On September 17, 2026, the European Commission adopted a proposal for an EU KIDS Act, ("EU Keeping Internet Digital Spaces Accountable and Trustworthy") accompanied by a Communication ("An EU approach to online child safety") and a Staff Working Document.
The Act will restrict minors' access to social networking services and video-sharing platforms in the EU where those services pose a risk to them. It will also impose a range of online safety requirements on such services, as well as on software application stores, online games, operating systems, AI companions, and general conversational chatbots.
The EU is arguably late to the party in introducing a social media ban for minors. Member States including France, Germany and Poland have already begun the process to restrict children's access to social media as has the U.K., following Australia's stalking horse. Social media businesses in the U.S. are also facing limited restrictions following the Meta settlement, including default time-limits and safety-by-design default settings. There is no doubt though, that the EU's announcement is a significant milestone and that this is another piece of EU legislation that will impact businesses outside the EU, not least the U.S. and Chinese tech giants.
While many of the safety-by-design requirements relate to default settings which means they can be overridden by users, the overarching principle of banning addictive design is embedded, as are key features including preventing minors from accessing features or settings which pose a risk to their privacy, safety, security, or health and wellbeing, blocking contacts from strangers, and implementing mandatory time-limited access and interruption measures.
Social networking services, video-sharing platforms, and very large online platforms or VLOPs as designated under the Digital Services Act (DSA) face the greatest compliance burden, but the safety-by-design framework has broad application to online services used by minors. In-scope providers will need to implement additional requirements over existing, related duties under legislation including the DSA, the AI Act, and the GDPR.
VLOPs conducting systemic risk assessments under the DSA are already required to consider negative effects on minors' physical and mental well-being. The more granular approach under the Kids Act will need to be added into those existing assessments. Similarly, the DSA's mitigation toolkit already contemplates targeted measures to protect children, including age verification and parental control tools, and these may have to be expanded to accommodate the Kids Act requirements. Providers of AI companions and general conversational chatbots will be complying with the AI Act's Article 50 transparency obligations (as and when they apply), but the Kids Act goes further by introducing broad requirements to protect minors, notably including not using human-like interaction patterns that create emotional dependency.
In-scope services, while bearing in mind that the draft legislation may change before enactment, should begin mapping how the new requirements will interact with existing duties and take the incoming requirements into account as they implement related DSA and/or AI Act obligations.
Who's in scope?
The proposal applies to the following types of service that are accessible to minors in the EU:
-
online social networking
-
video-sharing platform services
-
software application stores
-
online games
-
operating systems
-
AI companions
-
general conversational chatbots.
For the first five of these, application is regardless of the provider's place of establishment. With regard to AI chatbots and companions, the Act applies to providers placing them on the EU market or putting them into service in the EU regardless of place of establishment. Providers without an EU place of establishment must designate a legal representative in a Member State where they offer their service, or extend the remit of a representative appointed under the DSA or AI Act.
Are there any exceptions?
There are limited exceptions for key services providing access to information e.g. digital news, educational and public-authority services, services and systems developed for the sole purpose of scientific research and development, and open-source software developing and sharing platforms, unless they constitute an AI system in scope of the Kids Act or of the AI Act.
Which services will be subject to access restrictions?
Access restrictions apply to online social networking services and video-sharing platforms where the service is deemed to pose a risk to the privacy, safety or security of the relevant age group. Services will be deemed to pose such risk where they:
-
enable real-time transmission of content to an indeterminate number of recipients
-
allow account-holders to contact or interact with people who are not contacts
-
use recommender systems based on profiling
-
use recommender systems that recommend content or contacts not sourced from pre-existing connections
-
deploy functionalities or interfaces which reasonably foreseeably or intentionally enable uninterrupted content consumption, incentivize interaction, or transmit automated notifications prompting renewed use.
What are the access restrictions?
Social media and video sharing services must not allow under-15s to create accounts or access their services via accounts created for or attributed to them where the service is deemed to pose a risk. However:
-
13–15-year-olds will be able use a guardian-managed mini account with limited features and daily time limits. The Article 20 guardian tools must always be activated on these accounts, and guardians must additionally be allowed to set daily usage limits of not more than one hour per day, pre-approve new contacts, and set a maximum limit on number of contacts.
