EU KIDS Act sets up fight over child safety and platform rules

The European Commission adopted the EU KIDS Act on Thursday, September 17, proposing to bar children under 13 from social media accounts, set 15 as the EU-wide minimum age for autonomous accounts and require major providers to prove their services are safe by design before children use them.¹

The draft regulation makes child online safety a test of centralization in EU digital policy. If approved by the European Parliament and the Council, it would replace diverging national approaches with common age thresholds, certified age verification, EU-level supervision for the largest platforms and design obligations extending beyond social media to video-sharing services, games, AI chatbots, app stores and operating systems.²⁴

Commission President Ursula von der Leyen previewed the plan a day earlier in her September 16 State of the Union address, telling lawmakers the Commission would propose “No social media under the age of 13” and “No personal account under the age of 15.”⁷ The formal proposal was published the next day with supporting documents, including a communication and staff working document, opening the legislative track through the EU’s co-legislators.²

The plan still faces debate and votes by EU member states and institutions, a process that could take years and renew confrontation with large technology companies and governments wary of an expanded Brussels role in platform regulation.⁸

A single EU age ladder

The Commission describes the KIDS Act as a regulation on the protection of minors online. Its central age model is a “staircase”: no social media account for children under 13; guardian-created, limited accounts for users aged 13 and 14; and autonomous accounts from 15, provided the service complies with child-safety obligations.³

For 13- and 14-year-olds, the Commission says parental tools would stay on, contacts would require approval and daily use could be capped at no more than one hour.³ For under-13s, the proposal allows only narrow access to child-oriented video services through a parent’s account, without the child holding an account or using personalized feeds or search.³

The proposal explicitly seeks to harmonize national rules. The Commission says one EU-wide age standard would remove obstacles in the digital single market and give children a similar level of protection across the bloc.² That is the measure’s core political trade-off: member states would gain a common enforcement baseline but lose room to set separate age limits or verification models in an area that touches family policy, education and fundamental rights.

Platforms must prove safety

The Act’s second major shift is the burden of proof. The Commission says service providers would have to show their services are age-appropriate and safe by design, rather than leaving parents, children or authorities to prove harm after the fact.¹³

For very large online platforms — those with at least 45 million monthly active users in the EU — the Commission says providers would need to submit compliance plans and have them checked by independent auditors before children come into contact with covered services under the new regime.³ The Commission could object to an auditor if independence is not ensured, and the platform would pay the audit costs.³

The design rules would target features the Commission considers harmful for minors, including addictive mechanics, infinite scrolling, certain push notifications, streak rewards, recommender systems optimized for engagement and unwanted contact from strangers.³⁴ The proposal would also require safe default settings, tools to reset feeds, options without profiling, easy blocking and reporting, limits on livestreaming by minors and protections against content being downloaded or screenshotted by others.³

Age verification becomes the fault line

Age assurance is likely to be one of the most contested parts of the legislative process. The Commission says self-declared birthdays would no longer be enough, and platforms would have to check both new users and existing account holders once the rules apply.³⁴

At the same time, Brussels is presenting the model as privacy-preserving. The Commission says platforms would not check identity documents or learn a user’s identity. Instead, certified independent tools, including a free EU age-verification app and later the European Digital Identity Wallet, would provide a yes-or-no signal on whether the user meets the relevant age threshold.³

Every member state would have to offer at least one free way to prove age, including for people without digital ID.³ That requirement points to a broader implementation challenge: the Act would centralize the rulebook, but national authorities would still have to support practical access to age-assurance tools.

Scope reaches AI companions and games

Although the proposal is politically framed around social media, the Commission’s overview says it would apply to social media, video-sharing platforms, online games, AI chatbots or companions, app stores and operating systems, while exempting some services such as encyclopedias, educational platforms and digital news.⁴

The Commission FAQ says AI companions and chatbots accessible to minors could not use designs likely to create emotional dependency. They would have to be tested for risks before launch and monitored after deployment, and could not be automatically switched on or pushed at children when embedded in a platform or game.³

Reporting by El País highlighted the proposal’s breadth, noting that Brussels’ draft covers tools such as ChatGPT-style chatbots, online games, YouTube-style video platforms, app stores and operating systems as well as social networks.¹⁰

Enforcement would build on DSA and AI Act

The Commission says enforcement would use existing structures under the Digital Services Act for online platforms and the AI Act for AI companions and chatbots.³⁴ The Commission would directly supervise the most widely used platforms and AI chatbots, while digital service coordinators, market surveillance authorities and other national bodies would oversee other covered services and systems.³

Possible fines could reach 6% of total worldwide annual turnover, and the Commission proposes expedited procedures for services it supervises, with preliminary findings within 30 days and a targeted final decision within 90 days.³

That enforcement architecture is part of the centralization debate. The Commission is not proposing a standalone child-safety regulator. Instead, it is layering new child-protection rules onto the EU’s existing digital rulebook, giving Brussels a direct role over the biggest services while leaving smaller or sector-specific cases to national authorities.

Parliament and Council take over

The proposal now moves from Commission initiative to legislative negotiation. Parliament will assign the file to committees, and political groups will prepare amendments. The Council will develop member-state positions. The final regulation would require agreement between the two institutions.

The path is likely to expose divisions over proportionality, privacy, age-verification infrastructure, parental responsibility and how much discretion member states should retain. Supporters will argue that a borderless internet requires a single EU standard and stronger obligations for platforms. Critics are likely to press for safeguards against over-verification, unintended limits on lawful access and excessive compliance burdens.

Von der Leyen framed the measure as a question of democratic authority over major platforms, saying in her State of the Union address that Europe should decide its own rules, not big tech.⁷ The legislative process will determine whether that argument can survive negotiations among Parliament, Council and member states — and whether the EU’s next major digital law becomes a common child-safety standard or a narrower compromise.