EU Charges Meta Under Digital Services Act for Failing to Block Under-13 Users From Instagram and Facebook
The European Commission issued preliminary findings on April 29 that Meta violated the DSA by allowing children under 13 to create accounts using false birth dates, with potential fines reaching 6% of its global turnover.
Editor's Note ·
- Clarification:
- Two sources cited in this article — linkdash.eu and thepaypers.com — were not on the editorial source allowlist at the time of publication. Both are credible secondary publishers and all claims attributed to them are independently confirmed by the European Commission's official press release and by Euronews and The Next Web coverage. The sources have been flagged for allowlist review.
Overview
The European Commission issued preliminary findings on 29 April 2026 that Meta’s Instagram and Facebook violated the Digital Services Act by failing to prevent children under the age of 13 from accessing both platforms, according to the European Commission. If the preliminary conclusions are upheld, Meta could face a fine of up to 6 percent of its total worldwide annual turnover — potentially running into billions of euros.
The finding marks the first time the Commission has applied this specific charge under the DSA to a mainstream social media platform. Earlier in March 2026, the same preliminary findings were issued against four pornographic platforms — Pornhub, Stripchat, XNXX, and XVideos — for allowing minors to access adult content through simple age confirmation clicks, as The Next Web reported.
What We Know
The Commission formally opened proceedings against Meta in May 2024, according to The Paypers. After nearly two years of investigation, the regulator concluded that Meta’s age enforcement mechanisms fall short of the obligations imposed by Regulation (EU) 2022/2065 — the Digital Services Act — which has been fully applicable to very large online platforms since 17 February 2024, as Linkdash EU noted.
Meta qualifies as a Very Large Online Platform (VLOP) under the DSA, a designation that applies to platforms with more than 45 million monthly active users in the European Union, per Linkdash EU. Both Instagram and Facebook far exceed that threshold.
The Commission’s preliminary findings identify three specific failures. First, the account creation process allows children under 13 to bypass Meta’s own minimum age requirement. According to the European Commission, “when creating an account, minors below 13 can enter a false birth date that makes them at least 13 years old, with no effective controls in place to check the correctness of the self-declared date of birth.”
Second, once underage users gain access, Meta’s mechanisms for identifying and removing them are inadequate. The Commission found that Meta’s measures “do not adequately prevent minors under the age of 13 from accessing their services nor promptly identify and remove them, if they already gained access,” as the Commission stated.
Third, the reporting tool that lets users flag underage accounts requires navigating up to seven separate steps with no guarantee of effective follow-up, according to The Paypers and Linkdash EU.
The Commission also characterized Meta’s own risk assessment as “incomplete and arbitrary” and found that the company had disregarded available scientific evidence about the vulnerability of younger children, according to The Paypers.
The scientific evidence cited by the Commission indicates that between 10 and 12 percent of EU children under the age of 13 currently use Instagram or Facebook, according to Euronews. The violations identified fall under DSA Articles 28, 34, and 35, with Article 28(1) forming the primary charge for its requirement that platforms implement appropriate measures for minor safety and prevent underage access, as The Next Web reported.
Meta’s Response
Meta rejected the preliminary conclusions. In a statement, a company spokesperson said: “Instagram and Facebook are intended for people aged 13 and older and we have measures in place to detect and remove accounts from anyone under that age.” The company also argued that “understanding age is an industry-wide challenge, which requires an industry-wide solution,” according to Euronews.
Meta pointed to internal tests it said showed that its systems stopped 96 percent of teenagers attempting to change their stated birthdate from under 18 to over 18 on Instagram, according to The Next Web. However, the Commission’s concern centers on the separate and more fundamental problem of children falsely claiming to be 13 or older at account creation — a category Meta’s internal test does not directly address.
Meta will have the opportunity to examine the Commission’s investigation file and submit a written defense. The European Board for Digital Services will also be consulted before any final determination is made, per The Paypers. The preliminary findings do not prejudge the final outcome.
The EU Age Verification Push
The Commission timed the Meta announcement to coincide with a broader push on age verification. Two weeks before publishing the preliminary findings, on 15 April 2026, Commission President Ursula von der Leyen unveiled the EU’s own age-verification application, which uses zero-knowledge proof technology to confirm a user’s age without transmitting identifying data. The Commission recommended that member states deploy the app by 31 December 2026, as Linkdash EU reported.
In announcing the app, von der Leyen directed a pointed message at platforms: “Online platforms can easily rely on our age verification app so there are no more excuses.” She added: “We will have zero tolerance for companies that do not respect our children’s rights,” according to The Next Web.
What We Don’t Know
The proceedings have no fixed deadline for conclusion, meaning a final non-compliance decision and any accompanying fine could come months or years from now. The Commission may also expand its scrutiny: additional investigations into Meta continue regarding platform design and addictive features, according to The Paypers.
It remains unclear whether the Commission will require specific technical remedies as a condition of avoiding a fine — such as mandated use of the EU age-verification app — or whether it will leave the choice of compliance method to Meta.
Analysis
The case illustrates the growing gap between the DSA’s expectations for Very Large Online Platforms and what Meta has been willing to implement voluntarily. The Commission’s characterization of Meta’s risk assessment as “incomplete and arbitrary” suggests a structural disagreement about how seriously the platform has taken its obligations under EU law.
The DSA’s enforcement trajectory has accelerated. X received a €120 million fine in December 2025, and the March 2026 findings against pornographic platforms established the template now being applied to mainstream social media, per Linkdash EU. Applying Article 28(1) to Instagram and Facebook — platforms used by billions — significantly raises the stakes of the regulation’s child-protection provisions.
Meta faces simultaneous pressure on multiple fronts. The company is already engaged in a parallel judicial review against UK regulator Ofcom over how Online Safety Act fees are calculated, as previously reported, and it is contesting several US state-level rulings relating to child safety on its platforms. The EU DSA finding adds a further layer of regulatory exposure at a moment when the company’s approach to content moderation and child protection is under sustained scrutiny from regulators on both sides of the Atlantic.