EU Finds Meta in Breach of DSA Over Under-13 Age Verification

.t-callout-verified{display:flex;gap:14px;background:#f0fdf4;border:1px solid #bbf7d0;border-radius:8px;padding:16px 20px;margin:24px 0;color:#166534;font-size:0.92rem;line-height:1.55} .t-callout-verified strong{color:#166534} .t-finding-box{background:hsl(var(--card));border:1px solid hsl(var(--border));border-radius:14px;overflow:hidden;margin:28px 0} .t-finding-header{background:#003399;color:#fff;padding:14px 22px;display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:8px} .t-finding-header span{font-size:0.72rem;font-weight:500;letter-spacing:0.1em;text-transform:uppercase;color:rgba(255,255,255,0.75)} .t-finding-header .t-fine{font-family:Georgia,serif;font-size:1.3rem;font-weight:700;color:#ffcc00} .t-finding-body{padding:18px 24px} .t-finding-row{display:flex;flex-wrap:wrap;gap:14px;padding:12px 0;border-bottom:1px solid hsl(var(--border))} .t-finding-row:last-child{border-bottom:none} .t-fr-label{font-size:0.72rem;font-weight:600;letter-spacing:0.08em;text-transform:uppercase;color:hsl(var(--muted-foreground));min-width:140px;margin-top:2px} .t-fr-val{font-size:0.92rem;color:hsl(var(--foreground));line-height:1.55;flex:1;min-width:200px} .t-fr-val strong{font-weight:600} .t-seven{background:#fef2f2;border:1px solid #fecaca;border-radius:10px;padding:22px 24px;margin:24px 0;color:#7f1d1d} .t-seven h4{font-size:0.9rem;font-weight:600;color:#dc2626;margin:0 0 12px 0} .t-click-row{display:flex;gap:8px;align-items:center;flex-wrap:wrap} .t-bubble{width:34px;height:34px;border-radius:50%;background:#fff;border:2px solid #fecaca;display:inline-flex;align-items:center;justify-content:center;font-size:0.78rem;font-weight:700;color:#dc2626} .t-arr{color:#fca5a5;font-size:1rem} .t-click-label{font-size:0.86rem;margin-top:10px;color:#7f1d1d} .t-pull{margin:36px 0;padding:24px 28px;border-left:4px solid #003399;background:hsl(var(--card));border-radius:0 8px 8px 0} .t-pull p{font-family:Georgia,serif;font-size:1.08rem;font-style:italic;margin:0 0 8px 0;line-height:1.6;color:hsl(var(--foreground))} .t-pull cite{font-size:0.78rem;font-weight:600;color:hsl(var(--muted-foreground));letter-spacing:0.04em;text-transform:uppercase;font-style:normal} .t-fines .t-fine-row{display:flex;justify-content:space-between;align-items:baseline;padding:11px 0;border-bottom:1px solid hsl(var(--border));gap:16px;flex-wrap:wrap} .t-fines .t-fine-row:last-child{border-bottom:none} .t-fine-who{font-weight:600;font-size:0.92rem;color:hsl(var(--foreground))} .t-fine-amt{font-family:Georgia,serif;font-weight:700;font-size:1.05rem;color:#dc2626} .t-fine-why{font-size:0.84rem;color:hsl(var(--muted-foreground));flex-basis:100%} .t-who-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:14px;margin:24px 0} .t-who-card{background:hsl(var(--card));border:1px solid hsl(var(--border));border-radius:10px;padding:18px} .t-who-card .t-icon{font-size:1.4rem;margin-bottom:8px} .t-who-card h4{font-size:0.95rem;font-weight:600;color:hsl(var(--foreground));margin:0 0 6px 0} .t-who-card p{font-size:0.86rem;color:hsl(var(--muted-foreground));margin:0;line-height:1.5} .t-who-card.t1{border-top:3px solid #003399} .t-who-card.t2{border-top:3px solid #dc2626} .t-who-card.t3{border-top:3px solid #0d9488} .t-tuteliq{background:#040814;border-radius:14px;padding:36px;margin:44px 0 24px;color:#fff} .t-tuteliq .t-label{font-size:0.72rem;font-weight:600;letter-spacing:0.12em;text-transform:uppercase;color:#5eead4;margin-bottom:10px} .t-tuteliq h3{font-family:Georgia,serif;font-size:1.4rem;font-weight:700;margin:0 0 12px 0;line-height:1.3;color:#fff} .t-tuteliq > p{color:rgba(255,255,255,0.6);font-size:0.95rem;margin-bottom:24px} .t-step{display:flex;gap:16px;padding:14px 0;border-bottom:1px solid rgba(255,255,255,0.07);align-items:flex-start} .t-step:last-child{border-bottom:none} .t-step-num{width:30px;height:30px;min-width:30px;border-radius:50%;background:#0d9488;color:#fff;display:inline-flex;align-items:center;justify-content:center;font-size:0.8rem;font-weight:700;margin-top:2px} .t-step h4{font-size:0.95rem;font-weight:600;color:#5eead4;margin:0 0 4px 0} .t-step p{font-size:0.88rem;color:rgba(255,255,255,0.6);margin:0;line-height:1.5} .t-comp-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:12px;margin-top:24px} .t-cc{background:rgba(255,255,255,0.04);border:1px solid rgba(255,255,255,0.08);border-radius:8px;padding:16px} .t-cc h4{font-size:0.88rem;font-weight:600;color:#5eead4;margin:0 0 6px 0} .t-cc