Partnerblog
On 17 September 2026, the European Commission published its proposal for the EU Keeping Internet Digital Spaces Accountable and Trustworthy Act (EU KIDS Act). The proposal has attracted significant attention because it would introduce a minimum age of 15 for the autonomous use of certain social networking and video-sharing platform services.
Yet the proposal is about much more than restricting access to social media.
The EU KIDS Act reflects a broader shift in European digital regulation. Rather than focusing primarily on content moderation and online harms after they occur, it seeks to address risks through the design of digital services themselves. The proposal introduces detailed safety-by-design obligations covering recommender systems, addictive features, interactions between users, default settings, AI companions, chatbots and online games.
For many businesses, compliance would therefore mean redesigning products and services, not merely implementing age-verification tools.
Who is in scope?
The EU KIDS Act casts a wide net. It applies to providers of online social networking services, video-sharing platform services, software application stores, online games, operating systems, AI companions and general conversational chatbots that are accessible to minors (under the age of 18). Its territorial scope is equally broad: the Regulation applies regardless of where the provider is established, provided that the service is offered to users in the EU or, for AI companions and chatbots, the system is placed on the EU market.
The proposal nevertheless contains a number of targeted exclusions, including not-for-profit online encyclopaedias, educational and scientific repositories, and services or systems operated by public authorities exclusively for their own use.
Minimum age and age verification
One of the most debated features of the proposal is the introduction of age-based access rules for social networking services and video-sharing platforms that present risks to children’s privacy, safety or security.
The proposal does not prohibit children from accessing online services altogether. Instead, it introduces a graduated approach depending on age and the level of parental involvement.
Under 13
Children under the age of 13 would generally not be allowed to create accounts on social networking or video-sharing platform services.
A limited exception would apply to certain child-focused video-sharing services, where a child may access content through a guardian’s account but without having an account attributed to them.
Between 13 and 14
Guardians may create a restricted account for the child.
Parental controls must remain continuously active and guardians would retain significant oversight of the child’s activities, including contact requests and screen-time limitations.
From 15 onwards
Minors may create and manage their own accounts without requiring parental approval.
Importantly, however, the safety-by-design obligations continue to apply until the user reaches the age of 18.
These minimum age rules can only be effectively enforced if users’ ages are reliably verified. The EU KIDS Act therefore makes clear that self-declaration alone is insufficient. To support compliance, the proposal envisages the use of certified age-assurance solutions provided by independent third parties, such as the EU age verification app or a certified European Digital Identity Wallet.
As a result, age assurance is likely to become one of the most significant compliance challenges arising from the proposed Regulation.
Safety by design: from a principle to concrete obligations
The most transformative aspect of the proposal may not be the age thresholds themselves, but the extensive safety-by-design requirements.
European digital regulation already recognises the need to protect minors. For example, Article 28 DSA requires online platforms accessible to minors to adopt appropriate and proportionate measures to ensure a high level of privacy, safety and security.
The EU KIDS Act goes significantly further.
Rather than relying on broadly formulated obligations, it introduces detailed design requirements that would apply by default to in-scope services. Providers may depart from those defaults only after age assurance has established that the user is an adult.
The proposal would prohibit a range of engagement-driven features commonly associated with addictive behaviour, including:
- endless autoplay without meaningful breaks;
- notifications designed solely to recapture a child’s attention;
- rewards for posting or streaming to mass audiences;
- “streak” mechanisms and similar engagement techniques.
The proposal would also impose restrictions on recommender systems. Recommendations should be based primarily on preferences explicitly expressed by the child, rather than inferred behavioural signals.
Several functionalities would need to be disabled by default for minors, including geolocation, camera access, microphone access and push notifications. Certain beauty filters and design features encouraging social comparison would also be restricted.
The proposal further strengthens protections relating to interactions with other users by introducing safeguards around direct messaging, contact requests and livestreaming functionalities.
In addition, services must ensure that commercial features do not encourage impulsive or unintended spending by minors.
AI companions and chatbots
The proposal reflects growing concerns around AI systems designed for social interaction.
AI companions and conversational chatbots must not be designed in ways that encourage emotional dependency among minors. They would also face restrictions regarding the retention and reuse of information derived from previous interactions with children.
Providers would be required to test such systems before deployment and monitor their impact afterwards.
Where AI companions are integrated within social media platforms, games or video-sharing services, they must not be activated automatically, easily disabled, and must not be actively promoted to minors.
Online games
Providers of online games would be required to implement measures ensuring a high level of privacy, safety and security for children.
This includes safeguards against compulsive use as well as measures governing interactions between users.
A new approach to enforcement
The proposal also introduces a notable shift in regulatory philosophy.
Traditionally, regulators assess compliance after identifying risks or harms. Under the EU KIDS Act, certain providers would instead bear a more proactive responsibility to demonstrate compliance.
Very Large Online Platforms (VLOPs) would be required to prepare and submit comprehensive compliance plans explaining how their services meet the child-protection requirements of the Regulation.
These plans would be subject to independent auditing at the provider’s expense and could trigger corrective measures where deficiencies are identified.
For social networking services, video-sharing platforms, online games and app stores, enforcement would largely build upon existing mechanisms under the Digital Services Act.
For AI companions and general conversational chatbots, supervision would be linked to the AI Act framework.
Penalties could reach up to 6% of worldwide annual turnover.
How does the EU KIDS Act fit within the EU digital rulebook?
The proposal does not operate in isolation.
Instead, it forms part of an increasingly interconnected European digital regulatory framework that already includes the DSA, the AI Act and the GDPR.
Three aspects particularly distinguish the proposal.
First, it significantly expands the categories of services subject to child-protection requirements, extending beyond traditional online platforms to encompass online games, operating systems, AI companions and conversational AI systems.
Second, it transforms many child-safety principles that already exist under the DSA into detailed and binding obligations. The focus shifts from risk management to direct regulation of product design.
Third, it creates a dedicated layer of child-specific requirements while remaining closely integrated with existing regulatory frameworks.
The proposal therefore illustrates a broader trend in EU digital regulation: increasing scrutiny of how services are designed and operated, rather than focusing solely on the content they host.
Practical implications for providers
Although the proposal remains subject to the legislative process, organisations should start assessing its potential impact. In practice, this means reviewing in-scope products and features, age-assurance and parental-control mechanisms, recommender systems, engagement-driven functionalities, child-user interactions, AI-enabled features and existing governance frameworks. For organisations already preparing for the DSA and AI Act, a useful first step will be to map existing compliance measures against the proposed EU KIDS Act requirements and identify any material gaps.
Looking ahead
The EU KIDS Act remains a legislative proposal and several elements are likely to be debated during the legislative process, including age thresholds, parental-control requirements and the precise scope of the services covered.
Nevertheless, the overall direction is clear.
The protection of minors online is no longer limited to content moderation or parental controls. The European Commission is increasingly focusing on the design choices embedded within digital products themselves.
If adopted in its current form, the EU KIDS Act would represent one of the most ambitious child-safety frameworks globally, requiring organisations not only to verify users’ ages, but to rethink how online services are built, configured and experienced by children.
Authors
Social networks and video-sharing platforms