On 17 September 2026 the European Commission proposed the EU KIDS Act, a regulation that would bar under-13s from social media, put 13-to-14-year-olds into parent-managed "mini accounts" capped at one hour a day, and let users open their own accounts at 15. It is a proposal only: Parliament and the Council must still agree a text. But its architecture deserves scrutiny now, because the strongest parts and the riskiest parts sit side by side.
The best case for the Act
The case for intervention is serious. Platforms have optimised engagement for years, and the burden of proving harm has fallen on regulators and families. The Commission's announcement says the proposal shifts the burden of proof from regulators to platforms, requiring very large platforms to show their services are designed with children's wellbeing in mind. It also sets protective defaults: private profiles for minors, no unsolicited contact from strangers, easy blocking and muting, and AI chatbots and companions switched off by default and barred from fostering emotional dependence. Von der Leyen framed the question as "when and how do we allow social media to access minors". A patchwork of national bans would be worse for both families and companies than one harmonised rulebook, and a single regulation would apply directly in all 27 member states.
What is genuinely good
The design-focused provisions are the proposal's strongest element. The Commission lists limits on infinite scroll, reward mechanics and push notifications during sleeping hours. These regulate how a product is built rather than what users say, which is the right lever for a pro-speech approach: they do not require anyone to decide which lawful content a child may see. Extending duties to online games, AI companions and chatbots also reflects where young people actually spend time. According to the law-firm analysis by Davis Wright Tremaine, the draft rests on the existing Digital Services Act and AI Act enforcement structures rather than inventing a new regulator, with the Commission supervising very large platforms and national authorities handling games outside the DSA.
Where proportionality breaks down
The first problem is the age gate. The EEAS summary says social media and video-sharing providers must verify age when a user opens a new account, and that app stores must also run age assurance. Separating a 14-year-old from a 16-year-old means checking everyone. As Czech Pirate MEP Markéta Gregorová has put it, enforcing a ban requires checking everyone who wants to create an account, and industry group CCIA Europe makes the same point about adults. The Commission stresses that its EU age-verification app does not retain identity documents or biometric data, and that is a real mitigation. But a privacy-preserving credential is still a credential: the architecture normalises proving your age to speak, read or play, and Reason notes that the app's verification routes include a passport upload, a post-office visit or an online banking connection. The Electronic Frontier Foundation has warned that defining what is "safe" can easily become a means of controlling what people can access or share.
This is consistent with EFF's earlier position on the Commission's Digital Services Act guidance on minors. In its 2025 feedback, EFF argued that age verification often relies on government ID or biometrics, can exclude people without formal documents, and that age estimation is least accurate for marginalised groups. It urged strong privacy defaults, recommender-system transparency and user controls instead of one-size-fits-all technical mandates. Those alternatives map neatly onto the Act's design duties, which suggests the legislature could keep the design rules while softening the gate.
The cost side: no SME exemption
The second problem is scale. Per the Davis Wright Tremaine analysis, fines reach up to 6% of worldwide annual turnover, mirroring the DSA, and the draft contains no exemption for small or micro enterprises on the reasoning that they "may equally provide harms to minors." That reasoning is not absurd: a small app can harm a child as much as a large one. But compliance cost is not proportional to harm. A large platform can build age-assurance flows, parental-account tooling and a one-hour timer; a three-person games studio or a niche community forum cannot easily do so. The Act's own text acknowledges "additional costs for digital services providers," as Reason reports. Those costs fall hardest on exactly the European challengers that policymakers say they want to nurture, and they entrench incumbents who can absorb them. A sensible fix would tier obligations by risk and reach, with a lighter regime for services without recommender-driven feeds, direct messaging with strangers, or monetisation aimed at minors.
Questions for Parliament and the Council
- Is the age threshold stable? Reports differ on whether Parliament, which has previously called for a minimum age of 16, will accept 15 as the independent-account threshold.
- What happens to existing accounts? According to Davis Wright Tremaine, providers must check existing holders within six months of the rules applying and disable accounts that are under 15 or whose age cannot be established. Disabling by default when age is uncertain turns an inference failure into a lost account, and for many adults a lost archive of their own speech.
- How will it interact with speech rights? Platforms facing 6% fines and unclear age signals have every incentive to over-restrict, which is the over-blocking risk EFF has flagged.
The realistic timeline is long. Law-firm commentary expects the rules not to apply before 2028, giving legislators time to correct course.
A better bargain
The KIDS Act is at its best when it treats children's online safety as a product-design problem and at its weakest when it makes identity checks the price of participation. Parliament should keep the infinite-scroll, notification and default-setting duties, require age assurance to be proportionate to demonstrated risk rather than universal, preserve anonymous access to general-audience services that pose low risk, and replace the blanket absence of an SME exemption with risk-tiered obligations. Protecting children and protecting an open internet are compatible goals, but only if the final text is built to serve both.