Bill on minors in digital environments: why it lapsed

The Organic Law bill for the protection of minors in digital environments reached Congress after the Council of Ministers approved it on 25 March 2025. The Chamber published it on 11 April and agreed to process it under the urgent procedure on 6 May. A year and a half later, Royal Decree 806/2026 dissolved the Congress of Deputies and the Senate with effect from its publication in the Official State Gazette (BOE) on 6 October 2026 and called elections for 29 November.

The legal consequence is not a pause. Article 207 of the Standing Orders of the Congress of Deputies establishes that, upon the dissolution of the Chamber or the expiration of its mandate, matters pending examination and resolution shall lapse, except for those constitutionally corresponding to the Permanent Deputation. Bill 121/000052 is not among those exceptions. Its processing has concluded without legislation.

Should the incoming Government wish to recover the text, it must approve a new initiative and submit it once more to the Cortes. It may utilise the previous work as a political or technical foundation, but the new legislature shall not automatically resume the procedure from where it concluded.

How far it got

The verifiable parliamentary sequence is as follows:

25 March 2025. The Council of Ministers approved the bill and sent it to Congress.
8 April 2025. The Bureau qualified it, referred it to the Justice Committee, and opened the period for amendments.
11 April 2025. The text was published in the Official Gazette of the Cortes Generales.
6 May 2025. The Bureau agreed to its urgent processing; the agreement was published on 9 May.
10 September 2025. The Plenary rejected the amendment to the entirety presented by Vox, so the bill continued to be processed.
12 December 2025. Congress published the amendments to the articles and their index.
6 October 2026. The dissolution of the Cortes caused the file to lapse before any law had been approved.

The relevant detail is not merely the duration. The urgent procedure reduces certain parliamentary deadlines, yet it provides no guarantee that a regulation will be approved. In this instance, the declaration of urgency coexisted with months of processing and a file that failed to reach approval by the Committee, the Plenary of the Congress, the Senate, and the sanction and publication required to become law.

I have not located a committee report (dictamen) from the Justice Committee nor any approval subsequent to the document of amendments. It is more precise to state this than to attribute to the bill a parliamentary phase not substantiated by an official publication.

What the bill proposed

The text was not a singular prohibition concerning social networks. It combined obligations for manufacturers, platforms, and audiovisual services with educational, health, civil, and criminal measures.

Parental controls incorporated into devices

Manufacturers of terminal equipment with internet connectivity were required to include a parental control function within the operating system. Its activation was to be offered by default during the initial configuration, and its inclusion, activation, configuration, and updating were to be provided free of charge.

The project also prohibited the use for commercial purposes of data from minors collected or generated during the activation of that function. It provided for obligations for manufacturers, operating system providers, importers, distributors, and retailers, as well as penalties for non-compliance.

Age and consent for data processing

The proposal intended to amend Article 7 of the Organic Law on Data Protection to raise from fourteen to sixteen years the age from which a minor may consent on their own to the processing of their personal data. For those under sixteen, processing based on consent would require that of the person exercising parental authority or guardianship.

That reform did not enter into force. The current rule remains that of Article 7 of Organic Law 3/2018: the minor's consent may serve as the basis for processing when they are over fourteen years of age, unless another law requires assistance for the act or transaction in the context of which it is collected.

The age for consenting to data processing is not equivalent to a general age of internet access, nor does it resolve in isolation the validity of all contractual conditions of a platform. Conflating these issues produces simple headlines, yet they remain legally imprecise.

Age verification and audiovisual services

The project reinforced obligations for age verification regarding audiovisual content that could impair the physical, mental, or moral development of minors, with particular attention to gratuitous violence and pornography. It required that such systems respect security, privacy, data minimisation, and purpose limitation.

It also extended obligations to certain users of special relevance on video-sharing services and reinforced the powers of the National Commission on Markets and Competition. This section highlights one of the problems of national regulation: protecting minors requires verifying certain age thresholds without transforming the verification into a system of general identification or tracking of navigation.

Education, health, and digital literacy

The project included measures for digital citizenship and media literacy, information for families and professionals, the prevention of cyberbullying, the promotion of secure devices in educational environments, and research into the effects of technology on cognitive development, health, and childhood.

These measures are not ancillary. A regulation focused solely on prohibiting access to certain services neglects critical capacity, visual education, guidance, and the organisation of centres. This dimension relates to Social media and visual education for adolescents and the analysis concerning social media and adolescent mental health.

Criminal reforms

The project proposed amendments to the Criminal Code linked to offences committed in digital environments. It included a new response to the unauthorised dissemination of bodily images or voices generated or manipulated technologically to simulate sexual or severely degrading situations, as well as modifications relating to the contact and grooming of minors through false identities.

These provisions required a separate reading from the administrative obligations for platforms and manufacturers. That both appeared within the same law did not render them a single policy nor did it make their guarantees interchangeable.

What it means legally that it has lapsed

Parliamentary expiry affects the project as a legislative initiative. It does not repeal existing regulations, it does not annul previous administrative acts, and it does not automatically render the conduct the project intended to regulate either illicit or lawful.

