulators now deem insufficient under the DSA’s requirement that very large online platforms actively identify and mitigate systemic risks.

Meta pushed back sharply. A company spokesperson told reporters that Instagram and Facebook are intended for users 13 and older and that the firm invests in detection technology to find and remove underage accounts. “We disagree with these preliminary findings,” the statement read. The company characterized age verification as an “industry-wide challenge” that no single platform has solved, and said it would share details next week about new measures being rolled out. Executives have long argued that perfect age gates are technically difficult without invasive forms of identification that could compromise user privacy or drive families toward less regulated corners of the internet.

Yet the Commission’s findings suggest Meta’s current tools fall well short of the “diligent” standard required by European law. The DSA was designed precisely to move beyond voluntary industry promises toward enforceable obligations on platforms that shape the digital public square. Previous actions under the regulation have already forced changes to content moderation, advertising transparency, and risk reporting. This case extends that logic to the foundational question of who is allowed on the platform in the first place.

The preliminary nature of the decision gives Meta time to examine the Commission’s evidence and submit a formal response. If the findings are upheld, the company could face fines of up to 6 percent of its global annual revenue, though the Commission has not yet signaled specific penalties. More significant than the financial threat may be the mandated changes to Meta’s risk-assessment processes. Regulators are demanding the company rethink how it evaluates harms to European children rather than treating underage access as a peripheral compliance issue.

This episode fits a pattern of European regulators moving more aggressively than their American counterparts. While Congress has held hearings and introduced bills focused on child online safety, comprehensive federal legislation remains elusive. The EU, by contrast, is using the DSA to set de facto global standards, forcing multinational platforms to elevate child-protection systems in Europe that may eventually be adopted elsewhere for efficiency.

For families, the stakes are immediate. Parents have long complained that social media companies make it too easy for young children to lie about their age and too hard to extricate them once they are hooked. The Commission’s emphasis on both prevention and effective removal procedures acknowledges that reality. Simply telling users the platforms are not for children under 13 has proven an inadequate substitute for actual barriers.

How Meta responds in the coming months will test whether the company treats this as a serious regulatory and ethical failure or as another compliance negotiation to be managed. The Commission has made clear it expects fundamental changes to age-enforcement systems, not incremental tweaks to reporting forms. For an industry that has spent years telling regulators that age verification is impossible, the EU is now insisting that “impossible” is no longer an acceptable answer when the wellbeing of children is on the line.

The case also raises larger questions about the business models that reward maximum engagement from the youngest possible audiences. Instagram in particular has built much of its success on visual self-presentation that can prove especially fraught for preteens still forming their identities. If Meta cannot or will not build effective age gates, European regulators appear prepared to force the issue through the blunt instrument of the DSA.

Meta will now enter a formal process of review and rebuttal. The outcome could reshape not only how Facebook and Instagram operate in Europe but also set expectations for every major social platform that serves children. For a company that once dismissed much of the criticism of its youth safety record as overblown, Wednesday’s findings represent an official European verdict that the safeguards are simply not good enough.