p{font-size:0.84rem;color:rgba(255,255,255,0.55);margin:0;line-height:1.5} .t-cta{background:#003399;border-radius:14px;padding:36px;margin:44px 0;text-align:center;color:#fff} .t-cta h3{font-family:Georgia,serif;font-size:1.4rem;font-weight:700;margin:0 0 10px 0;color:#fff} .t-cta p{color:rgba(255,255,255,0.7);font-size:0.95rem;max-width:520px;margin:0 auto 22px} .t-cta-btns{display:flex;justify-content:center;gap:10px;flex-wrap:wrap} .t-cta-btn{display:inline-block;background:#0d9488;color:#fff !important;font-size:0.83rem;font-weight:600;letter-spacing:0.04em;text-transform:uppercase;padding:12px 24px;border-radius:100px;text-decoration:none} .t-cta-btn.gold{background:#ffcc00;color:#003399 !important} .t-cta-btn.ghost{background:transparent;border:1px solid rgba(255,255,255,0.35)} ✓ Primary source verified. All findings are drawn directly from the European Commission press release IP/26/920, published 29 April 2026, and corroborated by Euronews, RTE, and Technology.org. The investigation was opened in May 2024 and draws on Meta's own internal documents, data, and risk assessment reports. This is today's breaking news. Today the European Commission issued its preliminary finding: Meta's Instagram and Facebook are in breach of the Digital Services Act for failing to prevent children under 13 from accessing their services. The mechanism of failure is one the industry has relied on for years, ask users to enter a date of birth, trust what they enter, do nothing to verify it. The Commission has now said, in writing, with the force of EU law and the threat of a 6% global turnover fine, that this is not adequate. Every platform operating in the EU should read this ruling as a direct message to them. ## What the European Commission found EC Preliminary Finding · Meta / Instagram / Facebook · 29 April 2026 Up to 6% global turnover Legal basis Digital Services Act (DSA), failure to diligently identify, assess and mitigate risks of minors under 13 accessing services. The data 10, 12% of children under 13 in the EU are using Instagram and/or Facebook, contradicting Meta's own internal assessments, which the Commission describes as "incomplete and arbitrary". Age mechanism failure Self-declared date of birth, no verification. Meta did not provide effective controls to check the accuracy of the birth date entered at sign-up. A child can enter any date and proceed. Reporting failure Reporting an underage user requires up to seven clicks with no reliable follow-up. Even when a minor under 13 is reported, they can simply continue using the service without any type of check. Scientific evidence Meta "disregarded readily available scientific evidence" indicating that younger children are more vulnerable to potential harms from these services. Parallel investigation A second strand examines whether Facebook and Instagram interface design exploits the inexperience of minors, pushing toward addictive use and "rabbit hole" effects. DSA standard required The 2025 DSA Guidelines on protection of minors require age estimation and verification methods that are accurate, reliable, robust, non-intrusive and non-discriminatory . ## Seven clicks to report a child. Zero to bypass the age gate. The Commission's seven-click finding deserves to sit alongside the primary age verification failure, because it reveals the same structural logic. Meta's design makes it easy to enter a false age and hard to report someone who did. That is not an accident. It is the consequence of building systems optimised for growth rather than safety. To report an under-13 user on Meta's platforms, 7 clicks, no reliable follow-up 1 → 2 → 3 → 4 → 5 → 6 → 7 Compared to: zero clicks to enter a false date of birth and create an account. The asymmetry is the finding. "Our preliminary findings show that Instagram and Facebook are doing very little to prevent children below this age from accessing their services. Terms and conditions should not be mere written statements, but rather the basis for concrete action to protect users, including children." , Henna Virkkunen, EU Tech Commissioner · 29 April 2026 ## The regulatory context: this is not the first fine, and it will not be the last The EU DSA finding sits in a pattern of accelerating enforcement. Understanding the trajectory matters for any platform deciding whether to invest in age assurance infrastructure now or wait for a fine. Epic Games (US, COPPA) $275M Largest FTC child privacy penalty ever. Children's data. 2022. TikTok (ICO, UK) £12.7M Children's data processed without lawful basis. 