On 17 September 2026, the European Commission proposed the EU KIDS Act (EU Keeping Internet Digital Spaces Accountable and Trustworthy). It is a Regulation that would set a single EU-wide framework for how online services treat users under 18. Its most visible element is the age rule. Children under 13 could not have social media accounts. At 13 and 14 they could have parent-supervised accounts, and from 15 independent accounts.

Most of the proposal, however, is about design. Social media, video-sharing platforms, online games, AI companions, chatbots, app stores and operating systems would have to be safe by design for minors. Very large platforms would have to prove this before children can access their services, instead of waiting for regulators to prove harm.

The text is still a proposal. It is now before the European Parliament and the Council and may change significantly. Its direction, though, is already clear, and the product and compliance changes it implies take time to plan.

Why a new act

The KIDS Act builds on rules that already protect minors online and makes them more specific and harmonised. Article 28 of the Digital Services Act requires online platforms accessible to minors to ensure a high level of privacy, safety and security. The Commission published guidelines on that provision in July 2025. The AI Act, the GDPR rules on children’s consent and the Audiovisual Media Services Directive add further layers.

The push for a dedicated instrument came from two directions. Several Member States were preparing their own minimum ages for social media, which risked fragmenting the internal market. In a resolution of 26 November 2025, the European Parliament called for a harmonised approach. The Commission also convened a Special Panel on Child Safety Online, whose report in July 2026 recommended a gradual, age-based approach.

The KIDS Act would not replace Article 28 of the DSA, which stays in force alongside the new rules. On 11 November 2026, the Commission also proposed the Digital Fairness Act. The DFA complements the KIDS Act with consumer-law rules on addictive design, profiling-based advertising to minors and paid loot boxes (see our analysis of the Digital Fairness Act: https://www.datavalleyconsulting.com/en/post/the-digital-fairness-act-what-the-commissions-proposal-means-for-businesses).

Who is covered

The proposal applies to services offered on the EU market, wherever the provider is established. It covers online social networking services, video-sharing platforms, app stores, online games, operating systems, AI companions and general conversational chatbots. AI companions are AI systems that provide sustained, personalised interaction and simulate social or emotional relationships with users.

A minor is anyone under 18. Some services are excluded as unlikely to pose significant risks. These include not-for-profit encyclopaedias, educational and scientific repositories, certain open-source development platforms and services run by educational establishments. The age rules apply only to social networking and video-sharing services with risky features. The safety-by-design rules apply more broadly, to all covered services used by minors.

Key obligations

Age rules for social media. The proposal sets a graduated system, harmonised so that Member States cannot impose higher minimum ages. Children under 13 could not have social media or video-sharing accounts. The only exception would be child-friendly video services accessed through a guardian’s account, with no personalisation, a limit of one hour per day and parental controls. At 13 and 14, guardians could set up “mini accounts” linked to their own. These would give access to age-appropriate services with limited contacts, one hour of use per day and parental controls. From 15, minors could open autonomous accounts, but only on services that meet the safety-by-design rules. Existing accounts would not be exempt. Providers would have to check whether account holders are under 15, using reasonable proxies such as account creation date or credit card details.

Safety by design. All covered services used by minors would have to meet design requirements. Addictive features would be banned, including infinite scroll without stopping points, autoplay, streaks, reward mechanics and push notifications during sleeping hours. Profiling-based recommendations would be off by default, and minors could control, tune and reset recommender systems. Profiles would be private by default, with geolocation, camera and microphone turned off. Strangers could not contact minors without parental approval, and minors would have easy tools to block and mute other users. Services would also have to offer time-management tools and protection against spending traps.

Age assurance. Social media and video-sharing providers would have to verify age at account creation through certified solutions independent of the platform. Self-declaration would no longer be enough. Verification must preserve privacy: a third party confirms only whether the user is above or below an age threshold. The EU Digital Identity Wallet is the long-term tool, with an EU age verification app as an interim solution. Each Member State must offer at least one free method. App stores, operating systems and online games may use alternative methods, provided they are accurate and non-intrusive.

AI companions, chatbots and games. AI companions and chatbots would be off by default for minors and must not be designed to create emotional dependency. They would need risk testing before they reach the market and monitoring afterwards, and would be enforced under the AI Act. Online games would be subject to the safety-by-design rules. The Commission would facilitate EU codes of conduct on age rating.

Enforcement and timeline

The most significant change is the reversal of the burden of proof. Very large online platforms would have to submit a compliance plan to the Commission and undergo independent audits at their own expense. They would have to show that their services are safe before making them available to children. Where an audit reveals shortcomings, the Commission could require corrective measures.

Supervision builds on the DSA and AI Act structures. The Commission would supervise the largest services, and the AI Office would oversee chatbots and AI companions. National regulators would supervise other online games. Fines could reach 6% of worldwide annual turnover, and in the most serious cases services could be temporarily restricted in the EU. An expedited procedure would require the Commission to conclude investigations within 90 days. A supervisory fee, capped at 0.03% of worldwide annual net income, would fund oversight. The Commission also proposes to extend the Representative Actions Directive to the KIDS Act, opening the door to collective consumer actions.

Once adopted, most obligations would apply six months after entry into force, with further steps phased in. Safety-by-design and age verification obligations would apply from the date of application. Existing accounts would have to be checked six months later. Parental account features, the full chatbot rules and the expedited enforcement procedure would follow twelve months after application.

The legislative process has started. Under the Irish Presidency, the Council working party had completed a first examination of Chapters I to VI by 11 November 2026, and ministers are due to hold a policy debate on 20 November 2026. The opinions of the European Economic and Social Committee and the Committee of the Regions are expected in the first quarter of 2027. Political momentum is strong, but the minimum age of 15 is already contested.

Practical steps

The final text will change, but providers that wait for adoption risk having too little time to redesign their services. A sensible first step is to map which services fall within the seven categories, and whether minors actually use them, whatever the terms of service say. Current compliance with Article 28 of the DSA and the Commission’s 2025 guidelines should then be reviewed, since these remain the baseline in the meantime.

Providers should then audit their design features against the safety-by-design requirements: feeds, autoplay, notifications, streaks, default settings, contact rules and in-app spending. They should plan the move from self-declared age to certified, privacy-preserving verification, including for existing accounts. Providers of AI companions and chatbots should prepare default-off settings for minors, together with risk testing and monitoring in line with the AI Act. All of this should be aligned with the GDPR and with the Digital Fairness Act. Finally, it is worth following the negotiations, in particular on the minimum age, the scope of covered services and the obligations of app stores and operating systems.

Key takeaways

The KIDS Act is a proposed Regulation: once adopted, it would apply directly and uniformly in all Member States. The age rules are graduated: no social media accounts under 13, supervised mini accounts at 13 and 14, and autonomous accounts from 15. Safety by design is the core of the proposal and covers all services used by minors, not only social media. Self-declared age would no longer be accepted for social media and video-sharing services. Very large platforms would have to prove their services are safe before children can use them. Fines could reach 6% of worldwide turnover, and an expedited procedure would apply.

‍