European Commission - Proposal for the EU KIDS Act (Keeping Internet Digital Spaces Accountable and Trustworthy)

The European Commission has proposed the EU KIDS Act, a directly applicable Regulation on children's safety online. It sets a harmonised minimum age of 15 for autonomous accounts on social networks and video-sharing platforms. It adds binding design duties for platforms, games, app stores and AI chatbots, and it makes EU-certified, privacy-preserving age verification the standard route to compliance. The proposal builds on the Digital Services Act (DSA) and the AI Act and uses their enforcement structures, but it goes further than both.

Context and status

The proposal follows the July 2026 recommendations of the Special Panel on Child Safety Online convened by President von der Leyen. Its central argument for EU action is fragmentation. Belgium is among the Member States that notified national age-limit legislation under TRIS (Technical Regulation Information System), and national age limits range from 13 to 16. 

Scope

The Regulation covers seven categories of provider (Art. 2): online social networking services, video-sharing platforms, app stores, online games (video games and gaming platforms), operating systems, AI companions and general conversational chatbots. This can be seens as "social media+" and can create a situation in which one company can face different obligations for different products. Providers outside the EU are covered.

Under Article 6, children under 15 may not create autonomous accounts on social networks and video-sharing platforms that present risk features. These features include:

• live streaming to an indeterminate audience;
• contact with people outside the user's connections;
• profiling-based recommender systems;
• uninterrupted consumption or engagement-prompting notifications.

Guardians may open limited accounts for 13–14-year-olds, with guardian tools always on, a maximum of one hour per day and pre-approved contacts. Below 13, only exceptional guardian-controlled access is possible. It runs through the guardian's own account, on video platforms specifically designed for younger children, after a published impact assessment (Art. 7). Existing accounts of under-15s must be disabled within six months of application, including where age cannot be established (Art. 6(4)).

The design duties apply by default to all users, including unregistered ones, unless adulthood is established through age assurance (Art. 8(1)). Providers may skip that check only where they can establish with high confidence that the user is not a minor (Art. 32(3)). The main duties are:

• Addictive design (Art. 9): no autoplay without interruption moments, no notifications unrelated to the child's own activity, no rewards for live streaming, no engagement streaks, and time limits that protect school time and sleep.
• Recommender systems (Art. 10): explicit preferences take priority, engagement-based signals are off by default, no data from outside the service is used, and at least one non-profiled option is offered.
• Safe settings and contact safeguards (Arts. 11–12): geolocation, camera and microphone, contact recommendations and push notifications are off by default; no unsolicited contact; no live-streaming by default.
• Economic transactions (Art. 13): prices in virtual currency are shown in real currency, and minors are not exposed to variable reward systems such as loot boxes.
• AI companions and chatbots (Art. 14): no features likely to create emotional dependence, memory of past interactions off by default, testing before market placement and post-market monitoring (micro and small providers are exempt from the latter). Access below 13 only through guardian tools.
• App stores (Art. 16): an age-rating system, blocking of age-inappropriate apps, and support for the EU age-verification solution.
• Games (Art. 15) and agency of minors (Arts. 18–20): reduced design duties for games, child-friendly reporting and guardian tools.

The Commission may update these lists by delegated act (Art. 25).

Age assurance

Self-declaration is excluded, and Article 28(3) states that any age assurance measure "shall be zero knowledge proof". For the access delay, providers must rely exclusively on an EU age-verification solution based on an EU proof-of-age attestation (Art. 29(2)). European Digital Identity Wallets that meet the scheme are deemed compliant. Operating systems must share an age signal with in-scope providers, with the user's consent (Art. 29(6)). Until a delegated act is adopted, a guardian's self-declaration suffices for proof of parental responsibility (Art. 26(1)(c)).

Enforcement and timeline

Enforcement relies on existing DSA and AI Act structure (see Table 2). For very large platforms, the Commission proposes to communicate preliminary findings within [30] working days and to adopt a final decision within 90 working days (Art. 35). This contrasts with the nearly 
 nearly two years taken in recent TikTok proceedings. Very large platforms must also notify a compliance plan and have it independently audited at their own expense (Art. 5). The Commission finances its supervision through a fee of up to 0.03% of worldwide net income (Art. 36). For AI companions and chatbots, fines can reach 6% of worldwide turnover (Art. 34(2)). The Regulation would apply six months after entry into force, and a review is due by 31 August 2030 (Arts. 42–43). Parliament and Council can still amend the text, and several provisions still need to be confirmed.

Table 1: Overlaps and interactions

Table 2: Who supervises what