The European Commission has proposed the EU KIDS Act, a Regulation that would establish EU-wide age rules and safety-by-design obligations for online platforms and related services used by children and teenagers. Published on September 17, 2026, the proposal would affect how social platforms, apps, online games, app stores and AI companions verify age, configure feeds and interactions, and handle data relating to minors.
The central shift is clear: platforms would need to demonstrate that services are age-appropriate and safe by design, rather than placing most responsibility on children, parents or regulators after harm occurs. The Commission's official EU KIDS Act announcement presents the proposal as part of a broader effort to harmonize child-safety rules across the EU and avoid differing national requirements.
For companies building services that may attract minors, the proposal is not simply an age-gate issue. It would place product design, moderation, data practices and parental controls closer to the center of compliance planning. The Act remains a proposal, and the Commission's public consultation is open until December 3, 2026.
What the EU KIDS Act would change
The proposal sets out age-based rules for social media accounts. Children under 13 would be prohibited from holding accounts. Users aged 13 and 14 could use guardian-assisted accounts, subject to strict controls. From age 15, users could have autonomous accounts only on services considered safe by design.
| Age group | Proposed social media account rule | Key condition |
|---|---|---|
| Under 13 | Accounts prohibited | No social media account access |
| 13 to 14 | Guardian-assisted accounts | Daily time limit and parental approval of contacts |
| 15 and over | Autonomous accounts permitted | Service must be safe by design |
The Act would also reverse the practical burden of proof for platforms. Instead of relying chiefly on users or authorities to identify unsafe experiences, providers would have to show that their service is appropriate for minors. Very Large Online Platforms, defined in the proposal as platforms with 45 million or more monthly users, would face independent audits.
Age assurance is a core implementation issue. The Commission proposes certified age checks that use privacy-preserving approaches, including zero-knowledge techniques. The package also envisages a free EU age-verification option and eventual use of the European Digital Identity Wallet. These mechanisms matter because platforms would need to establish age and, where relevant, guardianship without unnecessarily collecting or retaining sensitive personal information.
Safety-by-design becomes a product requirement
The EU KIDS Act proposal reaches beyond account creation. It would require platforms, apps and AI companions to build safer defaults into feeds, interactions and feature design. The proposal specifically targets addictive design patterns, including endless autoplay, intrusive notifications, streaks and rewards tied to engagement.
For teams responsible for digital products, the most consequential changes would likely include:
- Feed and notification redesign to avoid prohibited engagement mechanisms.
- Safer default settings rather than expecting younger users to locate and enable protections.
- Limited profiling of minors and clearer user controls over relevant settings.
- Contact and interaction safeguards, including parental approval of contacts for guardian-assisted accounts.
- Age-rating and verification integration in online games and app stores.
- Pre-launch risk testing for AI companions, alongside restrictions on default activation and coercive interactions involving minors.
The proposal's treatment of AI chatbots and AI companions is particularly notable. It recognizes that conversational systems can create risks distinct from traditional social feeds. Services used by minors would need safeguards designed to prevent coercive interactions, and providers would need to test risks before launch. The proposal would integrate with existing EU frameworks, including the Digital Services Act and the AI Act, rather than operate as an isolated child-safety regime.
What compliance could mean for smaller platform teams
The research does not provide cost estimates, so businesses should be wary of treating any single budget figure as definitive. However, the proposal points to several likely cost and operational drivers: integrating certified age checks, adapting account flows, revising recommendation and notification systems, building parental controls, updating data practices, and testing products for risks to minors.
Those changes may be especially material for a smaller company that has relied on standard analytics, third-party identity tools or engagement-focused product patterns. A business operating an app, game, community or AI experience should first determine whether minors can access it in the EU, whether the service is designed to attract them, and which product features create contact, profiling or engagement risks.
A practical early review can focus on four questions:
- Who can access the service? Map current age rules, onboarding flows and the ability to distinguish a guardian-assisted account from an autonomous one.
- Which features shape behaviour? Review autoplay, notifications, streaks, rewards, recommendations, direct messaging and contact discovery.
- What data is used for younger audiences? Identify profiling, analytics and data flows connected to minors, then assess whether they can be limited or redesigned.
- How would safeguards be tested? Document risk testing for AI companions and other features that can influence or contact younger users.
The proposal's use of the DSA enforcement framework adds weight to these preparations. The Commission would directly supervise the largest platforms, and non-compliance could lead to fines of up to 6% of worldwide turnover. Smaller services may not face the same direct supervision model, but the proposed safety-by-design duties would still make early product assessment valuable.
For businesses considering AI features, age assurance and safe interaction design should not be treated as a late legal review. They influence the choice of tools, the information an AI system can access, default user settings and the testing required before a feature reaches younger users.
If your product uses AI, automation or personalised experiences, Scalevise can help translate emerging requirements into practical product and workflow decisions. Our AI implementation consultancy for safer digital services can identify high-risk user journeys, assess feasible safeguards and prioritize changes before they become expensive rework. Request an AI implementation consultation.
Frequently Asked Questions
What is the EU KIDS Act?
The EU KIDS Act is a European Commission proposal for a Regulation intended to strengthen online safety for minors through EU-wide age rules, age verification and safety-by-design obligations for platforms and related services.
Would the EU KIDS Act ban social media for children under 13?
The proposal would prohibit social media accounts for children under 13. It would allow guardian-assisted accounts for users aged 13 and 14, while autonomous accounts from age 15 would be limited to services considered safe by design.
What product features would the proposal restrict?
The proposal would prohibit addictive designs such as endless autoplay, intrusive notifications, streaks and rewards for engagement. It would also require safer defaults, limited profiling and explicit user controls.
How would the proposal affect AI companions used by minors?
AI chatbots and AI companions used by minors would face restrictions on default activation, safeguards against coercive interactions and pre-launch risk testing under the proposal.
When could the EU KIDS Act take effect?
The European Commission has published a formal proposal, not a final Regulation. Public consultation on the proposal is open until December 3, 2026, and the supplied material does not provide a final adoption or application date.
Conclusion
The EU KIDS Act proposal would make child safety a more direct product-design obligation for online services operating in the EU. Its proposed age rules, privacy-preserving verification and restrictions on engagement features signal that platforms should begin examining how minors access and experience their products while the legislative process continues.
Top comments (0)