Meta in breach of DSA over under-13s on Facebook and Instagram

The European Commission has preliminarily found that Meta’s platforms, Instagram and Facebook, are in breach of the Digital Services Act (DSA). The investigation indicates that Meta failed to identify and mitigate risks associated with children under 13 accessing its services. Although Meta's own terms set a minimum age of 13, the Commission found that current enforcement measures are ineffective.

Minors can reportedly bypass restrictions by entering false birth dates without verification. Furthermore, the tool for reporting underage users is described as difficult to navigate, while incidents of reported underage users often lack the proper follow-up. The Commission also claims Meta's risk assessments ignore evidence suggesting that approximately 10% to 12% of children under 13 in the EU are using the platforms.

Meta now has the opportunity to examine the investigation files and respond in writing. If the preliminary findings are confirmed, the Commission may issue a non-compliance decision, which could result in periodic penalty payments or a fine. 

Additional reporting by The Guardian.

Training Announcement: The IAPP Certified Information Privacy Technologist (CIPT) is a privacy-focused professional IT certificate from the IAPP that addresses data protection requirements and controls within complex technological environments. It explores the data lifecycle, privacy risk models and frameworks, the principles of Privacy by Design, and the role of privacy-enhancing technologies within the organisation. Find out more.