-
Children aged 3-13 will exceptionally be allowed to access video-sharing platforms whose services are specifically designed for under-13s, via a guardian account and subject to strict conditions.
-
15–18-year-olds can set up their own accounts within a safety-by-design environment.
Safety-by-design
Services used by under-18s must implement safety-by-design and default and ensure a high level of privacy and security. VLOPs must monitor compliance with these requirements as part of their DSA risk assessments.
Social networking and video-sharing platform services
Providers must:
-
Prohibit addictive design features—these include automatic content play, incentivizing regular engagement, rewarding content sharing, and undermining a minor's decision to discontinue use.
-
Put in place effective time-limited access and interruption measures for minors designed to protect school time and core sleep hours.
-
Use safe recommender algorithms, including by giving priority to explicitly stated user preferences, disabling default contextual recommendations based on implicit engagement-based signals, not relying on personal data collected outside the service, and not exposing minors to information that may pose a risk to their privacy, safety and security, including where encountered repeatedly. Tools allowing minors to control the parameters of the recommender system, reset their preferences, and choose at least one option which is not based on profiling must be provided. These tools need to be presented in a way that does not entice minors to choose the least privacy-friendly option and must remain accessible during account creation and from the relevant section of the user interface.
-
Safe settings to be set at the highest level by default. Geolocation and other tracking features, access to microphone and camera, recommendations of other accounts and synchronization of accounts should be off by default, as should push notifications which must, in any event, be designed to protect minors' school and core sleep times. Default settings can only be changed by the provider where the minor is over 15 and has consented to changes after being clearly informed about them. Where a minor has turned on geolocation or tracking, it must be turned off again after their session on the service ends. Features or settings that pose a risk to minors must not be available to them. This includes features increasing social comparison or misrepresenting minors' images, in particular, by disproportionately embellishing or idealizing them.
-
Prevent unsolicited contact from strangers: providers must ensure that other service users can't initiate direct contact with the minor without prior approval, ensure minors aren't included in contact recommendations or similar features, can only be added to a user group with their explicit agreement, and can easily block any other recipient without having to disclose their identity. Providers must also ensure safeguards to prevent third parties enticing minors to approve direct contact requests.
-
Taking steps to limit the visibility of information shared by minors including their interactions with other users. This includes at least making minors' profiles private by default and providing user controls. Other service recipients must be prevented from being able to download or take screenshots of information relating to minors or of content shared by them.
-
By default, prevent minors from being able to livestream or host real-time transmission of user-generated content.
-
Ensure minors clearly understand what they are doing before entering into a financial transaction, and not design services in a way that can lead to excessive, impulsive or unwanted spending.
AI companions/chatbots
Providers must put in place measures to ensure a high level of protection of minors' health and safety, fundamental rights, wellbeing and development. AI systems must not use human-like interaction patterns likely to create emotional dependency. Required measures include avoiding addictive design, providing safe settings, ensuring transparency around economic transactions, not using profiling, ensuring under-13s can only access where enabled and controlled by a guardian using Article 20 tools, pre-testing and implementing safeguards, and conducting post-market monitoring to ensure risks to minors are identified and mitigated.
Where an AI chatbot or companion is deployed as part of a social networking service, video-sharing platform or online game, the host service provider must ensure it is not automatically activated or prominently displayed, that minors are not encouraged to use it, and that they can opt out at any time.
Providers of online games
Providers of online games must apply measures ensuring a high level of privacy, safety and security for minors, including preventing compulsive or excessive use, applying safe default settings, applying contact safeguards, and ensuring mandatory access to the Article 20 tools for guardians, with access for minors below 13 enabled and controlled only through those tools. Providers must put in place safeguards preventing the game from being used to entice minors into initiating contacts on other services. Where video gaming platforms allow recipients to create and upload their own games, the platform must put in place the necessary software and stipulated organizational measures (these must allow the games to comply with Article 15(1) and (2), Article 18 and Article 20).
