The European Commission recently proposed the EU KIDS Act, which would combine age limits for certain social media accounts with online safety requirements. If adopted, most rules would apply six months after entry into force, which would occur 20 days after Official Journal publication. Some provisions have separate timelines. Enforcement would fall under the Digital Services Act and EU AI Act frameworks, with separate data-protection oversight.
The proposed Act would cover social networks, video-sharing platforms, online games, app stores, operating systems, AI companions, and general conversational chatbots accessible to children under 18. It would apply to non-EU companies that provide these services to users in the EU or place covered AI systems on the EU market or put them into service there. Exemptions include nonprofit online encyclopedias and certain educational, research, and public-authority services.
The Act would set special account rules for social networks and video-sharing services with certain higher-risk features, including contact with strangers, recommendations based on profiling, and design choices that encourage excessive use.
Children 15 and older could create their own account without parental involvement. For children aged 13 and 14, a parent or guardian could create a limited account. Parental controls would always be active, letting guardians approve contacts and set daily use limits of no more than one hour. Children aged 3 to 12 could use video-sharing services designed for young audiences, but only through a parent or guardian’s own account. Providers would need to publish a safety assessment, block harmful or age-inappropriate content, enable parental controls, and limit daily use to one hour.
Safety-by-design rules would also apply to use without an account, unless the provider establishes through age assurance that the user is an adult. Social networks and video-sharing platforms would need to offer regular breaks and default to disabling location tracking, camera and microphone access, and push notifications. Platforms would also need to block unsolicited direct contact and let children reset recommendations and choose a feed that does not rely on profiling.
AI companions and general conversational chatbots would need to avoid designs that encourage emotional dependency and complete safety testing before launch. Online games would face rules for contacts, settings, and parental controls. App stores would need to assign age ratings and prevent children from accessing or purchasing apps that are not appropriate for their age.
Account age checks would require certified third-party EU age-verification tools. Other methods meeting the proposal’s standards could support safety-by-design and app-store obligations. Age-assurance tools could not identify, track, or profile users. Existing accounts would generally require age checks unless providers could establish the required minimum age with high confidence.
Putting it Into Practice. While we wait to see what is next with the EU KIDS Act proposal, product teams may want to start now in examining account-opening controls and protections for logged-out use. This is one of many laws we are seeing in the children’s space around the globe, and we expect to see more proposed, if not in 2026, then in 2027.