EU KIDS Act: beyond a social media ban—how will the new rules affect your business?

The proposal in a nutshell

The Act covers seven categories of provider wherever the service or system is accessible to minors: online social networking services, video-sharing platform services, software application stores, online games, operating systems, AI companions and general conversational chatbots. For online social networking services, video-sharing platform services, software application stores, online games and operating systems, it applies irrespective of the provider’s place of establishment where those services are offered to recipients established or located in the Union; for AI companions and general conversational chatbots, it applies to providers placing them on the market or putting them into service in the Union, and small and micro enterprises are deliberately not exempted, on the basis that they may equally harm minors. 

The definitional reach is broader than it may first appear. “Online social networking services” borrows the DMA definition, extending beyond conventional social media to web boards and online communities. “Online games” is a new umbrella term whose current wording could extend to interactive video functionality. And an ordinary chatbot may fall within scope as “general conversational chatbot” unless its conversational functionality is confined to a specialized service, task or pre-defined set of functions. 

Three pillars

Age-based access delay

The Regulation fully harmonizes the minimum age for autonomous account creation on social networking and video-sharing services with high-risk features such as livestreaming, open contact, profiling-based recommenders or engagement-driven design. Below 13 there are no accounts at all; on video-sharing services specifically designed for young children, a guardian may enable limited access through the guardian’s own account. Between 13 and 15, providers may offer guardian-created “mini-accounts”, legally held by the guardian, with peer-only contacts, guardian pre-approval of contacts, a daily limit capped at a maximum of one hour and no public visibility. From 15, minors may open their own accounts, but the service must meet the strengthened safety-by-design and age-assurance requirements. 

Safety by design. The Act codifies and specifies DSA Article 28 obligations, operating in layers rather than applying a single code across all services. It prohibits addictive design features such as autoplay, infinite scroll, streaks and attention-recapture notifications, requires recommender systems to be optimized for safety, content quality and mental health rather than engagement, mandates highest-privacy defaults for minors, and imposes contact safeguards, including non-public profiles and no livestreaming by default. Notably, the economic-transaction rules—including spending safeguards and restrictions on variable-reward systems—pre-empt what had been expected in the forthcoming Digital Fairness Act, effectively narrowing its scope. 

Age assurance

Age assurance is the operational backbone of the whole framework, and self-declaration is expressly deemed “insufficient.” For the access-delay rules, providers must rely exclusively on EU age verification solutions using a third-party proof-of-age attestation certified as conforming with the EU Age Verification Scheme. Alternative solutions are permitted for safety-by-design and app-store duties, provided they are state-of-the-art and zero-knowledge-proof based. 

Enforcement

The Act relies on existing structures rather than creating new authorities. DSA Chapter IV applies to most in-scope intermediaries, with national authorities enforcing against video games outside the DSA. AI Act Chapter IX applies to AI companions and chatbots, with fines up to 6% of worldwide turnover, while GDPR supervisory authorities retain competence over the data-protection aspects. The Act would also be added to Annex I of the Representative Actions Directive, opening it to collective redress. 

What’s next?

The proposal now goes to the European Parliament and the Council under the ordinary legislative procedure, where amendments on ages, scope, SME treatment and AI safeguards are to be expected. Even so, the proposal benefits from strong political momentum and its core architecture is unlikely to be materially diluted. Once adopted, the Regulation would have a phased-in application timeline, with obligations kicking-in between six and 12 months after entry into force, with existing accounts held by users below 15 to be identified and disabled or verified within that first six-month period. 

Companies should begin mapping their technology stacks against these requirements now. For the full analysis—including the layered safety-by-design obligations, the interplay with the DSA, DMA, AI Act, AVMSD and eIDAS, and the enforcement architecture—please see our detailed alert, available to download below.