2023. Reddit (ICO, UK) £14.47M No robust age assurance. No DPIA. Self-declaration insufficient. Feb 2026. Meta, New Mexico jury $375M First jury verdict in wave of US state child safety actions. Mar 2026. Meta, EU DSA (pending) Up to 6% global turnover Preliminary finding today. Final decision and fine to follow. The 6% figure on Meta's global turnover, Meta reported approximately $165 billion in 2024 revenue. 6% is approximately $9.9 billion. That is not a ceiling that will be reached, but it is the statutory maximum the Commission is now working within. It signals that the EU treats this as a serious structural failure, not a minor compliance gap. ## What the DSA standard actually requires, and what fails it The 2025 DSA Guidelines on protection of minors establish the benchmark explicitly. Age assurance must be **accurate, reliable, robust, non-intrusive, and non-discriminatory**. The Commission has now confirmed that self-declaration of age meets none of those criteria. | DSA requirement for age assurance | Self-declaration (Meta's current system) | |---|---| | **Accurate** | ✗ Any date of birth accepted. No cross-check. | | **Reliable** | ✗ 10, 12% of under-13s access platforms despite prohibition. | | **Robust** | ✗ A child can bypass by entering a future year. No friction. | | **Non-intrusive** | ✓ A date-of-birth field is non-intrusive. But it is also ineffective. | | **Non-discriminatory** | ✓ Applied equally to all users. Equally bypassed by all users. | Two of the five DSA criteria are satisfied by self-declaration, because a checkbox is non-intrusive and non-discriminatory. It fails the three that actually matter: accuracy, reliability, and robustness. A system that is easy to use but easy to bypass is not adequate age assurance. The Commission has now formalised that position. ## Who needs to act, and how urgently Today's finding is against Meta. But the DSA applies to all Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) with over 45 million monthly active EU users, and its principles on child protection apply to all platforms accessible to children in the EU, regardless of size. The Commission has already opened parallel investigations into TikTok, Snap, and X. 🌐 Platforms with EU users Any service accessible to children in the EU, social media, gaming, AI companions, video platforms, is in scope. VLOP status (45M+ EU users) triggers the highest obligations. Below that threshold, the DSA's general child protection principles still apply. ⚖️ Platforms in active EU investigations TikTok, Snap, and X are already subject to related DSA proceedings. Pinterest and Discord are under ICO review in parallel. Any platform that currently relies on self-declaration for age assurance should treat today's finding as a direct warning. 🛡️ Platforms building proactively The most defensible position is not reactive compliance, it is documented, auditable age assurance implemented before enforcement arrives. Regulators consistently treat proactive investment differently from post-investigation remediation. What the Commission is asking Meta to do: overhaul its risk assessment methodology, properly map how risks show up across the EU, and tighten the systems that detect and remove underage accounts. Meta now has the right to inspect the case file and respond in writing. It can also propose fixes aligned with DSA guidelines. This process means the final decision and any fine are some months away, but the direction of travel is settled. ## How Tuteliq makes DSA-compliant age assurance implementable The DSA standard, accurate, reliable, robust, non-intrusive, non-discriminatory, describes exactly what Tuteliq's age verification is designed to deliver. Here is how each criterion is met in practice. Tuteliq Age Verification, DSA Compliant Accurate. Reliable. Robust. Non-intrusive. Non-discriminatory. Liveness detection and document verification. Per-jurisdiction thresholds. DPIA-ready audit trails. Zero content retention. Everything the DSA requires, implemented in under 5 minutes. 1 Accurate, liveness + document verification A live selfie is matched against an official identity document. OCR extracts the date of birth. MRZ validation confirms the document is genuine and unexpired. Face match score confirms the document belongs to the person present. This is not a self-declaration, it is a verified identity check. 