EU KIDS Act: social media and minors under 15

On 17 September 2026, the European Commission presented a proposal for a regulation entitled EU KIDS Act. It is not yet a law in force. It is being processed through the ordinary legislative procedure, under number 2026/0286(COD), and must be negotiated and approved by the European Parliament and the Council. The text may change during this process.

The proposal combines two distinct decisions. The first delays autonomous access to certain social networks and video platforms. The second requires digital services used by minors to demonstrate that they are age-appropriate and safe by design. Age is significant, yet it does not replace obligations regarding product functionality.

Three age brackets, not a single prohibition

The Commission proposes a gradual access model:

Under 13 years old. Accounts on social media services would not be permitted. Minors between 3 and 12 years old could access video services specifically designed for children through accounts created and supervised by their parents or guardians.
At 13 and 14 years old. Parents or guardians could create limited accounts for the minor, accessible from the adult account. Supervision tools would have to remain activated, allow for prior approval and limitation of contacts, and offer a configurable daily limit that could not exceed one hour.
From 15 years old. The minor could open an independent account on the social media and video platforms covered by the regulation.

The proposal does not necessarily prevent the consultation of public content without an account. It primarily regulates the creation and maintenance of accounts and access to specific functions. Furthermore, it does not encompass every digital service in the same manner: it defines different obligations depending on whether they are social networks, video platforms, app stores, online video games, chatbots, or artificial intelligence companions.

What would have to change for existing accounts

Providers could not simply check the age of new sign-ups. Six months after the regulation begins to apply, they would have to determine whether existing accounts belong to persons under 15 years of age. When they establish that an account belongs to someone below that age, or cannot establish the age, they would have to deactivate it or adapt it to the permitted regime.

Large platforms would be required to present a detailed implementation plan to the competent authority. The proposal also provides for parental accounts and other complementary measures to be available twelve months after the commencement of application.

These timeframes cannot yet be translated into calendar dates. The text has neither been approved nor published in the Official Journal of the European Union. The proposal stipulates that the future regulation would enter into force twenty days after its publication and would apply, with exceptions, six months later.

Verifying age without over-identification

The age limit necessitates resolving a difficult issue: how to verify that an individual has reached a certain age without requiring them to provide every platform with a copy of their identity document or creating a general browsing register.

The Commission proposes using European age verification solutions and accreditations that communicate the necessary attribute, rather than more data than is essential. For other design obligations, alternative estimation or verification systems could be permitted, provided they offer sufficient precision, reliability, security, privacy, data protection, and absence of discrimination.

The distinction is significant. Verifying age should allow for confirmation that a threshold has been met. Identifying an individual entails knowing who they are. A privacy-respecting solution must avoid conflating both operations, limit the subsequent use of data, and offer avenues for redress when someone is misclassified.

Safe design: what age does not resolve

The broader core of the proposal is not age, but design. Obligations would apply, with varying intensity, to social media, video platforms, online video games, app stores, chatbots, and AI companions used by minors under 18 years of age.

Among the practices the Commission intends to restrict are:

Infinite scrolling without stopping points.
Notifications during sleep hours.
Reward systems that encourage compulsive use.
Profile-based recommendations that lead to sequences of harmful content.
Unsolicited contact from strangers.
Spending traps and certain in-service purchases.
Camera, microphone, location, or visibility settings that are not private or protective by default.

The proposal thus reverses the usual logic. It would not be the responsibility of the minor to demonstrate that a feature has caused them harm for the platform to react. The provider would have to prove in advance that the service is age-appropriate and safe by design.

This approach continues the work initiated with the 2025 guidelines on the protection of minors in the Digital Services Act. The guidelines already addressed recommendation systems, addictive design, privacy, contact with strangers, and age verification. The EU KIDS Act would convert part of that approach into specific obligations and extend its scope to services that do not fit entirely within the same regime.

