The European Commission published its proposal for the EU KIDS Act on 17 September 2026. This proposal specifies and expands on existing child safety principles and guidelines under the Digital Services Act (DSA). It is intended to harmonise online child safety rules on access, safety-by-design and age assurance. The headline provisions would restrict access to social media and video platforms for children under 15. The proposal contains prescriptive safety-by-design requirements which will apply, not only to social media and video platforms, but also to providers of online games, AI companions, chatbots and app stores. The proposal is open for public consultation until 3 December 2026.
Key takeaways
- Evolution on DSA principles: Builds on digital child safety rules and guidance under the DSA
- Expanded scope: Will apply to online games, AI companions, chatbots, app stores and operating systems accessible to children, in addition to social media and video platforms (which are already regulated under the DSA)
- Age-based access restrictions: Children under 15 will not be able to access or create a social media or video platform account where the service poses a risk to their privacy, safety or security subject to limited derogations
- Safety-by-design: Prescriptive safeguards will include restrictions on addictive design features, default safety settings and limiting behaviour-based recommendations. Guardians must also be provided with specific controls.
- Age verification: Age verification for social media and video platform account access and creation must be based on EU-approved age verification methods
Beyond social media and video platforms
The EU KIDS Act proposal will apply to social media and video platforms (similar to the DSA) but also to the following services, where those services are accessible to children under the age of 18:
- App stores
- Online games
- AI companions
- Chatbots
- Operating systems
The proposal will not apply to not-for-profit online encyclopaedias, certain not-for-profit educational and scientific services, open-source code development and sharing platforms (like GitHub), services solely for scientific research and development purposes, and systems operated for or on behalf of public authorities. It also excludes certain narrowly designed chatbots whose functionality is limited to a specialised service/task or a pre-defined set of functions (e.g. customer service or technical support chatbots).
Evolution in child safety obligations
Since 17 February 2024 (and earlier for Very Large Online Platforms or VLOPs), the DSA requires providers of online platforms that are accessible to children to implement appropriate and proportionate measures to protect their privacy, safety and security. The types of measures that providers are expected to implement were detailed in non-binding guidelines from the Commission published in 2025. The EU KIDS Act proposal can be seen as a mechanism for codifying these soft law requirements and it will expand both the scope and depth of binding digital child safety rules.
Video platforms must also currently comply with Ireland’s Online Safety Code in relation to restrictions on harmful and illegal content and obligations relating to age assurance, parental controls and user reporting tools. In September 2026, Coimisiún na Meán opened its first formal investigation under the Online Safety Code, into X’s age assurance measures and parental controls, stating that age assurance based solely on self-declaration is not considered effective. Once finalised, the prescriptive requirements of the EU KIDS Act may prompt updates to the Online Safety Code.
Age-based access restrictions
Under the proposal, age-based access restrictions apply to social media and video platforms only.
| Default rule Children under 15 – no access or account creation | Children under 15 will not be able to access or create an account on social media or video platforms where the service poses a risk to their privacy, safety or security. The proposal lists a number of circumstances or features that would pose such a risk, including the use of recommender systems based on profiling (as defined in the GDPR). |
| Exception Children between 13 and 15 – Limited access via guardian-controlled account | As an exception to the default rule, providers may allow guardians to set up social media and video platform accounts for children between 13 and 15 subject to limitations on those accounts. |
| Exception Children under 13 – Limited access to video platforms designed for under 13s via guardian’s account | For video platforms specially designed for children under 13, providers may enable a guardian to allow a child under 13 access through the guardian’s account subject to certain conditions and limitations. |
Within six months of the restrictions applying, providers of social media and video platforms must assess existing accounts and disable accounts of children under 15 or accounts where the account holder’s age cannot be established. To establish an account holder’s age, the provider will be required to use EU-approved age verification methods unless they can establish, with a high degree of confidence, that the user is 15.
Separately, app stores must assess their users’ age and put in place an age-rating system to ensure that children are accessing apps that are appropriate for their age. Unless a provider can establish, with a high degree of confidence, that the user is over 18, they must assess their age using an age assurance method such as biometric age estimation. App store providers are not mandated to use EU-approved age verification methods, but they can offer these methods if they wish.
Prescriptive safety-by-design rules
The proposal would:
- Restrict addictive design features and require time-limited access and breaks to protect school and sleep time
- Give children greater control over recommender systems (e.g. ability to easily reset), protect against repeated harmful recommendations (“rabbit holes”), prohibit the use of children’s data from outside the platform and restrict use of behavioural data when making recommendations
- Mandate default safety settings (e.g. geolocation, microphone, camera access turned off by default)
- Oblige certain providers to implement safeguards relating to contact and interaction by children with others
- Require providers to make children aware of purchases in real time
Certain additional requirements would apply to VLOPs designated under the DSA.
Age assurance
Age assurance generally means a method for determining, estimating or verifying age. Age verification is a more specific concept which means establishing with a high degree of certainty whether a person has attained a particular age using identification documents and reliable verified sources. See our article on the EDPB’s age assurance statement.
Under the proposal, age verification is mandatory for higher risk areas such as determining if the user is 15 for access and account creation on social media and video platforms. Providers can use age assurance methods (e.g. biometric age estimation tools) to meet certain safety-by-design obligations, to distinguish adults from children for child-protective settings and for the purposes of applying app store age ratings.
Tools for empowering children and guardians
Under the proposal, providers must create tools that allow children to report content and control their settings. Controls must also be provided to guardians so that they can set time limits on access, manage settings and submit reports on behalf of their child. Interestingly, VLOPs designated under the DSA must ensure that their tools are interoperable with controls offered by third parties in accordance with the interoperability requirements under the Digital Markets Act (DMA).
Enforcement
The proposal does not create a new enforcement and supervision framework but instead refers to the existing frameworks under the DSA (for social networks, video platforms, online games and app stores) and the AI Act (for AI companions and chatbots).
It does, however, specifically state that fines for AI companions and chatbots must not exceed 6% of total annual worldwide turnover. (For reference, the AI Act has two tiers of fines: 3% for non-compliance with most rules and 7% for non-compliance with prohibited AI systems rules.)
Due to the heightened risk that children face online, the proposal also envisages a fast-track enforcement mechanism which would require the Commission to adopt preliminary findings within 30 working days and a final decision within 90 working days.
Next steps
The European Commission opened a consultation seeking feedback on the proposed regulation which will close on 3 December 2026. The feedback will be incorporated into amendments tabled and debated by the European Parliament and Council as part of the ordinary legislative procedure. If the proposal is adopted, the legislation is unlikely to become applicable before 2028.
A recent report from the Joint Committee on Children and Equality welcomed the EU KIDS Act proposal. The Committee recommended that, at a minimum, children under 13 should not hold traditional social media accounts. However, evidence shows that a blanket social media ban for children under 16 would, on its own, be unlikely to provide a comprehensive solution to the harms experienced by children online. Access for younger teenagers should be limited, age appropriate and subject to parental supervision. Autonomous accounts should only be permitted on services shown to be safe by design.
While it is too early to say what the final text of the EU KIDS Act will look like, it is clear that the direction of travel is towards mandated age verification for online services that are accessible to children and prescriptive safety controls. These requirements are likely to require significant product changes so organisations should consider what lead time is required for building, testing and implementing these changes.
The authors would like to thank Vivienne O’Keeffe for her contribution to this briefing.
