The proposal could have implications for social media and video-sharing platforms, online games, app stores, AI companions and general-purpose conversational chatbots. The legislative process is only beginning, however, and both the scope and individual requirements may change.

Key takeaways

  • The proposal applies to a broader range of services than social media alone.
  • Minors under 15 would face restrictions on independently creating accounts on certain social networking and video-sharing services.
  • Age assurance could become an important compliance and product-design consideration.
  • Safety-by-design requirements may affect settings, recommender systems, communications and commercial features.
  • Questions concerning proportionality, privacy, fundamental rights and technical implementation remain open.

Why is the EU proposing new rules?

Online child safety is already addressed through the Digital Services Act, the AI Act, the General Data Protection Regulation and national legislation.

Several Member States are also developing their own approaches to age limits, age assurance and access to digital services. According to the Commission, these differences risk creating legal uncertainty and regulatory fragmentation across the EU.

The EU KIDS Act is intended to establish a more consistent EU-wide approach. It would complement, rather than replace, the existing framework under the Digital Services Act and the AI Act.  

Which services could be affected? 

Depending on the obligation concerned, the proposal would cover providers of:

  • Social media services;
  • Video-sharing platforms;
  • Online games;
  • App stores;
  • AI companions; and
  • General-purpose conversational chatbots. 

Small and micro providers would not generally be exempt. Certain educational, scientific, public-sector, not-for-profit and open-source services could fall outside the scope, subject to the conditions set out in the proposal.  

Providers will therefore need to assess which rules could apply to their particular services, features and user journeys. 

New age-based access rules 

The Commission proposes a tiered approach to accessing certain social networking and video-sharing services:

  • Under 13: minors would generally not be able to create their own accounts. Guardian-supervised access could be available for certain age-appropriate video-sharing services.
  • From 13 to under 15: a guardian could create an account with limited, age-appropriate features for the minor.
  • From 15: minors could create and manage an autonomous account. 

The practical application of these rules would depend on the relevant definitions, exceptions and service features included in the final Regulation.  

Safety by design moves into focus 

The proposal would introduce safety-by-design requirements for services and systems used by minors. Depending on the service, these could cover:

  • Default privacy and safety settings; 
  • Recommender systems and personalised content;
  • Autoplay, infinite scrolling and notifications;
  • Rime-management tools;
  • Contact between minors and other users;
  • Purchases and other commercial features;
  • Child-friendly reporting and complaint mechanisms; and
  • Tools for parents and guardians. 

Specific requirements are also proposed for AI companions and conversational chatbots, online games and app stores. 

The proposal reflects the Commission's view that certain design features may require additional safeguards where minors are concerned. Whether a particular feature or design choice falls within the proposed requirements will depend on the final text and its interpretation. 

Age assurance will be a central issue 

Age assurance underpins both the proposed access restrictions and several safety-by-design requirements.

Under the proposal, age-assurance methods would need to meet requirements concerning accuracy, reliability, security, privacy and non-discrimination. Users would also need a way to challenge an incorrect result.  

The proposal would restrict reliance on self-declaration alone. The appropriate method and required level of certainty could nevertheless vary depending on the relevant obligation and the purpose of the age check. 

Finding an approach that is effective and proportionate, while respecting privacy, data protection, non-discrimination and other fundamental rights, is likely to be an important part of the legislative debate. 

What should businesses do now? 

The EU KIDS Act remains a proposal, so businesses are not yet required to implement its provisions. Potentially affected providers can nevertheless begin to consider where the proposal may interact with their existing services and compliance arrangements. 

Practical steps could include:

  • Identifying which services and functionalities may fall within scope;
  • Reviewing existing account structures and access arrangements for minors;
  • Assessing age-assurance methods and their privacy implications;
  • Reviewing relevant safety, privacy and recommender settings;
  • Documenting existing safeguards and risk assessments;
  • Identifying the legal, privacy, product and technical teams that may need to support implementation; and
  • Monitoring changes during the legislative process. 

Businesses should not treat the Commission’s proposal as a settled compliance standard. Its precise scope, obligations and enforcement arrangements may change as the text moves through the legislative process. 

What happens next? 

The European Parliament and the Council of the European Union will consider the proposal through the ordinary legislative procedure. 

Discussions are likely to focus on the proportionality and technical feasibility of age-assurance measures, the operation of guardian-managed accounts, the treatment of existing users and the relationship with the Digital Services Act, the AI Act and data protection legislation. 

For digital service providers, the immediate priority is to understand where the proposed framework could affect current services and future product development. Close attention to the negotiations will be important as the balance between child safety, privacy, technology and fundamental rights is further considered. 

Contact us

If you have any questions or would like to explore the implications of these developments for your business, please feel free to get in touch with one of the advisers mentioned below.