Children Online: the EU KIDS Act Proposal and Age Verification

The legal framework

Three texts matter for online services that reach children in the EU.

• The Digital Services Act (DSA), Regulation (EU) 2022/2065, has applied since 17 February 2024. Its Article 28 is the current rule on the online protection of minors.
• Commission Recommendation (EU) 2026/1035 of 29 April 2026 sets out a common framework for EU-wide age verification technologies. It does not bind businesses.
• The EU KIDS Act ("EU Keeping Internet Digital Spaces Accountable and Trustworthy") is a proposal for a regulation, COM(2026) 681 final of 17 September 2026, procedure 2026/0286(COD). The Parliament announced the referral to committee on 22 October 2026, and the file is awaiting a committee decision. Nothing in it binds anyone yet, and the text can still change.

What applies today: Article 28 DSA

Providers of online platforms accessible to minors must put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security of minors on their service (Article 28(1)). They may not show advertisements based on profiling with personal data of a recipient when they are aware with reasonable certainty that the recipient is a minor (Article 28(2)). The DSA does not require them to process extra personal data to find out whether a user is a minor (Article 28(3)). The Commission may issue guidelines on Article 28(1) (Article 28(4)), and it has done so. According to the recitals of Recommendation 2026/1035, those guidelines expect age verification on high-risk platforms, such as pornography or gambling, and where Union or national law sets a minimum age.

Article 28 sits in Section 3 of Chapter III. Under Article 19, that section does not apply to online platforms that qualify as micro or small enterprises, unless they are designated as very large online platforms.

The age verification recommendation

Recommendation 2026/1035 aims to give all EU citizens access to privacy-enhancing digital proof-of-age technology by the end of 2026 (point 1). It is addressed to the Member States. The Commission recommends that each Member State make an EU age verification solution available by 31 December 2026, integrated in the European Digital Identity Wallet, as a stand-alone app, or both (point 5). Member States were asked to submit an implementation plan by 30 June 2026 (point 5(a)). They are encouraged to set up proof of age attestations and to require age verification methods that conform to the EU Age Verification Scheme (point 10). A proof of age attestation is an electronic attestation of attributes under the eIDAS Regulation, showing only that the holder is above an age threshold (point 4(i)).

The KIDS Act proposal: who would be caught

The proposal would apply to providers of services accessible to minors in seven groups (Article 2(1)): online social networking services, video-sharing platform services, software application stores, online games, operating systems, AI companions and general conversational chatbots. A minor is anyone under 18 (Article 3(5)(a)). Services offered to users in the EU are caught wherever the provider is established (Article 2(2) and (3)). Excluded are, among others, not-for-profit encyclopaedias and repositories, educational services run by schools, open-source development platforms and research-only systems (Article 2(4)).

Most service definitions come from the Digital Markets Act (Article 3(2) and (4)). An AI companion is an AI system that provides sustained, personalised interaction simulating a social, emotional or interpersonal relationship (Article 3(5)(c)). A general conversational chatbot is a general-purpose AI system with conversation across many domains. Chatbots limited to a specialised task, such as customer service, technical support or transactions, are not covered (Article 3(5)(d)).

The duties in the proposal, article by article

• Minimum age of 15 (Article 6). Social networks and video-sharing platforms may not let a person under 15 create or use an account where the service poses a risk to minors. The text lists the features that count as such a risk: live streaming to an indeterminate audience, contact with strangers, recommender systems based on profiling or suggesting unknown contacts, and features built for endless scrolling, engagement or prompt notifications (Article 6(1)). Guardians may open a limited account for a child aged 13 or 14, with guardian tools always on, a daily limit of at most one hour and pre-approval of contacts (Article 6(2)). Within six months after the regulation applies, providers must check whether existing account holders are under 15 and disable those accounts, and accounts whose age cannot be established (Article 6(4)).
• Safety by design (Article 8). Social networks, video platforms, online games, AI companions, chatbots and app stores must design their services for minors by default. They may only depart from them once age assurance shows the user is an adult.
• Addictive design (Article 9). No design meant or foreseeably likely to encourage compulsive use by minors. Autoplay without real breaks, notifications not triggered by the minor's activity, rewards for live streaming and streak-style penalties are deemed to do so. Providers must offer time limits and interruptions that protect school time and sleep.
• Recommender systems (Article 10). Recommendations based on implicit engagement signals are off by default, and minors must be able to choose an option not based on profiling.
• Safe settings (Article 11). Geolocation, microphone and camera access, contact recommendations and push notifications are off by default. The provider may change them only for a minor over 15 who was clearly informed and explicitly agreed. Features that increase social comparison or embellish or idealise a minor's image may not be offered to minors at all.
• Contacts (Article 12). No direct contact without the minor's pre-approval, no inclusion in contact suggestions, private profiles by default and no live streaming by minors by default.
• Spending (Article 13). A minor must be told in real time that a transaction is a purchase, and prices in virtual currency must show the value in the local currency. Minors may not be exposed to variable reward systems.
• AI companions and chatbots (Article 14). No features that simulate relationships likely to create emotional dependency, safe default settings, testing before placing on the market and post-market monitoring (monitoring is not required from micro and small enterprises). A chatbot built into a social network or game may not switch on automatically and minors must be able to opt out.
• Online games and app stores (Articles 15 and 16). Games apply the rules on compulsive use, settings and contacts, and must offer guardian tools. App stores must run an age-rating system, block apps inappropriate for the user's age and allow the EU age verification solution in the store.
• Reporting and guardian tools (Articles 18 to 20). Child-friendly controls and reporting, handled as a priority, and guardian tools.

