The European Commission has issued preliminary findings that Meta has violated DSA obligations requiring it to prevent underage children from accessing its platforms, a charge previously levelled only at adult content sites.
The European Commission has issued preliminary findings that Meta is in breach of the Digital Services Act for failing to keep children off Facebook and Instagram. The finding, issued on Wednesday, marks the first time the Commission has applied this specific charge, platform-level failure to prevent underage access, to a mainstream social media company, having previously reserved it for adult content sites.
The distinction matters. In March 2026, the Commission issued identical preliminary findings against four pornographic platforms – Pornhub, Stripchat, XNXX, and XVideo, for allowing minors to access their services by a simple click confirming they were over 18.
Wednesday’s action against Meta applies the same legal framework to a platform that children are not only using but signing up to. Despite requiring users to be at least 13 years old, Meta’s age verification on Facebook and Instagram relies primarily on self-declaration ,a mechanism independent research has consistently found ineffective.
The finding is part of the broader formal proceedings the Commission opened against Meta in May 2024 over child protection obligations under DSA Articles 28, 34, and 35. Today’s specific finding targets Article 28(1), which requires platforms to put in place appropriate and proportionate measures to ensure a high level of safety, privacy, and security for minors, and to prevent children who are below the applicable national minimum age from accessing a service.
The timing of finding is deliberately calibrated. Just two weeks earlier, on April 15, European Commission President Ursula von der Leyen unveiled a privacy-preserving EU age verification app, built on zero-knowledge proof technology, that allows users to confirm their age without sharing personal data with platforms.
Ursula Von der Leyen was explicit: “Online platforms can easily rely on our age verification app so there are no more excuses. We will have zero tolerance for companies that do not respect our children’s rights.”
By issuing the Article 28(1) finding against Meta two weeks after the app’s launch, the Commission is signalling that the technical-infeasibility argument, the claim that robust age verification is impossible without invading user privacy, is no longer available.
The EU has offered a solution. Meta has not adopted it. The preliminary finding is the consequence.
The app itself has not been without problems. Security researchers demonstrated it could be bypassed within two minutes of its release. But the Commission’s enforcement posture appears unaffected by that embarrassment: the relevant question, in regulatory terms, is not whether the app is perfect but whether Meta has deployed any comparably robust alternative. Its current reliance on self-declaration and AI-based age estimation does not appear to meet that bar.
Research conducted by the Interface-EU think tank and published in 2025 tested the sign-up flows of all major platforms used by children in the EU, including Instagram. The conclusion was unambiguous: all of the platforms studied allowed a simulated 14-year-old to create an account by simply entering a false date of birth.
No document check. No third-party verification. No friction beyond a click. Meta’s own account of its approach, provided to TechCrunch at the time the formal proceedings were opened in 2024, was that it uses self-declared age combined with AI assessments to detect users who may have lied, and allows people to report suspected underage accounts.
The company said internal tests indicated it had stopped 96% of teens who tried to change their birthdays from under 18 to over 18 on Instagram from doing so. But the Commission’s preliminary finding suggests it views these measures as inadequate under the DSA standard of ‘appropriate and proportionate.’
The precedent set by the porn platform findings is instructive. In that case, the Commission’s language was precise: the platforms had allowed minors to access their services “by a simple click confirming they are over 18.” The standard being enforced is not perfection, it is the replacement of trivially-bypassable self-declaration with something meaningfully harder to circumvent. By that standard, Facebook and Instagram’s current approach appears to fall short in exactly the same way.
What happens next?
Preliminary findings do not constitute a final non-compliance decision. Meta now has the right to examine the Commission’s case file and respond in writing. It may also propose remedies. The European Board for Digital Services will be consulted in parallel.
If the Commission’s views are ultimately confirmed and a non-compliance decision is issued, Meta faces a fine of up to 6% of its global annual turnover, a figure that, based on Meta’s 2025 revenues, would represent a potential penalty of several billion dollars. The Commission can also impose periodic penalty payments to compel ongoing compliance.
There is no fixed deadline for the proceedings to conclude. But Wednesday’s action sits within a broader enforcement acceleration that also includes, on the same day, preliminary findings on addictive design and recommender systems. For Meta, the cumulative message from Brussels is clear: the period of negotiated goodwill is ending. The Commission is now issuing formal charges on multiple fronts simultaneously, and the fines are no longer hypothetical.
Meta had not responded publicly to Wednesday’s announcement at the time of publication.
