EU KIDS Act: Minimum Age 15, Safe-by-Default Design and Mandatory Age Verification

Why Is This More Than a "Social Media Ban"?

Guidance becomes binding law: The Commission's July 2025 guidelines on the protection of minors under Article 28 DSA are formally non-binding. The proposal converts their substance into enforceable, feature-by-feature prohibitions and places the burden on providers to demonstrate that their services are safe for minors.

The scope extends well beyond online platforms: Online games, AI chatbots and companions, app stores and, to a limited extent, operating systems are brought within a child-specific regime for the first time. Stand-alone games and AI systems may fall outside the DSA today, and app stores, although generally already online platforms under the DSA, receive new age-rating and access duties. The rules target design features (feeds, notifications, contacts, chatbot memory) rather than content as such. There is no general exemption for small or micro enterprises.

Protective settings become the default for all users: The safety-by-design requirements apply to every user, whether or not logged in, and may be relaxed only once age assurance establishes that the user is an adult.

Who Is in Scope?

Seven categories of service: Online social networking services, video-sharing platforms, app stores, online games, operating systems, AI companions and general conversational chatbots, wherever the provider is established.

The definitions are broad (examples): "Minor" means any person under 18. "Online game" covers any game purchased, accessed or distributed online, even if it is then played locally; "general conversational chatbot" means a general-purpose AI assistant that can converse with users and assist them across many domains and tasks; chatbots limited to customer service, technical support or similar specialised tasks are expressly excluded; and "AI companion" covers any AI system that simulates a social or emotional relationship with the user.

The exemptions are narrow (examples): Not-for-profit encyclopedias and educational or scientific repositories, services operated by educational establishments, open-source development platforms and public-authority services.

What Are the New Age Rules?

Under 15: No account of their own on a social network or video-sharing platform that has at least one of the listed risk features: livestreaming to an open audience, contact with users outside their existing connections, recommendations based on profiling or going beyond the user's own connections, or design that encourages uninterrupted use, rewards interaction or sends prompting notifications. Most mainstream services will meet at least one criterion. Use without an account is not age-restricted, although the safety-by-design defaults still apply to logged-out users.

13 to 14: Providers may, but need not, allow a verified parent to open an account with limited functionality for the child: parental control tools permanently active, daily use capped at one hour, contacts pre-approved and limited in number.

Under 13: No social media accounts; video-sharing platforms designed for young children may offer supervised access through the parent's own account under strict conditions.

Existing accounts: Within six months of the regulation applying, providers must establish whether existing account holders are under 15 and disable the accounts of those who are, as well as any account whose age cannot be established. Verification is not required where the provider can show with a high degree of confidence (for example, from the account's creation date or payment data) that the user is 15 or older. Very large platforms must file a plan, backed by statistical evidence, showing how they will carry out this exercise.

What Will Services Need to Change?

Social networks and video-sharing platforms face the most extensive obligations: No autoplay or endless feeds without effective stopping points, no notifications unrelated to the user's own activity, no "streaks" and mandatory time limits that protect school hours and night-time sleep. Recommender systems must prioritise preferences the minor has expressed, with engagement-based signals off by default. Location, camera and microphone access, contact synchronisation and push notifications must be off by default. Unknown users may not initiate contact, minors' profiles are not visible to non-contacts, and livestreaming is disabled by default. Commercial transactions must be labelled in real time and virtual currency shown in real money, and minors may not be exposed to loot boxes or other variable-reward mechanisms.

AI chatbots and companions: No design features that simulate relationships in a way likely to create emotional dependency; memory of previous conversations off by default for minors; access by under-13s only through parental control tools; testing for risks to minors before launch and, in principle, ongoing post-market monitoring.

Online games: The addictive-design, default-settings and contact rules apply in adapted form; parental control tools are mandatory and are the only route through which under-13s may play.

App stores take on a central role in age-based access: They must age-rate every app under a published methodology, prevent minors from downloading or purchasing apps unsuitable for their age (or below a higher age set by national law), assess users' age for that purpose and allow the EU age verification solution to be offered in the store.