Who would oversee compliance

The proposal reuses existing structures. The European Commission would supervise very large online platforms and certain systems integrated within them. National digital services coordinators would control smaller services. Obligations applicable to chatbots and AI companions would rely on the supervision system of the Artificial Intelligence Act. Data protection authorities would remain competent when age verification involves the processing of personal data.

The sanctioning regime is also connected to existing rules. In the case of chatbots and AI companions, the proposal refers to fines of up to 6% of the total annual worldwide turnover where there is an intentional or negligent infringement. For other categories, the sanctioning structures of the Digital Services Act or the applicable national rules would apply.

Effectiveness will therefore depend not only on the final text, but on coordination between authorities, their technical resources, and the real possibility of auditing recommendation systems, age verification, and interface design.

Why the Commission is proposing a European rule

Since 10 December 2025, Australia has required certain platforms to adopt reasonable measures to prevent persons under 16 from creating or maintaining accounts. Public content that does not require a login may remain available. The Australian experience shows two foreseeable limits: verification systems can be bypassed, and removing accounts does not, by itself, eliminate access to content or design incentives.

In Europe, several States had begun to study their own rules. The Commission justifies the common intervention by the need to avoid incompatible ages, obligations, and verification systems within the single market. The European Parliament had requested in November 2025 a harmonised limit of 16 years, unless parental authorisation is provided, and an absolute floor of 13. The Commission's proposal chooses a different balance: an independent account at 15 and limited accounts with supervision at 13 and 14.

What remains open

The legislative procedure will have to resolve issues that the initial text does not address on its own.

The reliability of verification

A system may erroneously exclude someone who meets the age requirement or allow someone who does not reach it to pass. The regulation will require accessible correction and complaint procedures, in addition to audits regarding discrimination, accuracy, and data usage.

Access without an account and displacement

Restricting accounts may displace activity towards services not included, messaging applications, shared adult accounts, or public browsing. Such displacement does not invalidate the measure, but it necessitates evaluating its real effects rather than merely the number of accounts deleted.

The burden on families

Limited accounts return decision-making capacity to parents, yet they also assign them configuration, supervision, and response tasks. Not all families possess the same time, digital literacy, or capacity for guidance. Protection cannot rest primarily upon them.

The rights of minors

Safety must coexist with privacy, freedom of expression, access to information, and progressive autonomy. The text itself provides for the Commission to evaluate its impact on freedom of expression and information. The issue is not choosing between protection and rights, but justifying that each restriction is necessary, proportionate, and reviewable.

Evidence regarding mental health

The proposal cites risks to sleep, well-being, learning, and exposure to harmful content or contacts. This does not authorise presenting any relationship between social media and mental health as a uniform causality. The effects depend on the type of use, the content, the design, personal circumstances, and other social and family factors. I wrote about this distinction between association, risk, and causality in Social media and mental health in adolescents. Regarding visual literacy, self-image, and learning to look, I wrote in Social media and visual education in adolescents.

A proposal broader than a minimum age

Reducing the EU KIDS Act to "banning social media before 15" obscures the most relevant part. The Commission proposes delaying independent access, but also limiting contacts, time, and certain functions in supervised accounts; requiring privacy-respecting age guarantees; prohibiting specific design practices; and distributing supervision between the frameworks for digital services, artificial intelligence, and data protection.

In my view, this approach is more robust than an isolated prohibition. A minimum age may modify when an account is opened. Design obligations determine what the minor encounters upon entry. The outcome will depend on the final drafting, its technical application, and ensuring that the primary responsibility remains with those who design and operate the services, rather than on the unequal capacity of each family to defend themselves against them.

About the open conversation

This text distinguishes the content of a legislative proposal from my assessment and does not constitute legal advice. If you work in child protection, education, digital rights, or platform regulation and wish to clarify a detail or discuss this reading, you may write to me.

The author's relationship with the cases

I declare, in a personal capacity, that I have no financial or professional relationship with the individuals, companies, and institutions cited.

EU KIDS Act: what the EU proposes on social media and minors under 15