2 Reliable, liveness detection prevents bypass The liveness check confirms a real, live person, not a photograph, a video replay, or a mask. Six visual checks run in parallel: blink, skin texture, depth cues, landmark motion, cross-frame consistency, and visual score. A static image of an adult cannot pass. 3 Robust, jurisdiction-specific thresholds configured per market EU member state minimum ages vary from 13 to 16. Tuteliq's market override system configures different thresholds per jurisdiction, so a platform operating in France (under 15), Germany (under 13), and the Netherlands (under 16) applies the correct standard in each market automatically. 4 Non-intrusive, blocking modal, one-time verification Verification runs once at account creation. The result is stored in the browser, not on the platform's server. On subsequent visits, verified users pass through instantly. Biometric data is deleted immediately after the result is returned. No data persists. 5 Non-discriminatory + DPIA-ready audit trail Every verification returns a unique audit_id, a timestamped, retrievable record of when the check ran, which method was used, and what result was returned. This is the documentation layer the Commission expects platforms to produce under a DSA investigation. 45-country document validation. SOC 2 Type II attestation in progress. Zero content retention Biometric data, the selfie, the document scan, is processed in memory and deleted immediately after the verification result is returned. Nothing persists. GDPR Article 5 data minimisation satisfied by architecture. Blocks the $4 bypass Pre-verified account resales (documented on eBay at $4 after Roblox's facial estimation rollout) are closed by requiring live face-to-document matching. A purchased verified account cannot be reused. Operates before data collection The ComplianceGate blocks the entire application until verification completes. No tracking scripts, no third-party tags, no data collection runs before age is confirmed. This is the architecture the ICO and DSA both require. 8 official SDKs, under 5 minutes Node.js, Python, Swift, Kotlin, Flutter, Unity, React Native, .NET. The API playground lets developers test against real documents before writing a line of production code. ## How a compliant flow actually runs end-to-end The DSA finding focuses on what platforms must achieve, not how to build it. The recommended Tuteliq integration pattern, used in production today, looks like this: Reference Architecture 5 components Compliance Gate A blocking modal overlays the entire app until the user is verified. No tracking scripts, no third-party tags, no data collection runs before age status is confirmed. This is exactly what the ICO and the DSA both require. Hosted Verification The user creates a Tuteliq verification session and completes ID document scan plus selfie liveness on Tuteliq's hosted page. Your servers never touch the biometric data. State Machine idle → creating → ready → polling → verified / failed . Polling is resilient to mobile browser throttling: setInterval every 3 seconds, plus focus , visibilitychange , return-URL flag, and a manual Next button. Status Normalization A user is verified when status === "completed" AND (data.verified === true OR data.is_minor === false) . Pending states ( processing , created , in_progress , awaiting_result ) keep polling. Terminal failures ( declined , rejected , expired ) end the flow. Per-jurisdiction Threshold The age gate is configurable per market. Same code path applies COPPA's under-13 in the US, GDPR-K's 15 in France, 13 in the UK and Germany, 16 in the Netherlands, and the 16-bracket for Australia's social media ban. The full reference implementation, including the polling state machine, the Supabase Edge Functions for create-age-verification and check-age-verification , and the localStorage flag pattern, is documented at tuteliq.ai/docs/verification/recommended-configuration . ## What the verification API actually returns Tuteliq's verification combines document intelligence, biometric matching, liveness detection, and multi-layer fraud prevention in a single API call. Most providers give you OCR and a face match. Tuteliq cross-references every data source on the document against every other one, MRZ check digits, PDF417 barcode, OCR text, document front vs. back, document vs. selfie, and flags any inconsistency as potential tampering. This is what catches forgeries that pass single-layer checks. What every verification checks 14 layers Document Number Algorithmic check digit verification for 45 countries: CPF, personnummer, Aadhaar, CURP, SSN, Codice Fiscale, and 39 more. Mathematical validation, not format check. MRZ Validation ICAO 9303 check digits on document