Natalie Barnfield – Petabyte Lawyer (Of Counsel) at Digiphile.
October 7, 2026.
Going further to protect children
The EU announces proposals for the KIDS Act
Last month the EU Commission announced its proposals for the EU KIDS Act. Ambitious and complex, the proposals will have far-reaching implications for the design and architecture of a wide variety of online services.
The proposals for the EU KIDS Act propose to introduce:
- (i)tiered age restrictions for access to certain online services;
- (ii)extensive safety design requirements; and
- (iii)prescriptive age verification and parental oversight standards.
Introduction: more EU regulation?
There are few more important and emotive topics than ensuring the safety of our children. And yet, while we have extensive laws regulating online services in the EU, there are currently no harmonised minimum age requirements for children accessing online services in the EU, nor a set of legally binding harmonised standards for protecting children online across the EU.
As we continue to lead more digital lives, only further accelerated by the rapid rise of AI, being online is no longer optional for children. With 97% of young people in the EU using the internet daily and 92% of EU citizens viewing the protection of children online as a high priority (according to the Commission), going further to expand the protections for children online has become a clear political priority for the EU.
(https://digital-strategy.ec.europa.eu/en/policies/protecting-young-people-online)
“Being online is no longer optional for children.”
Notable is that these proposals come at a time when the EU is actively seeking to simplify its digital rulebook, but also at a time when multiple EU Member States are independently seeking to legislate to impose their own national age restrictions and rules governing the use of social media.
It then comes as no surprise that the EU KIDS Act proposals are highly anticipated and politically motivated, ultimately aimed at bolstering, and importantly harmonising, the rules that seek to protect children online in the EU.
Core objectives
The Commission’s proposals for the KIDS Act are centred on four main pillars:
Who will be caught?
Like other EU regulation, the proposed KIDS Act has extra-territorial application, and applies to in-scope services offered to recipients in the EU. While the proposals focus largely on obligations for social networking services and video-sharing platforms, they also apply to: app stores; online games; operating systems; AI companions; and general conversational chatbots.
There are some limited exemptions, including, notably, for services designed for “primarily” educational purposes, and no doubt their scope will be the source of hot debate during the legislative process.
Minimum age requirements to access certain online services
One of the core proposals is to introduce harmonised rules for minimum age requirements to access a specific set of online services. The proposals take a tiered approach:
Independent accounts
Children must be at least 15 to create and independently use their own accounts with social networking and video-sharing platform services with certain features. This includes: services with features that support live broadcasting to unlimited audiences, interacting with users outside the user’s network, recommender systems based on profiling, and addictive features. While 15–17 year olds can create and use accounts independently, these accounts must comply with the safety design requirements set out in other parts of the proposals.
Supervised “limited accounts”
Guardians (i.e. parents in most cases) of 13–14 year olds can set up supervised or “limited accounts” with social networking and video-sharing platform services provided that guardians have access to certain supervising tools. This must include the ability to set maximum time limits (not exceeding 1 hour per day), to pre-approve new contacts and to set limits on the number of contacts the child can have. In-scope services must also take measures to establish that the guardian has parental responsibility for the child and verify that the child has reached 13.
Controlled access accounts
Under 13s are only permitted to access video-sharing platform services that are “specifically designed” for under 13s, and even then, only through the guardian’s account where certain conditions have been met (e.g. the service must make certain parental controls available to the guardian, conduct and publish a risk assessment and signpost non-age-appropriate content). Social networking platforms must not allow under 13s to access their services.
Importantly, services caught by these requirements are expected to use an EU age verification solution to determine which bucket the user falls into (see Pillar 3 below).
Safety by design principles
The proposals also set out extensive safety design requirements for under 18s/children, with slightly different requirements for each of the different services in scope. For example, social networking and video-sharing platform services are subject to:
- Addictive design. Prohibitions on designing or operating services to encourage compulsive or excessive use by children – for example, enabling uninterrupted content consumption, incentivising content sharing or engagement. There are related requirements to ensure time-limited access measures to protect school and sleep hours.
- Recommender systems. Prohibitions on recommender systems based on inferred behaviours online, or based on information captured outside the service. This includes requirements to give priority to user-declared preferences.
- Safe settings. Requirements to ensure privacy-protective settings. Specifically geolocation access, microphone access, push notifications, account recommendations and synchronisation of contacts settings should all be off by default. Features posing a risk to privacy, safety, security, health or wellbeing must also not be available to children – including those increasing social comparisons.
- Contact and interaction safeguards. Prohibitions on allowing children to be contacted by unknown contacts, including children in contact suggestions/recommendations for others, and allowing children to be added to groups without explicit agreement. Requirements to allow children to easily block other recipients, without being disclosed as having blocked them. Requirements to limit the visibility of information/content shared by others. Requirements to ensure that no child’s contact details (address, phone number, email address) are shared with any others, and that no service recipients can download or take screenshots of a child’s content or contact details.
- Safety and security of economic transactions. Requirements to ensure that (i) children are made aware in advance that they are engaging in an economic transaction and (ii) services are not designed to lead to excessive, impulsive or unwanted spending (e.g. by offering rewards for purchases).
Safety design requirements for other services adopt similar requirements as outlined immediately above, but are tailored to specific service risks.
