Europe’s proposed Kids Act asks platforms to adapt to children’s ages
On 17 September, the European Commission published its proposed EU Kids Act. It would prohibit social-media accounts for under-13s, allow guardian-supervised limited accounts for 13- and 14-year-olds, and permit independent accounts from 15 in services subject to safer-design duties. It is a legislative proposal, not law in force.
What it could improve
The proposal combines gradual access with duties to change the services themselves. Its proposed safeguards address addictive design, recommender systems, privacy defaults, unwanted contact, livestreaming, AI chatbots, games and app stores. The Commission also proposes independent, privacy-preserving age verification: a platform would learn whether a user meets an age threshold, without receiving identity documents or learning who that person is. The Commission says a declared date of birth would not be enough and existing accounts would have to be checked. Very large platforms would have to demonstrate compliance through plans and independent audits, rather than leaving children and families to prove harm.
What remains unresolved
The decisive implementation question is how a service will recognise a child when an existing account has not been checked, its declared age is wrong, or the child uses another person's account. Age rules only change a child's experience if services can apply them to the person actually using the service.
- The Commission proposes exemptions for services such as educational platforms, encyclopaedias and digital news. The boundaries of those exemptions and access to beneficial online communities will matter in practice.
- The proposal calls for certified, privacy-preserving age verification independent of platforms. Its deployment should be tested for accuracy, accessibility, data minimisation and whether checks remain genuinely unlinkable across services.
- Australia's three-month evaluation found that 81.5% of children under 16 still reported using a social-media platform, compared with 85.9% before its account restrictions. Many children retained accounts because platforms had not checked their age; others had an account age of 16 or older, or an incorrect age estimate. These are implementation gaps that European services will need to address.
- A child may use a shared or inaccurate account, switch devices, visit a service while signed out, or move to a service outside the rules. An age label attached only to one account does not resolve these situations.
- Parent-supervised accounts can support younger teenagers, but should not make parents solely responsible for risks designed into a platform.
- Compliance plans and audits need to test actual outcomes, including contact, recommendation, privacy and wellbeing safeguards; stated policies or account settings alone are insufficient.
- Restrictions need to respect young people’s participation, accessibility and growing autonomy, including the circumstances of children who rely on online communities for support.
The Child-Friendly Internet perspective
The proposal is unusually close to the Child-Friendly Internet principle that digital environments should adapt as children mature. Its independent, privacy-preserving age verification is a substantial step toward reducing identity disclosure to platforms. A complementary network-level architecture could help make trustworthy child context available across participating cellular, home, school and public networks. A trusted source would establish the relevant age or developmental context; a short-lived, purpose-limited signal could then be securely recognised or relayed to a participating service, which would apply its own safeguards without receiving the child's name or identity document. The signal must be tied to the child's actual session, not merely a household connection, and must not become a common identifier that allows services to track the child. Shared devices, adult accounts and signed-out use still need explicit solutions. This concept requires testing and would not replace effective service design, regulatory duties or independent oversight.
- Design safeguards around developmental needs and evolving autonomy rather than a single under-18 setting.
- Require services to prove that protective defaults and wellbeing measures work in practice.
- Test whether interoperable, data-minimising assurance can help safeguards follow a child across participating services and network environments, while preventing cross-service tracking.
- Preserve beneficial digital opportunities and assess the unintended consequences of restrictions alongside their intended safety benefits.
The central question
How will services recognise the child behind an unchecked or inaccurate account, then provide appropriate protection without repeatedly exposing that child's identity?