Very large social networks and video-sharing platforms (45 million or more monthly EU users): Within 30 days of the KIDS Act applying, a compliance plan must be submitted to the Commission and audited at the provider's expense by independent auditors; where the Commission identifies shortcomings, a corrective action plan is due within 30 days and must be implemented within a further 60 days. Across sectors, regardless of size, social networks, video-sharing platforms, online games and AI chatbots must offer effective parental control tools; all of these except stand-alone games must also provide child-friendly reporting channels, with reports from minors handled as a priority.

How Will Age Be Verified?

Two tiers: For the under-15 age gate, providers may rely only on an EU age verification solution that uses a certified third-party proof of age under the EU Age Verification Scheme, whose binding technical specifications are still to be adopted; EU Digital Identity Wallets that are certified under the eIDAS Regulation and comply with the Scheme qualify. For the safety-by-design and app-store obligations, any method that the provider can demonstrate meets the statutory standards may generally be used.

Privacy safeguards: Self-declaration of age is not sufficient. Every method must operate on a zero-knowledge basis: the service learns only whether the user is above or below the relevant threshold, not the user's identity or date of birth, and may not use the information for any other purpose.

Parental verification: For accounts opened for children aged 13 to under 15 and for parental control tools, providers must verify that the adult holds parental responsibility, using official databases, existing signals or, until the Commission adopts a delegated act, self-declaration combined with reasonable verification efforts. Member States must provide free electronic means to prove age and parental responsibility.

Who Enforces and What Are the Enforcement Risks?

No new regulator: Social networks, video-sharing platforms, gaming platforms and app stores are supervised under the DSA enforcement regime: the Commission for very large platforms, and national Digital Services Coordinators (in Germany, the Bundesnetzagentur; in France, Arcom) for all others. AI chatbots and companions fall under the AI Act regime. Stand-alone online games are supervised by national authorities designated by the Member States. Compliance with the regulation counts as compliance with Article 28(1) DSA for the matters it covers; pending DSA proceedings are not affected.

Sanctions and procedure: Fines can reach 6% of worldwide annual turnover for AI companions and general conversational chatbots under the AI Act's fining power. Social networking services, video-sharing platforms, video gaming platforms and app stores instead face sanctions under the DSA's own enforcement and penalty regime, applied by cross-reference (also up to 6% of worldwide annual turnover under the DSA). Breaches of the age-assurance data rules are sanctioned under the GDPR, with fines of up to 4%. Stand-alone video games are enforced by national authorities under penalties set by each Member State. For cases handled by the Commission, an expedited procedure targets preliminary findings within 30 and a final decision within 90 working days of opening proceedings. Commission-supervised providers will also pay an additional annual supervisory fee of up to 0.03% of worldwide annual net income.

Private enforcement: Minors and parents may mandate non-profit organisations to exercise their rights and to lodge complaints with regulators. The regulation is added to the Representative Actions Directive, enabling consumer and child-protection bodies to bring collective actions for injunctions and damages in national courts.

When Will the KIDS Act Apply and What Should You Do?

Timeline: The feedback period runs until 3 December 2026. The Commission hopes for political agreement by spring 2027. Once adopted, the regulation applies six months after entry into force; the compliance-plan provisions for very large social networks and video-sharing platforms apply from entry into force, with the plan itself due 30 days after the application date.

Map the scope: Identify which services, features and embedded chatbots are covered, including games available for online purchase or distribution.

Decide the strategic direction: Either verify the age of adult users to retain engagement-based features or apply minor-safe settings to all users. Quantify the revenue effect of switching these features off by default.

Prepare for existing accounts: Assemble the evidence needed to rely on the "high degree of confidence" exception and decide whether to offer parent-managed accounts for children aged 13 to under 15 at all.

Build on existing compliance: The DSA guidelines on minors and the UK Online Safety Act children's codes should generally provide a baseline, but alignment with them does not amount to compliance with the regulation.

Engage: Participate in the Commission's feedback round, the codes of conduct on age rating and online games and the legislative negotiations. The age threshold, age checks for adult users and the position of smaller providers, which the proposal does not exempt, are likely to be among the open points.