The Commission announced the ruling on Wednesday after an almost two-year investigation, saying that Meta doesn’t have adequate measures in place to stop under-13s from accessing its services, or to identify and remove those already on its social media platforms. A notable example is that minors can simply enter a false birth date when signing up for Facebook and Instagram to falsely declare they’re over 13 years old — the minimum age outlined in Meta’s own terms and conditions — with no effective controls to verify their real age.

“Meta’s own general conditions indicate their services are not intended for minors under 13,” EU tech policy leader Henna Virkkunen said in a statement. “Yet, our preliminary findings show that Instagram and Facebook are doing very little to prevent children below this age from accessing their services.”

The available Facebook and Instagram tools for reporting minors under 13 are also “difficult to use and not effective,” according to the Commission, having found that even when an underage user is reported, there is often no follow-up to actually remove the child from the platform. These concerns place Meta in breach of DSA rules that requires it to “diligently identify and mitigate the risks” of under-13s using its platforms.

The EU’s announcement describes Meta’s own risk assessment for protecting minors from age-inappropriate experiences as “incomplete and arbitrary.” The Commission says it contradicts “large bodies of evidence from all over the European Union” that suggest 10-12 percent of children under 13 are accessing Facebook and/or Instagram.

“Moreover, Meta seems to have disregarded readily available scientific evidence indicating that younger children are more vulnerable to potential harms caused by services like Facebook and Instagram,” said the Commission. An investigation into concerns that Facebook and Instagram may cause “behavioral addictions in children,” launched alongside the age-verification probe, is still ongoing.

Meta now has the opportunity to remedy the breaches, with the Commission calling for Instagram and Facebook to update their risk assessment methodology and implement more robust age verification tools. If Meta fails to do so and is hit with a non-compliance ruling, it risks fines of up to six percent of its global annual turnover. That could be as high as $12 billion, given Meta reported revenue of $201 billion for 2025.

Meta says it disagrees with the EU’s preliminary findings in a statement to The Guardian:

“We’re clear that Instagram and Facebook are intended for people aged 13 and older and we have measures in place to detect and remove accounts from anyone under that age. We continue to invest in technologies to find and remove underage users and will have more to share next week about additional measures rolling out soon.”