App stores
Providers of software application stores must put in place an age-rating system applicable to each app, taking into account minors' evolving capacities. They must not allow minors to access or purchase age-inappropriate apps. To comply, providers must assess the recipient's age under Chapter V, including via the Article 20 tools for guardians, and must ensure that access for minors below 13 is enabled and controlled only through those tools. Providers must publish, in clear and accessible terms, the methodology, criteria and sources underpinning their age-rating systems, and must allow use of the EU age verification solution in their store.
Information provision, reporting and support
All information, tools and content reporting mechanisms must be provided in an easily accessible way that children can understand. Reports from minors must be prioritized and processed without undue delay and minors must be informed of the process and redress options. Providers must give minors access to support and authoritative information sources where they encounter illegal or harmful content. They should also make reasonable efforts to display clear warnings where minors are likely to publish or be exposed to risky content or interactions.
Guardian tools (Article 20)
Article 20 sets out requirements for guardian tools. Minors must be informed when the guardians use these tools and providers must encourage guardians to use them and remind them of their availability. There must be a reporting mechanism in case the tools don't work. VLOPs must ensure their tools are interoperable with third-party guardian tools in accordance with Article 6 of the Digital Markets Act (DMA).
Age verification and assurance
Parental responsibility verification
Parental responsibility must be verified for creating limited feature accounts and ensuring an age-appropriate experience on video-sharing platforms, as well as in order to implement Article 20 guardian tools. Providers may verify parental responsibility from freely accessible official databases or interfaces, or from previous engagement, or, until a suitable delegated act is passed, can rely on self-verification by the parent or guardian, subject to reasonable verification efforts. Verification must be privacy-preserving and not involve location tracking, targeting or profiling of an adult or minor. Member States are required to establish at least one system to allow parents and guardians to obtain an attestation of responsibility.
Age assurance
Services must use privacy-preserving age assurance based on state-of-the-art technology with zero knowledge proof measures i.e. revealing only what age threshold has been met. For the purposes of applying the age-related service restrictions, providers must rely exclusively on an EU age verification solution using an EU proof of age attestation certified as conforming with the EU Age Verification Scheme. For safety-by-design requirements (Article 8(1)), and app store obligations, other solutions can be used if they comply with the Act's general principles and data protection requirements. There must be access to a free electronic complaint mechanism to challenge incorrect outcomes. Where an operating system holds a compliant age signal, it must enable sharing with in-scope providers subject to user consent.
For new accounts, service providers must verify parental responsibility and the age of the user, but within six months of the Act becoming applicable, social networking and video-sharing service providers must establish whether existing account users are under 15 and disable accounts where they are. They must use an EU-certified age verification solution to do this unless they can establish with a high degree of confidence that the minimum age requirements have been met.
Compliance plans (Article 5)
The proposal reverses the burden of proof on VLOPs, which will have to prove their services are safe via design via independently audited compliance plans. They will be required to submit compliance plans to the Commission for new services, features or functionalities. Services will have to submit plans within 30 days of the Act coming into application where they are VLOPs at the time, or within four months of a VLOP designation. Auditors must supply a final report to the relevant provider and the Commission within two months of receipt of the plan, identifying any shortcomings. Where the Commission concludes there are shortcomings, the provider will have to submit a corrective action plan which must be implemented in full within 60 days. Providers must report annually on compliance as part of their DSA risk assessments and audits.
VLOPs are required to pay an annual supervisory fee for services embedded or which embed online social networking services, video-sharing platform services or software application stores. Where their services include AI companions, general conversational chatbots and video gaming platforms, the fee will be payable subject to the Commission's supervisory competence. The fee is charged per in-scope service or system and is capped at 0.03% of worldwide annual net income in the preceding financial year.
Enforcement and supervision
Enforcement structures will be those under the DSA and AI Act. There is a collective redress mechanism, and provision for Codes of Conduct, adherence to which will demonstrate compliance with aspects of the Act. Member States are required to implement national strategies to prepare and support minors in their use of in-scope services.
When?
The Act will come into force 20 days after publication in the Official Journal and apply generally six months after that, save that Article 5 (compliance plans) will apply from the date of entry into force, and Articles 33 and 35 (national support measures and expedited enforcement procedure) will apply one year after entry into force.
The Commission also plans to propose a broader Digital Fairness Act in autumn 2026 which will deal in more detail with addictive design.
Want to know what this means for you?
Please let us know if we can help you prepare for compliance.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]