Age assurance under the proposal

Age assurance must be accurate, reliable, secure, non-intrusive, privacy-preserving and non-discriminatory (Article 27). It may not identify, locate, track, target or profile the user, and any age assurance measure must be zero knowledge proof (Article 28). For the minimum age of 15, providers must rely exclusively on a certified EU age verification solution using an EU proof of age attestation from a third party (Article 29(2)). European Digital Identity Wallets that meet the scheme are deemed certified (Article 29(3)). For the safety-by-design duties and app stores, other age assurance methods can be used if they meet Articles 27 and 28 (Article 29(4)). Users must be able to complain about a wrong age result (Article 29(5)). Member States must make at least one EU age verification solution available free of charge (Article 31(5)).

Enforcement and dates

Social networks, video platforms, gaming platforms and app stores would be supervised under Chapter IV of the DSA. AI companions and chatbots would be supervised under the AI Act, with fines of up to 6% of worldwide annual turnover where the provider acted intentionally or negligently (Article 34(1) and (2)). Data protection authorities would supervise the age assurance rules (Article 34(6)). Social networks and video platforms designated as very large online platforms would have to notify a compliance plan to the Commission and have it audited (Article 5). The regulation would enter into force 20 days after publication and apply six months later. Article 5 would apply from entry into force, and Articles 33 and 35 twelve months after it (Article 43). Article 41 would add the act to the annex of the Representative Actions Directive (EU) 2020/1828.

In practice

A video app with comments, live streams and an algorithmic feed would meet the risk features of Article 6(1). Under the proposal it would have to verify, with a certified EU solution, that new users are at least 15, run the same check on existing accounts within six months after the regulation applies, and redesign its default settings for any user it has not verified as an adult. Today, under Article 28 DSA, it already has to take proportionate measures and may not show profiled ads to users it knows are minors.

A company that adds a general chatbot to its consumer app would fall under Article 14. A narrow customer-service bot would not, because Article 3(5)(d) excludes it.

Contracts and practical steps

• Map your service. List which of the seven categories in Article 2(1) you fall into, and which features trigger Article 6(1).
• Check your age data. Age assurance data may not be reused for profiling or advertising (Article 28 of the proposal), and the GDPR applies in parallel. A data protection impact assessment is the natural place to document this.
• Review vendor contracts. Age verification, chatbot and analytics suppliers will process minors' data on your behalf. Their contracts should cover data minimisation, no reuse, certification status, audit rights and cooperation with complaints under Article 29(5).
• Plan for app stores and operating systems. The proposal requires app stores to assess the age of their users (Article 16(4)) and operating systems to share an age signal with the user's consent (Article 29(6)). Check what your distribution partners will expect from you.
• Act on today's rules. Article 28 DSA already applies; the proposal is at committee stage.

Frequently asked questions

Does the KIDS Act apply today?

No. It is a proposal. Today the DSA, in particular Article 28, applies to online platforms, together with the GDPR, consumer law and national rules.

Is a self-declared date of birth enough?

Under the proposal, no. Its definition of age assurance excludes self-declaration (Article 3(5)(i)), and the minimum age of 15 requires a certified EU age verification solution. Self-declaration by a parent is accepted for parental responsibility at least until the Commission specifies other signals (Article 26(1)(c)).

Are small companies exempt?

The DSA's Article 28 does not apply to micro and small online platforms (Article 19 DSA). The KIDS Act proposal has no general exemption for small providers. It only spares micro and small enterprises the post-market monitoring duty for AI companions and chatbots (Article 14(1)(f)).

How this connects

Age checks and default settings meet the rules on cookie consent and the website technology audit. The consumer side, including dark patterns and spending by minors, is in the Digital Fairness Act in depth, and the wallet that can carry a proof of age is explained in the EU Digital Identity Wallet. We document the privacy side with our DPO as a service and a data protection impact assessment, and we review age verification and platform contracts as part of commercial contracts and transactions, with Contract Review for the clause-by-clause check.

Cited provisions. DSA (Regulation (EU) 2022/2065): Articles 19 and 28. Recommendation (EU) 2026/1035: points 1, 4, 5 and 10. EU KIDS Act proposal, COM(2026) 681: Articles 2, 3, 5, 6, 8 to 16, 18 to 20, 26 to 29, 31, 34, 41 and 43.

Key dates. 17 February 2024: the DSA applies in full. 29 April 2026: Recommendation 2026/1035. 17 September 2026: KIDS Act proposal published. 22 October 2026: referral to Parliament committee announced. 31 December 2026: recommended date for an EU age verification solution in every Member State. KIDS Act: would apply six months after entry into force.

Further reading. platform duties under the DSA, the Digital Fairness Act in depth, the EU Digital Identity Wallet, cookie consent, website audits.