The European Commission (EC) has introduced the Keeping Internet Digital Spaces Accountable and Trustworthy (KIDS) Act, a proposed law that would set common rules for protecting children online and restricting digital access across the European Union. The proposal still needs to pass through the EU’s legislative process before it can become law.
The proposal uses different restrictions for different age groups, rather than applying one blanket ban to minors. It would also require platforms to build stronger protections into their services, use age-assurance systems and give guardians more control over younger children’s access. The rules would apply alongside existing EU laws covering digital services, AI and data protection.
Which companies and services would it cover?
- Social networking services: Platforms that allow users to connect and interact with others, particularly where they have features such as recommendations, public sharing or contact with strangers.
- Video-sharing platforms: Services where users can upload, watch or share videos, including services with livestreaming and recommendation features.
- Online games and video gaming platforms: Game providers would face rules on addictive design, privacy, contacts and guardian controls. Platforms allowing users to create games would also have responsibilities.
- AI companions: AI systems designed to interact with users in a more personal or relationship-like way.
- General conversational chatbots: Chatbots that minors can access for general conversations.
- Software application stores: App stores would have to introduce age ratings and prevent minors from accessing age-inappropriate apps.
- Operating systems: They are not subject to the Act as a separate broad category. However, operating systems holding a compliant age signal would have to allow it to be shared with covered services, with the user’s consent.
Graded restrictions: The proposal creates different rules for children below three, three to under 13, 13 to under 15, and 15 to under 18.
- Below three: A child cannot use guardian-controlled access to a covered child-focused video-sharing service.
- Three to under 13: A child may access a qualifying child-focused video-sharing service through a guardian’s account, if the service permits it. The child cannot have their own account.
- 13 to under 15: Social networking and video-sharing services may allow a guardian to create a limited account for the child. Guardian tools must remain active, and daily access can be capped at one hour.
- 15 and above: The specific under-15 account restriction no longer applies, and teens can make an account without the consent or oversight of their parent or guardian. However, the platform must still apply the Act’s safety-by-design protections to minors.
For social networks and video-sharing platforms, the main restriction applies when a service has features that create specified risks. These include livestreaming to an unlimited audience, contact with people outside existing connections, profiling-based recommendations, recommendations of new contacts or information, and designs that encourage uninterrupted or repeated use.
Safety by design: The Act would require covered services to make children’s privacy, safety and security protections the default. For social networks and video-sharing platforms, this would include:
- Preventing automatic playback and uninterrupted consumption from encouraging excessive use.
- Providing time limits and interruptions that protect school hours and core sleep hours.
- Making recommender systems prioritise a child’s stated preferences.
- Turning off, by default, recommendations based on the child’s behaviour.
- Offering at least one recommendation option that does not rely on profiling.
- Turning off location tracking, microphone and camera access, account recommendations, contact syncing and push notifications by default.
- Preventing strangers from directly contacting a child unless the child has approved them.
- Requiring a child’s agreement before adding them to groups.
- Making it easy to block other users.
- Limiting the visibility of a child’s account information and content.
- Preventing children from livestreaming by default.
- Making children aware when they are making purchases and showing the monetary value of virtual currencies.
- Preventing designs that could encourage excessive or impulsive spending.
The rules would also apply to AI companions and general conversational chatbots. They would need safeguards against designs that could encourage emotional dependency. Providers would also have to test systems for risks to children before deployment and monitor emerging harms afterwards.
Online games would face similar requirements covering excessive use, privacy, contacts and guardian controls. App stores would have to rate apps by age and stop minors from accessing or purchasing apps unsuitable for their age.
Which platforms would face the under-15 restriction? The Act does not simply classify every social network or video service as restricted.
Instead, the restriction applies where the service has specified features or functions that create particular risks. These include:
- livestreaming content to an indeterminate number of recipients;
- allowing users to contact people outside their existing connections;
- using recommendations based on profiling;
- recommending new contacts or information outside existing connections; and
- using interface designs or automated notifications that encourage uninterrupted or repeated use.
The Commission could also add equivalent features later through delegated acts. Very large online platforms already designated under the Digital Services Act (DSA) would face additional requirements. They would have to submit detailed compliance plans and have those plans independently audited. Auditors would need expertise covering child rights, paediatrics, child development, age assurance, interface and recommendation systems, data protection and security.
Age assurance: The Act would require services to establish whether users meet relevant age thresholds. Simply asking users to declare their age would not qualify as age assurance. For services subject to the under-15 access restriction, providers would have to use an EU age-verification solution based on a third-party proof-of-age attestation certified under the EU Age Verification Scheme.
The system would have to be accurate, reliable, secure and non-intrusive. It would also have to protect privacy and avoid discrimination. Crucially, the system should not reveal a user’s identity, exact age or date of birth to the service. It should provide only the necessary proof that the user meets the required age. The proposal also requires age-assurance systems to avoid tracking, targeting or profiling users.
Member States would have to make at least one EU age-verification solution available free of charge. They would also have to provide ways for guardians to obtain electronic proof of parental responsibility.
Providers would also have to deal with existing accounts. They would need to establish whether existing users are below 15. However, they would not have to conduct fresh verification where they can establish, with a high degree of confidence, that the user has already reached the required age.
Parental controls: For guardian-controlled accounts, the guardian must be established as the person with parental responsibility for the child. The controls must be active by default. Guardians must be able to:
- set a daily access limit of no more than one hour;
- supervise the content shown or recommended;
- approve, limit or remove people the child can interact with; and
- suspend access at any time.
Guardian-controlled access ends when the child reaches 13. Member States must provide a free electronic method for proving parental responsibility. It must rely on official sources and reveal no more information to the service than confirmation that parental responsibility exists.
Enforcement: Enforcement would largely use existing EU digital-services and AI enforcement systems. The DSA enforcement framework would apply to social networks, video-sharing services, video gaming platforms and app stores. The AI Act enforcement framework would apply to AI companions and general conversational chatbots. AI providers could face fines of up to 6% of worldwide annual turnover for certain intentional or negligent breaches.
National authorities would supervise services within their remit. The Commission would retain powers over services under its existing EU-level supervision, including VLOPs.
For Commission proceedings involving covered very large platforms and certain AI systems, the proposal sets an expedited process. The Commission would aim to issue preliminary findings within 30 working days and a final decision within 90 working days.
The Commission could also charge certain very large platforms, AI providers and video gaming platforms an annual supervisory fee. The fee for an individual provider could not exceed 0.03% of its worldwide annual net income from the preceding financial year.
Also read:
