Sites don't require phone numbers because of any sort of law or regulation. They started requiring them on their own, likely in an effort to amplify their tracking efforts by being able to a high confidence unique identifier to an account which can be paired and cross-referenced with data from other sources to create ever more detailed and invasive profiles of people. Privacy with anything involving companies like Facebook or Google is just nonexistent. And people are fine with this, until there's actually a motivation that isn't outright dystopic.

The companies that would be punished in this case would be Google/Facebook/etc if found to be willingly complicit in enabling fraudulent underage access. And the poetic thing about this is that this is where their endless datamining comes back to bite them square in the ass. That'll be day 1 discovery in the lawsuits, because Google/Facebook/etc already know full well who's e.g. under 14, with an extremely high degree of accuracy.