The proposals also impose:
- App store age rating systems and access requirements. Obligations on app stores to ensure age-appropriate access to the apps they make available through their platforms. App stores would be required to put in place age rating systems for apps made available for purchase via their platform, and only permit children to access apps with age ratings that correlate to the user’s age – through some form of age assurance. Notably, the proposals make clear that the age assurance obligations imposed on app stores should not affect those that apply to social network and video-sharing platforms – likely resulting in a “double tier” of age assurance for the user – both at the app store level and within the application itself.
- Tools that ensure the agency of children. General obligations for service providers to ensure that children and their guardians have access to specific features, notices, communications, reporting tools and content control tools that are easily accessible, tailored to their ages and easy to use, with backend processes designed to prioritise reports from children.
Age assurance and parental responsibility
In general terms, all “age assurance” solutions (which by definition notably excludes self-declaration) used must offer high levels of accuracy, reliability, security, robustness, non-intrusiveness, privacy and non-discrimination. Solutions must also be privacy-preserving; for example, they must not enable the identification of the recipient or locate, target or profile them for any purpose. The proposals also set out prescriptive, harmonised age assurance requirements:
- Complying with minimum age access requirements. To comply with the minimum age access requirements central to Pillar 1, providers of social networking services and of video-sharing platform services must rely exclusively on an EU age verification solution that uses an EU proof of age attestation, provided by a third party, certified as conforming with the EU Age Verification Scheme.
- App stores and safety by design obligations. For other obligations, such as the safety by design principles (Pillar 2) or the obligations applicable to app stores, providers can use other age assurance solutions provided that they meet the general principles and privacy requirements.
- Determining parental responsibility. Notably, providers are also required to verify parental responsibility of those that supervise “limited accounts” for 13–14 year olds and control accounts for under 13s. The KIDS Act proposals currently set out three ways that this can be achieved:
- through signals of parental responsibility based on national online databases;
- through signals of parental responsibility in their possession from prior engagements; or
- through self-declaration by the adult, until such time as delegated acts to specify signals indicating parental responsibility by the other above means are adopted.
Quite what “signals of parental responsibility” based on “national online databases” will look like in practice is unclear (and the self-declaration option in the third bullet seems to recognise as much), but recitals to the KIDS Act provide the example of “such as those related to education or public birth registries”. This suggests that providers making available “supervised” accounts will need to verify that the child using the supervised account is at least 13 using an EU age verification solution, and demonstrate that the supervising guardian has parental responsibility to supervise by checking against national databases such as birth registries.
Enforcement
The EU KIDS Act proposes to divide supervision and enforcement of its subject matter across the existing frameworks:
| Providers of | Supervised under | Maximum fine |
|---|---|---|
| Online social networking services, video-sharing platform services, online games that are video gaming platforms, and app stores | The EU’s Digital Services Act (and its enforcement regime) | Not exceeding 6% of worldwide turnover |
| AI companions and conversational chatbots | The enforcement and supervision provisions of the EU AI Act | Not exceeding 6% of worldwide turnover |
| Online games that are not video gaming platforms | Competent national authorities where they have their main establishment | Not exceeding 6% of worldwide turnover |
There is obvious overlap between parts of the KIDS Act proposals and certain aspects of the Digital Services Act – for example, the KIDS Act safety design requirements and the DSA’s requirements for online platforms to implement measures to ensure the safety and security of minors on their platforms. Hopefully, the proposal to bring enforcement and supervision of certain KIDS Act services under the DSA regime will remove the potential for “double jeopardy” enforcement risk under the two regimes.
Providers could also be subject to complaints from children, guardians or not-for-profits mandated to exercise collective rights of children under the Act.
There are also proposals to introduce supervisory fees on certain providers that constitute VLOPs, not exceeding 0.03% of worldwide annual net income of the preceding year – intended to be a “top-up” to the existing supervisory fee under the DSA.
Conclusions and timetable
“While there is clear political will for the adoption of legislation to solve the issues that the Commission’s proposals attempt to, the proposals are nonetheless complex and ambitious, with far reaching implications for industry.”
The Commission’s KIDS Act proposals will now need to progress through the EU’s ordinary legislative procedure. While there is clear political will for the adoption of legislation to solve the issues that the Commission’s proposals attempt to, the proposals are nonetheless complex and ambitious, with far-reaching implications for industry.
The legislative process will take some time. We can expect healthy debate, and even with political will, momentum and a favourable wind it seems unlikely that formal adoption will be before 2027/2028. With the speed of technological advances, the key will be to ensure that the output is flexible enough to keep pace.
Current proposals are that the majority of provisions will take effect 6 months after its entry into force (with some provisions taking effect 12 months after entry into force). The Commission is now inviting feedback on the proposals for an 8-week period until 26 November.
About Digiphile
We are a UK-based challenger law firm specialising in data protection, artificial intelligence and digital regulation. We help our clients realise the benefits of new technologies while managing the risks.
Simple. Strategic. Actionable.
86-90 Paul Street
London EC2A 4NE
United Kingdom
This publication is for general information only and does not constitute legal advice. It reflects the Commission’s proposals as announced and may change during the legislative process. Digiphile Services Limited is authorised and regulated by the Solicitors Regulation Authority under SRA number 8001623.