The tech company Meta has been found to be in breach of EU law for failing to prevent children under 13 from using its Facebook and Instagram platforms.

Issuing the preliminary findings of a nearly two-year investigation, the European Commission said on Wednesday that Meta did not have effective measures in place to stop under-13s accessing its services.

The US tech company was unable to meet its own terms and conditions that set 13 as the minimum age to access Facebook and Instagram safely, the commission said.

Following an initial assessment, Meta was found in breach of the EU’s Digital Services Act (DSA), which requires it to “diligently identify and mitigate the risks” of under-13s using its platforms.

The commission said its preliminary findings “do not prejudge the final outcome of the investigation”.

A Meta spokesperson said the company disagreed with the preliminary findings: “We’re clear that Instagram and Facebook are intended for people aged 13 and older and we have measures in place to detect and remove accounts from anyone under that age. We continue to invest in technologies to find and remove underage users and will have more to share next week about additional measures rolling out soon.”

The spokesperson said understanding the age of users was “an industry-wide challenge, which requires an industry-wide solution” and that it continued to “engage constructively” with the commission.

Meta will now have the chance to examine the commission’s investigation file and mount a defence. If the finding against the Silicon Valley company is upheld, it could be fined up to 6% of its global annual turnover. Meta reported revenue of $201bn (£148bn) for 2025.

The findings come as governments across Europe consider whether to ban social media for children, amid rising concerns from the EU executive over “the tsunami of big tech flooding” people’s homes.

Spain wants a social media ban for under-16s to protect children from the “digital wild west”, while French lawmakers have voted for similar restrictions for under-15s.

The UK government said this week it was looking at “age or functionality restrictions” on social media for children under 16.

Publishing its findings on Wednesday, the commission said children under 13 could use a fake birthdate to open a Facebook or Instagram account, with no checks on their self-declaration.

The company’s tool for reporting underage use was deemed “difficult to use and not effective”, with no proper follow-up, meaning underage users could continue to use the service, it said.

“Our preliminary findings show that Instagram and Facebook are doing very little to prevent children below this age from accessing their services,” the commission’s lead official on tech policy, Henna Virkkunen, said.

“The DSA requires platforms to enforce their own rules: terms and conditions should not be mere written statements, but rather the basis for concrete action to protect users – including children.”

Speaking to reporters, she said the company’s “poor mitigating measures” were exposing children under 13 years old to dangers such as cyberbullying, grooming or “age-inappropriate experiences”.

Officials estimate about 12% of children under 13 in the EU use Instagram and Facebook.

The commission opened a wide-ranging investigation into Meta in May 2024 under the DSA. Other strands of that inquiry continue, notably into whether the company is doing enough to protect the physical and mental health of young users.

EU officials are examining potentially addictive impacts of Meta platforms, notably “rabbit hole” effects, where an algorithm feeds young people negative or extreme content.

When the investigation was opened in 2024, Meta said it wanted young people “to have safe, age-appropriate experiences online” and had “spent a decade developing more than 50 tools and policies designed to protect them”.

In a separate announcement, the commission urged member states to have an EU age verification app in operation by the end of the year. The app would enable users to prove their age online without sharing other personal details with the platform they want to access. It could be used as a standalone app or integrated into national government “digital ID wallets”.

Some member governments have been lukewarm about the EU app, preferring their own national versions, while one cybersecurity expert claimed to have hacked it in under two minutes and said it would expose users to risks. The app is not yet publicly available and the commission told Politico this month that hackers had been using a demo version and that a vulnerability had been fixed.