The EU KIDS Act proposal: safety for children by design

At a glance

• On 17 September, the European Commission unveiled a proposal for a new EU KIDS Act, designed to protect minors from certain “risky digital services and AI systems”, large and small, accessible in the EU.
• This includes age restrictions for accessing social media and Video-Sharing Platforms (VSPs) as well as other measures to ensure that broader services used by children are safe-by-design. Taken together, this represents a step change in the EU’s approach to ensuring minors are protected online.
• Affected services should prepare for proposed gradual access requirements and safety-by-design measures, supported by stronger age assurance and parental verification requirements.
• Very Large Online Platforms (VLOPs) designated under the Digital Services Act (DSA) should also plan for additional governance and assurance requirements, including an independently audited compliance plan and integration of KIDS Act compliance into annual risk assessments and audits.
• Given the scale of the proposed changes and the potential for significant penalties for non-compliance, preparation should start now.

1. The political and regulatory background

Over the past year, the European debate on protecting children online has shifted from how services respond to harmful content towards whether aspects of their design may themselves be harming children. This concern is reflected internationally. Australia’s under-16 social media ban, applicable since December 2025, has become a reference point for European policymakers. The UK initially pointed to Australia as a model for its proposed under-16 ban, but recent comments suggest a shift, whereby services may be able to avoid the ban if they can demonstrate they have made their platforms safe. This echoes Canada’s proposal, under which an under-16 social media account restriction would be introduced, with an exemption route for services that demonstrate “sufficient safeguards” for children.

In this context, calls for protections beyond DSA duties have grown within the EU. Many Member States have advanced national initiatives, increasing pressure for a harmonised EU framework. Ireland has made stronger online protections for children and an EU-level decision on a digital age of majority a priority of its Council Presidency. It recently hosted an EU Presidency Online Safety Conference bringing together policymakers, industry and representative organisations.

Against this backdrop, the European Commission presented the EU KIDS Act (Keeping Internet Digital Spaces Accountable and Trustworthy Act) proposal on 17 September. This complex package would supplement the DSA by introducing more prescriptive requirements for services accessible to children. Its central premise is that in-scope services should have to demonstrate they are safe for children before they can be accessed by them. The proposal would have major implications for product design and underlying business models, affecting both the age at which children can access certain services and how services are designed when used by children.

The proposal may change during negotiation as it moves through the EU legislative process. Views already differ on key issues. For example, Member States have taken different approaches to minimum ages, with France advancing an under-15 social media ban and Spain proposing one for under-16s, while some, most notably Estonia, have spoken out against restrictions. Nonetheless, the Commission has indicated that reaching agreement will be a priority.

With most rules set to apply six months after entry into force, services may face new requirements from 2028 if negotiations progress quickly. Despite uncertainty over the final text and timeline, affected services should begin assessing the proposal’s impact on design decisions now, rather than incur the additional cost and disruption of redesigning to a deadline when the rules are finalised.

This article explores what the proposal means for affected services across four areas: delayed access, safety-by-design, age assurance, and oversight and supervision.

2. Delayed access to risky social media and VSPs

A key focus of debate has been what services are appropriate for children of different ages, with national proposals for minimum age thresholds ranging from 13 to 16. The KIDS Act proposal moves away from a single age gate or blanket ban, instead opting for gradual access and increasing autonomy as children get older.

The headline measure is a harmonised minimum age of 15 for creating an autonomous account on online social networking services and VSPs with specified risk features.¹ The proposal would also allow different forms of access below that age, as shown in Figure 1.

Figure 1: Overview of delayed access requirements by age²

Services should first determine whether the delayed-access rules apply to them. In some cases, difficult boundary questions may arise. For example, the exemption for purely educational services operated within educational establishments or organisations may prove challenging to apply to services offering a broad range of functions. When assessing whether the requirements apply, providers should consider the service’s design, operation and features, rather than relying on how it is marketed.

This assessment would inform decisions on account types, features, default settings and user journeys for different age groups. These choices will depend on services’ ability to verify users’ age and, where guardian-controlled access is available, verify parental responsibility, as discussed in Section 4.

In some cases, these decisions will require a strategic choice. For example, VSPs seeking to serve children under-13s would need to establish guardian-controlled access, verify parental responsibility and provide an age-appropriate service that meets detailed conditions, outlined in Figure 1. Services will therefore need to decide whether to exclude this age group or invest in a separate child-specific service or experience. Small and micro enterprises, which are not excluded from the scope, face a similar decision. Developing and maintaining separate experiences and associated controls could require substantial investment, the feasibility of which will vary by service. These decisions will affect product strategy and development priorities and may depend on the commercial case for serving younger users.

Finally, because delayed access rules depend on the presence of specified risk features, some services may choose to examine whether those features could be removed or redesigned. Given these features are central to traditional social media and VSPs, such changes create a substantial engineering challenge, along with other design changes stemming from wider safety-by-design obligations, discussed below.

3. Safety-by-design becomes front and centre

Beyond delayed access proposals, the KIDS Act would introduce prescriptive safety-by-design requirements for social media, VSPs, online games, app stores, AI companions and general conversational chatbots.

Whilst services may recognise elements from non-binding DSA guidelines and age-appropriate design initiatives, the proposal would establish binding dos and don’ts, with implications across content, interactions and privacy. In-scope services would need to provide a child-safe experience by default, including when a user is not signed in, unless the user is confirmed to be an adult through compliant age assurance. Figure 2 summarises the main requirements.

