On 7 September 2026, Estonia's Justice and Digital Affairs Minister Liisa-Ly Pakosta told AFP that the EU should not ban children from social media. "As children are members of the information society, it's actually the platforms who should change," she said, adding that "the best interests and rights of the child must guide platforms' design" (AFP via The Star). AFP described Estonia as the only EU country opposing the bloc's plan, ahead of a Commission announcement expected on 16 September, with an age limit of 13 or 15 under discussion.
The case for an age limit
The strongest argument for a limit is that years of voluntary measures have not worked. Platforms have had every incentive to retain young users, and self-declared birthdates are trivially false. The Commission has already used the Digital Services Act (DSA) to investigate Meta's Facebook and Instagram and TikTok over "addictive" design. A bright-line rule is easy to explain and easy to audit. Parents who say that no child can opt out of a peer network alone have a real point.
What Estonia is actually asking for
Pakosta's position is narrower than "do nothing." She wants the DSA's child-protection recommendations made legally binding. Those recommendations are the Commission's guidelines under Article 28(1) DSA, published on 14 July 2025. The Commission's own page states that they are voluntary and that "following these guidelines is voluntary and does not automatically guarantee compliance," although the Commission will use them to assess compliance (European Commission).
The content of the guidelines is design-focused. They recommend switching off by default features that encourage excessive use, including streaks, ephemeral content, read receipts, autoplay and push notifications. They also recommend safeguards for AI chatbots integrated into platforms and protection from manipulative commercial practices such as loot boxes. They say measures must not disproportionately or unduly restrict children's rights, and they recommend age verification for adult content and age estimation in other cases.
This is a different theory of harm from an access ban. It targets the product (infinite engagement loops, recommender defaults, contact from strangers) rather than the user. Estonia's argument is that the DSA already supplies the legal hook. The missing step is turning recommendations into obligations and enforcing them.
The proposal that followed
The Commission has since proposed the KIDS Act. Its own page says that in September 2026 it "proposed the KIDS Act to enhance the protection of minors online," with a consultation running from 2 October to 3 December 2026 (European Commission). According to law firm Lewis Silkin's summary, the proposal would bar children under 13 from social media. Opening an independent account would require being 15. Ages 13 to under 15 would get guardian-managed "mini accounts" with limited contacts and a one-hour daily screen-time cap. Providers would verify age at account opening (Lewis Silkin). It is a proposal, not law, and it now goes to Parliament and Council.
The package is more mixed than a pure ban. It includes safety-by-design rules, which is Estonia's own demand. But the access tier is where the costs concentrate.
Why the access tier deserves skepticism
Circumvention. Pakosta has said young people can easily bypass age checks. In ERR's reporting she said, "What we really need is much stronger enforcement" (ERR News). A ban that teenagers evade shifts them to unmoderated services, VPNs and borrowed adult accounts, which are less safe than regulated platforms.
Profiling. Verification at scale means collecting more data about everyone. Pakosta told ERR that "we really don't want to see profiling of all users, especially not of children." The Commission's reported answer is an age-verification app that keeps no identity documents or biometric data. That is a sensible design, and its real-world performance should be tested before it becomes a mandatory gate for every user.
Rights. Children have expression, information and association interests. The Commission's own guidelines acknowledge this by warning against undue restriction of children's rights. A flat floor of 15 sits awkwardly with that language.
Fragmented legal baseline. Today, Article 8 GDPR sets a default digital consent age of 16 and lets member states lower it to no less than 13 (GDPR Art. 8 text). Estonia sits at the floor of 13 and has no national age-verification mandate. A harmonised EU rule has real merit. The question is whether it harmonises on restriction or on platform accountability.
A proportionate alternative
The most defensible path combines both ideas, in sequence. First, convert the DSA Article 28 guidelines into binding, testable design duties. Defaults for minors would be set by the platform, with the burden on the platform to show its design is safe. Second, enforce them hard, with the Commission's existing DSA investigations as the proving ground. Third, treat access limits as a fallback that is triggered if measurable harms persist, rather than the opening move. Run the age-assurance app in limited pilots and publish the evidence on circumvention and data handling before mandating it.
This ordering has a practical benefit. Design duties apply to every user and improve the product for adults too. Access bans protect only the children who comply with them, while imposing identity checks on everyone.
Estonia is a small, digitally advanced state, and its isolation in the Council should not be read as proof it is wrong. Its argument is also not a defence of the status quo. Platforms have had a decade of voluntary promises. The argument is that regulators already hold a lever and have chosen not to make it binding. Before Brussels restricts what children may do, it should require that platforms stop doing what harms them.