EU: Proposed KIDS Act Targets Online Child Safety

Why should I read this?

Social media and video-sharing platforms would have to close under-15s’ accounts under the KIDS Act, proposed by the European Commission (EC) on 17 September 2026. Platforms could let parents set up limited accounts for 13- and 14-year-olds, capped at one hour a day. Online games, AI chatbots and app stores would also have to be safe by design for minors.

In practice, services would have to treat every user as a minor unless they establish the user is an adult. The largest social media and video-sharing platforms would need an independently audited compliance plan. Fines could reach 6% of worldwide annual turnover.

The proposal would build on the Digital Services Act (DSA) and the AI Act. Like both, it would apply to providers offering services to EU users, wherever they are based. Enforcement would run through both regimes and data protection authorities, so one group could face several regulators. The European Parliament and the Council of the EU must still agree the final text, which would replace diverging national rules with one EU-wide standard. It would also sit alongside the GDPR, including its rules on children’s consent, and forthcoming EU rules such as the Digital Fairness Act, expected to address addictive design and other harmful online practices more broadly. Providers will therefore need to assess the KIDS Act as part of the wider EU digital rulebook rather than as a standalone regime.

What should I do?

The proposal would bring age limits, age checks and safety-by-design duties to a wide range of digital services, although details may still change. Affected providers can use the negotiation period to:

• map which services and features would be in scope, and review them against the proposal’s prohibited design features, default settings and age-check requirements
• check whether providers without an EU establishment would need an EU legal representative, or could extend a DSA or AI Act representative’s mandate
• benchmark current practices against the EC’s DSA guidelines on minors, which the proposal would largely turn into binding rules
• check AI chatbots and companions, including those built into other services, against the AI Act and the proposal’s specific rules for minors
• track national draft laws, as some could apply before the EU standard and require separate adjustments in individual markets
• identify the provisions with the greatest impact, such as age thresholds, safety-by-design scope and the treatment of smaller companies, while the text can still change

What else do I need to know?

Compliance costs, implementation and privacy

Compliance costs would rise. Services would need to remove engagement-maximizing features for minors, integrate certified age verification at sign-up and, for the largest platforms, produce an audited compliance plan. Age checks on every new account and the largest platforms’ annual audits would make part of these costs recurring. One EU standard could, however, spare providers from meeting similar requirements under several national laws.

Checks on existing accounts add a further challenge: within six months of the rules taking effect, platforms would need to determine whether existing users are under 15. Accounts of under-15s, and of users whose age cannot be confirmed, would be disabled. The proposal offers a concession, allowing platforms to skip new checks where they can already establish with high confidence that a user is at least 15. The EU Age Verification Blueprint, already available as an open-source tool, would offer one route to certified checks. The European Digital Identity Wallet, due from Member States by the end of 2026, would provide another channel. As platforms could not rely on their own age-estimation tools, readiness would partly depend on Member States rolling these solutions out in time.

The age verification framework reflects a deliberate tension between robust checks and data minimization. The proposal requires certified verification beyond self-declaration, but mandates zero-knowledge proof technology: the platform learns only whether a user is above or below the age threshold, and cannot repurpose the data beyond keeping that result. Adults opening new accounts would face the same age checks, adding friction to services they currently access without any verification step. The KIDS Act would also apply alongside the GDPR’s rules on children’s consent, meaning that providers will need to reconcile access restrictions, age assurance and data protection requirements in their onboarding processes.

Legislative timeline and likely debates

The proposal follows the ordinary legislative procedure, the EU’s standard lawmaking route involving the Parliament and the Council. Its length varies, and major EU digital laws have often taken more than a year to agree. Strong political backing could however shorten that timeline. Twenty-five Member States signed the Jutland Declaration in October 2025, calling for stronger online child protections. The European Council endorsed that agenda, and the Parliament passed a supporting resolution in November 2025.

Once adopted, most rules would apply six months after entry into force, with compliance plans from the largest platforms due 30 days later.

That political alignment suggests the core policy direction will hold, even if specific provisions change during negotiation. Several flashpoints are already visible. The Parliament’s 2025 resolution called for 16 as the age for social media use without parental consent, one year above the Commission’s proposed threshold of 15. That gap could be politically contested. The proposal gives no general exemption to small and micro enterprises, a point likely to draw pushback from smaller providers across all sectors in scope.

National and global context

Six Member States and Norway notified the EC of draft laws restricting minors’ access to certain online services in 2025 and 2026. The drafts differ in age limits and scope, and almost all other Member States are discussing similar measures. Some national initiatives may therefore apply before the EU standard is in place, although their adoption and cross-border application remain subject to EU internal market rules, notably the country-of-origin principle.

Under the Single Market Transparency Directive, recently notified drafts that overlap with the proposal may be frozen for 12 months from notification. Earlier drafts are not caught by this freeze, so some national rules may apply before the EU standard. France illustrates this transitional picture. A revised French bill restricting access by under-15s to certain social networks was notified to the Commission on 14 September 2026, three days before the KIDS Act proposal. The French draft already anticipates EU harmonisation: its restrictions would cease to apply once an EU regulation with the same purpose becomes applicable.

Child-safety regulation is also accelerating globally. Australia has restricted social media for those under 16. The UK and Brazil have adopted laws with specific protections for children online. The G7 endorsed child-safety principles in June 2026. Businesses operating in several of these markets may need to reconcile differing age thresholds and age-check rules.

Further reading:

• Insights: The EU age verification framework: a new pillar of online child protection and platform compliance
• Insights: The EU Digital Rulebook in Motion: The Digital Omnibus and parallel AI Act developments
• Executive Compliance Guide: Cyber Resilience Act
• Technology Law Shorts – July 2026
• EU Legislation Roundup: June 2026