EU Kids Act: European Commission proposes landmark new rules for the protection of minors online

On 17 September 2026, the European Commission published its highly anticipated proposal for a new EU Kids Act (the Act), a standalone regulation designed to strengthen the protection of children under the age of 18 online and establish a harmonised framework across the EU for children’s access to certain digital services. The proposal follows increasing political and regulatory concern regarding the impact of online services on children, including exposure to harmful content, addictive design features, cyberbullying, online predators and excessive screen time.

The EU legislative framework already provides for a number of protections for children online, most notably the protection of children’s personal data under the EU GDPR and obligations on digital services to protect children from online harms under the Digital Services Act (DSA). However, the Act reflects the European Commission’s view that existing laws do not fully address the risks, as well as increasing pressure from EU Member States to introduce a “social media ban” for children in the EU.

Who will the EU Kids Act apply to?

The proposal applies to a broad category of online services made available to minors, including:

• Social media services;
• Video-sharing platforms;
• Software application stores; 
• Online video games;
• Operating systems; and 
• AI companions and AI general conversational chatbots.

Whilst all of the above services are in-scope of the Act, the specific obligations that apply vary depending on the particular service. The majority of the proposals affect social media and video-sharing platforms, which are the primary focus of the legislation, but several key obligations also extend to online games, AI companions/chatbots and certain other digital services used by minors.

Educational services, services used by public authorities, and industrial or professional AI tools are expressly excluded from the scope of the Act. 

Proposed Obligations

Restrictions on access for minors to online services

A central feature of the proposal is a staged approach to children's access to online services:

1. Autonomous accounts from age 15. Providers of social media services and video sharing platforms must not allow children under 15 to create an account, where the service poses a risk to the privacy, safety or security of the child. The Act sets out certain conditions which, if met, demonstrate that the service poses a risk (e.g. live streaming features or recommender systems based on profiling).
2. Limited "mini accounts" for ages 13 to 14. As an exception to the general prohibition for under 15s, providers may allow parents/guardians to create accounts for children aged 13 to 14 with limited features. These accounts are subject to enhanced safeguards including parental oversight, limits on social interactions and maximum screen-time limits.
3. Access for children under 13. Children under 13 cannot create or access social media accounts. However, they may access specially designed child-friendly video-sharing services through accounts managed by a parent/guardian’s own account.

Safety obligations

The proposal introduces extensive "safe by design" obligations for in-scope services provided to users under 18. The burden is placed on providers to demonstrate that services are age-appropriate and safe for minors, rather than on regulators to prove harm after it occurs.

The obligations vary depending on the particular service, but broadly cover the following: 

• Prohibiting addictive design features, e.g. those that encourage excessive use. 
• Additional rules (to those under the DSA) relating to recommender systems to ensure a high level of privacy, safety and security of minors (e.g. ensuring they do not exploit minor’s vulnerability or attention). 
• Implementing age appropriate safety and privacy settings by default. 
• Safeguards relating to minors contact and interactions with other users (e.g. preventing unsolicited contact from strangers). 
• Tools that enable minors to control content and settings. 
• Reporting mechanisms to enable minors to report harmful content, accounts, groups, features or behaviour, as well as providing minors with access to support information. 
• Implementing tools for parents/guardians to keep children safe online. 

Parental verification and age assurance

The proposed Act establishes a harmonised EU framework for both parental verification and age assurance, recognising that the age-based account restrictions and safety obligations can only be effective if providers are able to determine a user's age and, where relevant, verify the identity of a parent or guardian. 

• Parental verification. Where the Act permits access through parent-managed accounts, providers will be required to verify that the individual creating and managing the account is in fact a parent or legal guardian. The Act provides a framework for such verification based on the use of “signals” to demonstrate parental responsibility, and power for the Commission to supplement this through a delegated act.
• Age assurance. Providers will be required to determine whether users fall within the relevant age categories using age assurance solutions (and in particular, an EU age verification solution certified under the EU Age Verification Scheme).

The practical implementation of these obligations, particularly the interaction between age assurance, parental verification, privacy requirements and the EU Age Verification Scheme, is likely to be a key focus during the legislative negotiations.

Additional obligations for VLOPs

Online platforms designated as Very Large Online Platforms (VLOPs) under the DSA will be subject to enhanced compliance requirements under the Act. These include obligations to conduct compliance assessments demonstrating adherence to the Act and to undergo independent auditing of those assessments. The proposal therefore builds upon the existing DSA supervisory framework for the largest digital services. 

Enforcement

Enforcement will largely leverage the existing framework under the DSA, for online services, such as social media, video sharing and online games; and the EU AI Act, for AI companions and AI chatbots. The proposal provides for regulatory supervision, investigatory powers and significant financial penalties for non-compliance (up to 6% of a provider’s worldwide annual turnover). 

The proposal also introduces a supervisory fee payable by certain providers, such as VLOPs, to support oversight and enforcement activities.

Key takeaways

The Act represents a significant intervention on the part of the EU legislature in regulating children’s online activities, and is the EU’s attempt to impose its own “social media ban” for children (similar to bans implemented elsewhere in the world, such as Australia, and proposals to do the same in other jurisdictions, such as the UK). 

If adopted in its current form, it would introduce an EU-wide minimum age of 15 for autonomous accounts, create mandatory parental oversight mechanisms for younger users, and impose far-reaching safe-by-design obligations on social media platforms, video-sharing services, online games and AI services. The proposal also signals a continuing shift in EU digital regulation towards placing primary responsibility for protecting minors on service providers rather than users or parents.

The proposal remains subject to the EU legislative process before adoption. Implementing similar bans has so far proven a challenge at the individual Member State level (France’s recent proposal was successfully challenged in the French courts). It seems highly likely that the Act will be subject to significant scrutiny and negotiations, and is therefore subject to change prior to formal adoption.