EU court dismisses Meta's challenge to German data protection order on child safety

The Court of Justice of the European Union has upheld a German data protection authority order requiring Meta to delete and refrain from processing data obtained from children who registered on Instagram with a false age. The ruling confirms that national data protection authorities may take immediate protective measures when children's data has been processed unlawfully, even when the breach originates from user misrepresentation rather than platform failure, and that such measures do not require prior consistency mechanisms under the General Data Protection Regulation when protecting the rights of vulnerable individuals is urgent.

The judgment establishes that platforms must actively prevent unlawful data collection from children who bypass age controls, creating a compliance obligation that identity checks at registration cannot satisfy if minors routinely defeat them. Real-time monitoring for predatory contact patterns in direct messages meets the duty to protect child users as soon as they are on the service, regardless of the age they declared, surfacing not only the child who lied about their birthdate but the adult attempting to exploit them. Guardii's cross-platform detection for grooming, sextortion and child sexual abuse material operates in the conversation layer where the actual harm to the child unfolds, reporting the shape and seriousness of contact to the parent or school equipped to act and enabling platforms to demonstrate active protection of minors in compliance with data-protection and online-safety mandates without constructing a centralised archive of message content.