On 17 September 2026, the European Commission published its proposal for the EU KIDS Act (the “Keeping Internet Digital Spaces Accountable and Trustworthy” Act). The headlines have focused on the proposed ban on social media for children under 13, and understandably so. But scratch beneath the surface, and what emerges is something considerably more ambitious, more prescriptive, and more far-reaching than a simple age gate. Organisations with any digital presence aimed at EU users would be well advised to engage with this proposal now, rather than treating it as somebody else’s problem.
What is actually being proposed?
The KIDS Act would be a directly applicable EU regulation, meaning it takes effect across all Member States without the need for national implementing legislation. It covers what the Commission has branded “Social Media+”: social networks, video-sharing platforms, online games, app stores, operating systems, AI companions and conversational chatbots. The scope is deliberately wide, and that breadth is the first thing worth paying attention to.
The headline measure is a tiered age-based restriction on social media and video-sharing platforms:
- Under 13: No social media account at all. Limited access to child-friendly video-sharing platforms is possible, but only through a guardian’s own account and subject to a one-hour daily cap.
- 13 to 14: No autonomous account, but a guardian may create a supervised “mini account” with limited contacts, guardian tools always active, and again a maximum one-hour daily limit.
- 15 to 17: Teenagers can set up their own accounts, but safety-by-design obligations continue to apply.
These account restrictions apply to social networking and video-sharing platforms with specific risk features such as livestreaming, profiling-based recommendations, or design that encourages uninterrupted consumption. Importantly, the regulation would prohibit Member States from imposing stricter minimum age limits, aiming to replace the current patchwork of national rules with a single EU-wide framework.
Beyond social media: the real scope
What makes this proposal genuinely novel is its extension well beyond traditional social media. The safety-by-design obligations apply by default to all in-scope services for any user under 18, not just those with accounts. A provider can only switch off the child-protective experience after establishing that a user is an adult.
This means a video game studio, an AI chatbot developer, or an app store operator may all find themselves caught, even if they have never thought of their product as “social media”. In particular:
- AI companions and chatbots must not be designed in ways that create emotional dependency in children and must be turned off by default for minors where integrated into a social networking service, video-sharing platform, or online game.
- Online games must include safeguards against luring minors to establish contact on other platforms.
- App stores must introduce age-rating systems and prevent minors from accessing apps rated as inappropriate for their age.
On the specifics, the proposal bans addictive features such as infinite scrolling without breaks, push notifications during sleeping hours (defined as 8 consecutive hours between 10pm and 8am), streak mechanics, and reward systems that encourage sharing or returning daily. Recommender systems must give primary weight to stated preferences rather than engagement signals, and a non-profiling option must be available. Virtual currencies in games must be displayed alongside their real-money value, and variable rewards (think loot boxes) are banned for minors.
Age verification: the hard question
Self-declaration of age is expressly insufficient under the proposal. For new accounts on social media and video-sharing platforms, providers must use a certified EU age-verification solution using a third-party proof-of-age attestation. The planned European Digital Identity Wallet would qualify.
For existing accounts, providers have six months from the regulation becoming applicable to determine whether current users are under 15. If a user’s age cannot be established, the account must be disabled. This retroactive element is significant and could prove operationally challenging for platforms with large existing user bases.
Other in-scope services (games, AI chatbots) have more flexibility but must still use age-assurance methods offering “a high level of accuracy, reliability, security, robustness, non-intrusiveness, privacy and data protection, and non-discrimination”.
Enforcement: serious teeth
Non-compliance could attract fines of up to 6% of a provider’s total worldwide annual turnover. For context, that is higher than the GDPR’s maximum of 4%. Enforcement piggybacks on existing DSA and AI Act machinery for the most part, with the European Commission directly supervising very large online platforms and certain AI systems. A fast-track procedure targets preliminary findings within 30 working days and a final decision within 90.
The proposal would also be added to the Annex of the Representative Actions Directive, opening the door to collective consumer redress for infringements.
What this means from a UK perspective
Although the UK is no longer an EU Member State, the KIDS Act would apply to services offered in the EU regardless of where the provider is established. Any UK-based business that offers a digital service accessible to EU users, whether that is a social media platform, a game, an AI chatbot, or an app store, should be thinking about this now.
The UK already has its own evolving framework for children’s online safety. The children’s safety duties under the Online Safety Act 2023 came into force in July 2025, and Ofcom has been actively enforcing its Protection of Children Codes and age-assurance requirements. The ICO’s Age Appropriate Design Code (the Children’s Code) has been in force since September 2021. The UK Government has also announced a proposed social media ban for under-16s, though legislation implementing it has not yet been introduced.
There is meaningful overlap between these regimes. Concepts like safety-by-design, age assurance, restrictions on addictive features, recommender controls, and safer defaults appear across both the UK and proposed EU frameworks. Organisations already complying with the UK Online Safety Act and the Children’s Code will recognise many of the KIDS Act’s requirements and should be able to leverage existing operational processes for their EU users.
However, the KIDS Act goes further in certain areas. Its explicit coverage of AI companions and chatbots, the detailed rules on emotional dependency, and the obligations placed on app stores and operating systems are new ground. The mandatory use of certified EU age-verification solutions for social media and video-sharing accounts is also more prescriptive than the UK’s current approach. Additionally, the flat prohibition on autonomous accounts for under-15s, rather than a risk-based assessment, represents a philosophical divergence from the UK model.
How much of this is genuinely new?
This is the question that matters most for organisations already subject to existing regulatory obligations. Much of the safety-by-design content will feel familiar to anyone who has implemented the DSA’s Article 28 minors guidelines or the UK’s Online Safety Act requirements. There are clear parallels in the treatment of addictive design, recommender systems, safer defaults, contact controls, and transaction protections.
The real compliance lift will be felt most acutely by services that do not currently qualify as online platforms under the DSA, such as many video games and chatbot providers. For these organisations, the KIDS Act would represent a significant step change.
There is also a question of regulatory complexity. The KIDS Act sits alongside, rather than replacing, the DSA, the AI Act, the GDPR, and the e-Privacy Directive. The Commission’s position is that compliance with the KIDS Act would constitute compliance with Article 28(1) DSA for matters covered, but the interplay between these overlapping regimes will inevitably generate difficult questions. This is particularly true for the GDPR: a 15-year-old may hold an autonomous social media account under the KIDS Act while still being unable to consent to particular processing under national digital-consent age rules.
What happens next?
The proposal now passes to the European Parliament and the Council under the ordinary legislative procedure. Even if adopted, the KIDS Act is unlikely to apply before 2028. Changes are expected during the legislative process, and the question of age thresholds is likely to be contested, given that national proposals across EU Member States already span ages 13 to 16.
The Commission has been candid that the rules will not work overnight, pointing to Australia’s experience, where a minimum age of 16 has applied since December 2025 and most minors who already held accounts still have them.
But none of that is a reason to wait. Organisations should be assessing now which of their services fall within the proposed scope, how the tiered age bands map to current sign-up flows, what age-verification solutions may be needed, and how these new obligations interact with their existing compliance work under the DSA, GDPR, and UK regimes. The direction of travel is clear in both the EU and the UK, and across the world: the era of self-regulation for children’s online safety is drawing to a close.
If you would like to discuss how current or future regulations impact what you do with please contact Olivia Ward, Lucy Pegler, Martin Cook, Hamish Corner or any other member in our Technology team.
This article was written by Olivia Ward.