Furthermore, it does not prevent a future Government from presenting an identical text. The new initiative would once again undergo governmental approval, presentation, publication, amendments, debates and votes. The incoming Congress could replicate previously reached consensuses or entirely modify priorities, ages, competent authorities and control mechanisms.

Expiration must also be distinguished from three situations:

A regulation already approved and published. Dissolution does not cause it to disappear.
A preliminary draft or government bill that never reached Congress. It does not expire as a parliamentary matter, although the new Government must decide whether to recover it.
A European regulation or directive in the process of being processed within the Union. Its procedure does not depend on the dissolution of the Spanish Cortes.

What protection remains in force

The disappearance of the project does not leave an absolute void. A dispersed framework remains that protects different rights and attributes competencies to different authorities.

Data protection

The General Data Protection Regulation and Organic Law 3/2018 continue to regulate the processing of minors' data. Spanish law maintains the threshold at fourteen years for the minor's consent to serve as a legal basis, with the exceptions provided for by the regulation itself.

This does not authorise any processing. Consent must be free, specific, informed and unambiguous, and the controller must comply with the rest of the principles, transparency obligations and applicable guarantees.

Digital Services Act

The European Union's Digital Services Act already obliges platforms accessible to minors to adopt appropriate and proportionate measures to ensure a high level of privacy, security, and protection. In July 2025, the Commission published guidelines on its application.

The guidelines recommend, among other measures, default private accounts, changes to recommendation systems, greater control for the minor over their content, blocking and muting of users, limits on excessive usage functions, safeguards against unwanted contact, better reporting mechanisms and age verification methods that are effective, robust, non-intrusive and non-discriminatory.

The guidelines are not a new law nor do they, by themselves, guarantee compliance with the Regulation. They are non-binding recommendations that can serve as a reference to evaluate whether a platform satisfies the obligations already imposed by the Digital Services Act.

The European proposal changes the context

On 17 September 2026, the European Commission presented the proposal for a Regulation known as the EU KIDS Act. The text aims to create a common framework for certain high-risk AI services and systems, restrict minors' access to certain platforms, and prevent each State from constructing incompatible ages and obligations within the single market.

The proposal establishes a gradual approach: it prevents access by minors under thirteen to the affected social platforms and sets the age for autonomously creating an account on those services at fifteen. It also shifts the burden to providers to demonstrate that their services are age-appropriate and secure by design.

However, it remains a proposal. It should not be presented as current law nor confused with the guidelines of the Digital Services Act. Its content may change during negotiations between the European Parliament and the Council. I analysed this in more detail in the article on the EU KIDS Act.

What a Spanish law could still contribute

European progress reduces the scope for incompatible national rules on platforms, but it does not render a state initiative useless. Areas persist in which Spain can legislate or coordinate its own policies:

Digital and media education within the educational system.
Training for families, teachers, healthcare personnel and child care professionals.
The organisation of public prevention and assistance services.
Certain civil and criminal reforms.
Market surveillance of devices and the obligations of their manufacturers.
Coordination between competent national authorities.
Research and evaluation of the measures adopted.

The question is, therefore, not whether Spain or the European Union should regulate. It is which legal level can act effectively on each problem, how to avoid duplicating obligations and what guarantees accompany sensitive measures such as age verification.

The urgency that did not reduce the time

The case demonstrates a distance between the declared urgency and the real capacity to approve the regulation. The Government requested the urgent procedure in May 2025. The bill passed the debate on the entirety and reached the publication of amendments, but it did not complete its processing before the dissolution in October 2026.

This does not, by itself, demonstrate a lack of interest, nor does it allow for a single cause to be attributed to the delay. An extensive organic law, which modifies educational, healthcare, audiovisual, criminal and data protection regulations, requires agreements and a particularly careful legal review. It does, however, allow for a more limited assertion: the urgency label did not prevent the file from expiring eighteen months after its presentation.

The next proposal should explain which parts respond to problems that remain uncovered, which have been altered by the EU KIDS Act and how the ages of fourteen, fifteen and sixteen that appear in different legal frameworks fit together. It should also clearly separate protection, progressive autonomy and participation. Minors are not just people who must be kept away from certain content; they exercise rights of information, expression, education, creation and relationship in digital environments.

What to monitor in the next legislature

If the project reappears, there will be five decisive issues:

Whether it retains the raising of the age of consent for data processing to sixteen and how it coordinates this with the future European age for creating accounts.
What age verification method it proposes and what data it requires to be processed.
How it distributes responsibilities between manufacturers, operating systems, platforms, audiovisual services, educational centres and families.
Which measures have a budget, supervisory authority and periodic evaluation.
Which national provisions remain necessary after the Digital Services Act and the negotiation of the EU KIDS Act.

Promising the legislation again will be the straightforward part. The decisive factor will be publishing a text adapted to the European framework, explaining its safeguards, and providing it with a parliamentary timetable compatible with the urgency invoked.

About the open conversation

This text distinguishes between current regulations, pending proposals, and interpretation. It does not constitute legal advice. If you work in child protection, digital education, health, platforms, or technology law and wish to clarify a point or discuss this reading, this notebook remains open: write to me.

The author's relationship to the cases

There is no financial, professional or collection relationship with the individuals, companies and institutions mentioned.

The bill to protect minors in digital environments lapses: what is lost and what remains in force