The European Commission on Thursday opened an investigation into Snapchat and warned four pornographic platforms they could face penalties for failing to follow child safety laws.

The moves come as regulators worldwide grapple with the challenge of verifying users’ ages online while protecting their data from cyberattacks. The problem has proved difficult to solve in the European Union, despite the introduction of strict requirements under the Digital Services Act (DSA) which can lead to companies being fined up to 6% of their global annual turnover for failing to comply.

Speaking to journalists ahead of the announcement, a senior Commission official said they were “not convinced of the measures that Snapchat has taken to ensure that under-13s are not getting on the platform.”

Hard age checks such as ID uploads and facial recognition are often unsuitable for platforms that allow younger minors, and raise concerns about data privacy, surveillance and security breaches.

Simpler systems like self-declaration, in which users are queried to confirm they are of age, are widely used but criticized as ineffective. The Commission said Tuesday that more advanced tools, such as Snapchat’s AI-based age estimation, are also under scrutiny for failing to reliably identify users. Adult platforms that rely on basic click-through checks are believed to be in breach of the rules.

The Commission said it was particularly concerned about Snapchat users, whether children posing as older users or adults pretending to be minors, falling outside of the platform’s age protection measures.

It said there is growing evidence of grooming on the platform, going beyond sexual exploitation and including efforts to draw minors into criminal activity, increasingly including extremist networks, the officials said.

Henna Virkkunen, the Commission’s technology lead, said: “From grooming and exposure to illegal products to account settings that undermine minors’ safety, Snapchat appears to have overlooked that the Digital Services Act demands high safety standards for all users. With this investigation, we will closely look into their compliance with our legislation. “

Authorities are also examining whether minors can access banned goods such as alcohol and vaping products, and whether Snapchat’s reporting tools comply with EU standards. The case builds on earlier work by national regulators, including in the Netherlands, and brings the investigation under the Commission’s direct control.

Adult-only platforms

In a separate move, the Commission said four pornographic websites — Pornhub, Stripchat, XNXX and XVideos — likely breached EU rules by failing to prevent minors from accessing adult content.

“If you are an adult-only platform, you have to make sure that only adults come on your platform, and we are not convinced they have taken the necessary measures,” the official said.

The Commission said these sites rely largely on self-declaration, allowing users to confirm they are over 18 with a single click, which it considers inadequate. They have a right to respond to the charges of falling short and attempt to remediate the situation before facing any penalties.

The Commission officials said they are testing a privacy-focused “mini wallet” that would let users prove their age without handing over personal data, though companies can use other systems if they meet EU standards.

The pilot is underway in France, Denmark, Italy, Greece and Spain, and forms part of broader plans for a controversial EU digital identity wallet. The aim is to allow users to confirm they are above a certain age without revealing who they are.

Instead of uploading ID documents to platforms, a trusted authority would verify a user’s age once and store that credential on their device. When accessing a service, users would share only a simple confirmation, such as being over 18, without disclosing their name or date of birth.

Officials say the system is designed to prevent tracking or data sharing, working through a “triangular” setup in which the entity verifying age does not directly interact with the platform, ensuring identities are protected using cryptographic zero-knowledge proofs.

“This is not about storing the data anywhere,” a senior Commission official said. “You are getting the certification from a neutral party and then giving that to the platform.”

Officials liken it to the technology used in EU COVID certificates, where people could prove their status without exposing broader personal data.

EU member states are expected to roll out the bloc’s planned digital identity wallet more widely at a future date, depending on the development of the trials.

Officials see it as a leading option for age verification because it combines effectiveness with strong privacy safeguards, though they stress it is not mandatory if other solutions can meet the same standard.

Critics say the EU’s digital wallet approach still raises significant privacy and security concerns, despite being designed as a safer alternative to current age checks. Civil society groups and researchers have warned the system could create new risks around data misuse, cyberattacks and exclusion if safeguards are weak.