number, DOB, expiry, and composite. Catches any tampering inside the Machine Readable Zone. Authenticity AI vision analysis of document layout, security features, fonts, colours, and photo integration against known templates. Recapture Detection Detects photos of screens (moiré patterns), printouts, and photo-of-photo attacks. Face Matching 128-dimensional descriptor comparison between document photo and live selfie. Liveness Landmark motion, texture analysis, depth cues, cross-frame consistency. Defeats static images and basic deepfakes. Cross-References MRZ vs. OCR. Front vs. back. PDF417 barcode vs. OCR vs. MRZ (US/CA licences). Declared document type vs. detected type. Any mismatch is flagged as tampering. Geolocation Flags inconsistency between the document's country and the request origin. Age Consistency Cross-checks document age against selfie age estimate. Discrepancy greater than 10 years is flagged. Full request and response schemas, including the checks object, MRZ fields, authenticity confidence, and barcode AAMVA fields, are in the Verification API reference . ## Open-source SDKs in every major language DSA-compliant verification should not require a procurement cycle. Tuteliq publishes official SDKs on the public package registries developers already use. Source is open and auditable, no vendored binaries, no hidden telemetry. Node.js npm install @tuteliq/sdk docs.tuteliq.ai/sdks/node Python pip install tuteliq docs.tuteliq.ai/sdks/python Swift (iOS) Swift Package Manager docs.tuteliq.ai/sdks/swift Kotlin (Android) Maven Central docs.tuteliq.ai/sdks/kotlin Flutter flutter pub add tuteliq docs.tuteliq.ai/sdks/flutter React Native npm install @tuteliq/react-native docs.tuteliq.ai/sdks/react-native .NET NuGet: Tuteliq docs.tuteliq.ai/sdks/dotnet Unity Unity Package Manager docs.tuteliq.ai/sdks/unity CLI brew install tuteliq or npm i -g @tuteliq/cli docs.tuteliq.ai/sdks/cli MCP Server npm install @tuteliq/mcp docs.tuteliq.ai/sdks/mcp ## What a compliant verification response looks like ```javascript // npm install @tuteliq/sdk const { Tuteliq } = require('@tuteliq/sdk'); const client = new Tuteliq({ apiKey: process.env.TUTELIQ_API_KEY }); // EU: apply per-member-state threshold const result = await client.ageVerify({ mode: 'complete', // liveness + official document market: 'FR', // France: under 15 threshold min_age: 13, // DSA baseline minimum external_id: userId, // your platform's user reference }); // DSA-ready response, full audit trail // result.verified -> true / false // result.is_minor -> false (over threshold) // result.age_band -> "16_17" | "18_plus" | "under_13" etc // result.document.country_code -> "FR" // result.liveness.valid -> true (live person confirmed) // result.audit_id -> UUID for DSA / DPIA documentation if (!result.verified || result.is_minor) { // Block access, no data collected, no consent sought return res.status(403).json({ error: 'access_denied' }); } // Store audit_id, your evidence trail for any DSA investigation await db.users.update(userId, { age_audit_id: result.audit_id }); ``` The `audit_id` on the final line is what a DSA investigation would ask for. It is a verifiable, timestamped record that age was checked, how it was checked, and what the result was, for every user, at the point of account creation. That is the documented evidence the Commission found absent in Meta's systems. The EC just told every platform in Europe what adequate age assurance looks like. Self-declaration is off the table. Tuteliq's liveness + document verification is DSA-compliant, GDPR-ready, and live in under 5 minutes. Free tier, 1,000 API calls/month, no credit card required. Start free Read the docs Talk to the team ## References 1. European Commission. *Commission preliminarily finds Meta in breach of Digital Services Act for failing to prevent minors under 13 from using Instagram and Facebook.* IP/26/920, 29 April 2026. [ec.europa.eu](https://ec.europa.eu/commission/presscorner/detail/en/ip_26_920) 2. Euronews. *EU finds Meta in breach of digital rules over children on Instagram and Facebook.* 29 April 2026. 3. Technology.org. *EU Charges Meta With Failing to Keep Under-13s Off Facebook and Instagram.* 29 April 2026. 4. RTE. *Meta criticised over measures aimed at under-13s.* 29 April 2026. 5. European Commission. *2025 DSA Guidelines on the protection of minors.* [digital-strategy.ec.europa.eu](https://digital-strategy.ec.europa.eu) 6. ICO. *Reddit issued with £14.47M fine for children's privacy failures.* 24 February 2026. [ico.org.uk](https://ico.org.uk)