Figure 2: Overview of safety-by-design requirements

Safety-by-design requirements would have significant implications for product design, recommender systems and underlying business models. For child users, features such as autoplay, infinite scrolling, notifications, contact suggestions, livestreaming, virtual currencies and AI memory may need to be switched off, limited or redesigned. Assessing which products and features may be affected by the rules is an essential first step before services can plan product changes and investment.

Responding effectively will require a coordinated cross-company effort across product, engineering, safety, legal, data protection, policy and compliance, and may require a broader cultural shift. Services should translate the requirements into practical design principles that product teams can apply in practice. Governance should also play a role, for example through child safety checkpoints throughout the product lifecycle, from ideation and design through to testing and post-launch.

Once relevant measures are in place, minors’ safety should be reviewed on an ongoing basis. Whilst pre-launch testing should check that safeguards are compliant, post-launch monitoring should identify how they fare in practice, considering workarounds, unintended effects and changes in user behaviour. Teams should keep clear records of design decisions, testing and outcomes, and findings should feed back into product design and remediation.

The proposals also create tension with conventional measures of product performance, meaning services may need to reconsider how success is measured for products used by children. Traditional metrics such as engagement and session length may conflict with requirements intended to introduce friction, encourage breaks or increase minors’ control. Product teams should therefore assess whether existing metrics incentivise potentially non-compliant design choices.

Of course, some requirements remain unclear and may evolve during negotiations. For example, restrictions on interpersonal relationships and persistent memory on AI companions and chatbots could affect important aspects of service functionality. Services should monitor negotiations to inform preparatory work. Beyond the KIDS Act, the forthcoming Digital Fairness Act is expected to introduce design requirements beyond child users, reinforcing the case for companies to prepare for a broader review of product design.

4. Privacy-preserving age assurance and parental responsibility

The proposed rules depend on reliably establishing users’ age. As existing approaches may not meet the proposal’s detailed expectations, services should assess their age assurance processes as a priority.

For delayed access, services would have to use certified EU third-party age verification solutions and proof-of-age attestations, including qualifying European Digital Identity Wallet attestations. Integration with the emerging digital ID ecosystem should be considered in product roadmaps.

Services in scope of delayed access rules would need to age-verify existing accounts and disable those where the user is under 15 or their age cannot be established, unless there is high confidence that the threshold is met (e.g. based on account creation date). This could involve significant work to review users, manage complaints and address inaccurate determinations.

International services will need flexible architecture to apply different thresholds, methods and feature restrictions. For example, where the EU prescribes the use of certified tools, the UK may rely on ‘highly effective age assurance’ methods. Services should consider adopting a modular approach that minimises data collection, monitors errors and maintains oversight of third-party suppliers.

Verifying parental responsibility is distinct from age assurance and may be more complex. The proposal specifies that services may use official Member State databases, provider-held relationship information and, temporarily, adult self-declaration. It will also be important to consider what evidence may be proportionate, how to accommodate different care arrangements and resolve disputed or fraudulent claims. Reflecting these challenges, the proposal requires services to make “reasonable efforts” to verify parental responsibility.

5. Oversight and supervision

The KIDS Act would build on existing supervisory and enforcement architectures, meaning services could face enforcement action under the DSA or AI Act, depending on the service type. The Commission would supervise the relevant obligations for VLOPs under the DSA, and AI systems for which it is responsible under the AI Act, while designated national authorities would supervise other providers. Commission supervision would be financed through an annual supervisory fee based on the DSA framework.

Where the Commission is responsible for supervision, the proposals envisage an ‘expedited enforcement regime’ under which the Commission would reach preliminary findings within 30 working days of opening proceedings and a final decision within 90 working days. This proposed process may leave Commission-supervised services with limited time to respond, making early and ongoing regulatory engagement throughout product design and development crucial. Providers should establish a clear approach to evidencing compliance throughout the product lifecycle, keeping design decisions, testing results, monitoring evidence and remediation records readily available.

Certain VLOPs³ would also face demanding compliance planning requirements. They would need to submit a detailed compliance plan within 30 days of the KIDS Act becoming applicable, commission an independent audit⁴ of that plan and publish a non-confidential summary. This timeline makes early planning essential. VLOPs should define ownership, map the evidence required and identify the specialists needed before the final rules apply.

Finally, KIDS Act compliance would need to be integrated into VLOPs’ annual DSA risk assessments and audits, incorporating evidence on product design, age assurance and child safety outcomes. This will require clear ownership and information sharing across legal, safety, product, engineering, data protection and compliance teams. Companies subject to both the KIDS Act and AI Act should also coordinate overlapping governance and supervisory requirements.

6. Preparing now

Although the specifics of the proposal may change during negotiations, its implications for product design, age assurance and governance are sufficiently clear to justify proportionate preparation now. Relevant preparatory actions are outlined in Figure 3.

Figure 3: Preparing for the EU KIDS Act

Early assessment of the requirements and consideration of the options available will help companies identify proportionate approaches, sequence actions and preserve flexibility as the negotiations unfold. It should also reduce the risk of costly, rushed product redesign once the final requirements and implementation timetable are finalised.

Footnotes

1. These include livestreaming to an open audience, contact with strangers, profiling-based recommendations, suggested contacts or content outside a user’s network and features that encourage continuous use or re-engagement.

2. Descriptions are simplified and paraphrased for illustrative purposes. Please refer to the legislative proposal for precise conditions and requirements.

3. Providers of online social networking services and VSPs designated as VLOPs.

4. The proposal envisages one or more independent auditors with proven child safety, medical, developmental, age assurance, interface and recommender systems design and data security expertise.