EU Kids Act: how the EU plans to strengthen online protections for minors
What you need to know
The purpose of the proposed EU Kids Act is to strengthen the protection of minors online by regulating their access to certain digital services and the way those services are designed. It introduces age-based rules and new obligations for social media, video-sharing platforms, online games, AI companions, and chatbots.
On September 17, 2026, the European Commission presented a proposal for a new regulation designed to strengthen the safety of minors online, known as the “EU Kids Act.” (1) The proposal seeks to better protect minors online, in particular against the risks associated with certain addictive features, while harmonizing the rules applicable across the European Union.
The EU Kids Act has two main objectives: harmonizing the rules applicable to minors online and strengthening the safety obligations imposed on digital service providers. To achieve this, the proposal establishes age categories for minors to determine access to digital services and sets requirements for the design of those services to limit their addictive effects. The new rules must also be considered in the context of the existing EU regulatory framework, in particular the DSA, GDPR, and AI Act.
1. Access to digital services adapted to the minor’s age
1.1 Gradual access to social media and video-sharing platforms
Unlike the French proposal to regulate social media, the EU Kids Act does not provide for a general ban on social media for children under 15. Instead, it provides for different levels of access to digital services based on three age groups:
· under 13, children would not be allowed to create an account on social media. Limited access would remain possible for certain child-friendly video-sharing services through an account managed by a parent;
· from age 13 to under 15, access to these services could be provided through an account created and supervised by a parent or a person with parental responsibility. Parental controls would remain enabled and daily usage time would be limited;
· from age 15, minors could create their own accounts. The protective measures applicable to users under 18 would nevertheless continue to apply.
1.2 Verifying age without systematically identifying the user
Applying these thresholds requires service providers to determine whether a user has reached the required age. Entering a date of birth would no longer be sufficient for the services concerned. The proposal provides for the use of certified age-verification solutions independent of the platforms.
However, the Commission intends to limit the information disclosed to providers. Age verification would be based on confirmation that a person is above or below a given age threshold, without disclosing their identity or full date of birth. In the longer term, this solution would interact with the European Digital Identity Wallet.
Age verification thus becomes a central component of the system, both for enforcing age restrictions and for determining whether the protections intended for minors should apply. For digital service providers, this stricter age-verification requirement means revising not only the registration process but also the associated data processing procedures.
2. New obligations for platforms and digital service providers
2.1 The scope of the EU Kids Act extends beyond social media
The proposed regulation is not limited to social media. It also covers video-sharing platforms, online games, AI companions and chatbots, as well as app stores and operating systems.
The second part of the proposal addresses the design of these digital services. Providers will have to adapt how a service operates when it is accessible to minors, including where it can be used without creating an account.
The Commission adopts a safety-by-design approach. Accounts used by minors should include protective settings enabled by default from the outset, designed to protect minors, limit usage time, and adjust recommender systems.
The EU Kids Act provides for restrictions concerning the visibility of minors’ profiles, contact with unknown persons, geolocation, and user tracking. A social media service could therefore be required to make a minor’s account private by default, disable certain location features, and limit contact from users who have not been approved.
Techniques designed to keep minors using a service, such as infinite scrolling, certain reward mechanisms, repeated notifications, or features likely to disrupt sleep, would have to be adapted and limited.
For recommender systems, the proposal introduces safeguards intended to limit minors’ exposure to recommendations that could adversely affect their safety or well-being. The settings applied to children will have to provide a higher level of protection, which may require providers to distinguish between the systems used for minors and those offered to adults and to reconsider the data used to personalize content.
Online games will have to incorporate safety measures adapted to minors, covering excessive use, interactions with other players, spending, and parental control tools.
App stores will also have to contribute to the age rating of applications and block access to applications that are not appropriate for the user’s age.
Providers will have to take these requirements into account throughout the minor’s user experience. The protection of minors can no longer depend solely on settings that they would be responsible for enabling after signing up.
Compliance is therefore no longer limited to content proposed to minors. Interface design and features used to capture their attention also fall within the scope of compliance.
Parents will continue to have access to parental control tools that allow them to manage certain uses, such as screen time, contacts, and account settings. However, these features will not exempt the provider from designing a service that is appropriate for minors. A social media platform will not be able to compensate for insufficiently protective settings simply by directing parents to its parental control tools.
2.2 Specific rules for certain AI systems
The EU Kids Act introduces specific obligations for certain AI systems with which minors can interact directly, in particular AI companions and chatbots.
To prevent behaviors that could foster emotional dependency between a minor and an AI system, the proposal regulates the use of previous conversations as well as solicitations directed at children. A provider of an AI companion will have to assess not only the responses generated by the system, but also features that could encourage a child to engage in more interactions or to perceive their interaction with the agent as a personal relationship.
The providers will therefore have to integrate the protection of minors into the design, testing, and monitoring of the system.
3. How the EU Kids Act fits with the existing EU digital regulatory framework
The EU Kids Act will add to an already extensive EU regulatory framework. Once the regulation is adopted, digital service providers will have to incorporate the new requirements into their compliance programs alongside the regulations already applicable to their services, including the DSA, GDPR, and AI Act.
3.1 DSA: additional rules for the protection of minors
The DSA already requires online platforms accessible to minors to put in place “appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors, on their service.” (Article 28(1) of the DSA)
The EU Kids Act supplements these obligations with age thresholds and more detailed requirements concerning the design of certain services.
Platforms that have already implemented DSA compliance measures will be able to build on their work concerning minors, recommender systems, and default settings while incorporating the additional requirements introduced by the new regulation.
3.2 GDPR: age verification remains subject to data protection rules
The principles of data minimization, purpose limitation, data protection by design, and security are central to the EU Kids Act. These principles will have to guide the implementation of age-verification mechanisms and, more broadly, the design of services accessible to minors.
The age thresholds of 13 and 15 proposed by the EU Kids Act should also be distinguished from the age referred to in Article 8 of the GDPR regarding children’s consent. In France, that age has been set at 15. However, their respective purposes should not be confused: the thresholds established by the EU Kids Act determine the conditions for access to certain services, whereas the threshold under Article 8 GDPR concerns the validity of a minor’s consent as a legal basis for the processing of personal data.
3.3 AI Act: additional requirements for systems accessible to minors
Chatbots and AI companions generally fall within the category of limited-risk AI systems. As such, they are subject to a transparency obligation.
The EU Kids Act adds obligations relating to the use of these systems by minors.
Providers will therefore have to consider the classification of their system under the AI Act, its accessibility to children, and the specific protective measures required by the EU Kids Act.
The proposed EU Kids Act adds a new dimension to the protection of minors in the digital environment. However, the overlap between the future regulation and the DSA, GDPR, and AI Act, as well as the proposed age-verification mechanisms, is likely to remain a central issue during the legislative process.
* * * * * * * * * * *
(1) Proposal for a Regulation of the European Parliament and of the Council, EU KIDS ACT – “EU Keeping Internet Digital Spaces Accountable and Trustworthy,” COM(2026) 681 final. The proposal must still be examined by the European Parliament and the Council and may therefore be amended before adoption.
Bénédicte DELEPORTE
Avocat
Deleporte Wentz Avocat
October 2026