EU KIDS Act

Overview

The EU KIDS Act proposes harmonised protection for minors online under Article 114 of the Treaty on the Functioning of the European Union. The Commission adopted the proposal, COM(2026) 681 final, on 17 September 2026 under ordinary legislative procedure 2026/0286(COD). Commission adoption is not enactment by Parliament and Council. Its 43 articles across nine chapters combine access restrictions, protective design, parental-responsibility verification, age assurance, national support and enforcement. The Commission feedback period closes on 3 December 2026 at midnight Brussels time.

Article 2 covers social networking, video-sharing, app stores, online games, operating systems, AI companions and general conversational chatbots accessible to minors. Digital-service providers fall within scope when serving recipients established or located in the Union, regardless of provider establishment; relevant AI systems are covered when placed on the Union market or put into service there. Exclusions encompass specified nonprofit reference resources, institution-operated educational services, certain open-source development platforms, exclusively scientific research systems and exclusively public-authority systems. The open-source exclusion does not apply where the platform itself is an AI system within scope. Duties vary by category: operating systems do not inherit every safety-by-design obligation.

Definitions

Article 3 defines a minor or child as a person under 18 and a guardian as a person holding parental responsibility under national law. An AI companion provides sustained, personalised interaction or companionship simulating or facilitating a social, emotional or interpersonal relationship. A general conversational chatbot directly interacts with users and assists across multiple domains and tasks. Specialised conversational functionality limited to a service, task or predefined functions is excluded, including customer-service, operational, technical-support, transactional, educational, information-retrieval and industrial applications. Relational functionality and broad conversational capability therefore provide distinct routes into scope.

Age assurance determines, estimates or verifies age and excludes self-declaration. Age verification establishes an age or threshold with high certainty using identification documents or other reliable verified identification sources. An age signal is a token, credential, attribute or information demonstrating an age, threshold or range. A proof-of-age attestation electronically authenticates that its holder meets an age condition. An EU age-verification solution requires public-authority certification under the EU Age Verification Scheme and inclusion in the Commission list following Member State notification. Other terms are incorporated from the DSA, DMA, AI Act and electronic-identification framework.

Governance and Institutional Framework

Article 34 applies DSA Chapter IV supervision to social networking services, video-sharing platforms, video gaming platforms and app stores. AI Act Chapter IX governs AI companions and general conversational chatbots, with the proposal's cross-reference to Chapters II, III and IV. Member States must empower their designated DSA and AI Act authorities. Standalone video games require a designated authority with DSA Article 51 powers; the authority at the provider's main establishment has exclusive supervisory and enforcement competence. Data protection authorities separately oversee personal-data processing, particularly under Articles 27–29. National decisions must not contradict Commission decisions under the regulation.

Applicable Commission DSA and AI Act powers extend to supervision, investigation, enforcement and monitoring. Article 36 establishes annual fees for each covered service or system under Commission supervision. Aggregate fees cover the preceding year's supervisory costs, including personnel, the age-verification scheme, enforcement and expertise. Each provider's fee is capped at 0.03% of preceding-year worldwide annual net income, rather than turnover; delegated acts establish methodology and payment arrangements. A Child Safety Committee assists with implementing acts. Commission and national authorities develop expertise and incident-response cooperation.

Account Access and AI Safeguards

Article 6 prohibits accounts below age 15 on social networking and video-sharing services with specified risk features: public real-time transmission, interaction beyond existing connections, profiling-based recommendations, recommendations outside subscriptions or connections, or uninterrupted-consumption and re-engagement designs. A derogation permits guardian-created limited accounts for minors described as above 13 and below 15. Guardian tools must remain activated, daily use cannot exceed one hour, and contacts require guardian pre-approval and limits. Article 7 permits specially designed video-sharing services to give children below 13 access only through a guardian's account, with no access below three. An impact assessment, age-adapted features, harmful-content exclusions and tightly restricted personalisation are required. These are conditional permissions, not access entitlements.

Article 14 requires AI companions and general conversational chatbots to prevent addictive designs and simulated relationships likely to create emotional dependency. It applies Article 9's general prohibition and time-limiting measures, Article 11 safe settings and Article 13 transaction safeguards. Information or analysis from prior interactions must not inform subsequent interactions by default, except where necessary for safety or those settings. Below-13 access must be enabled and controlled through guardian tools. State-of-the-art pre-market evaluation and testing must address health, safety, fundamental rights and physical, mental and emotional development, followed by safeguards. Post-market harm assessment and serious-incident response are required, except for micro and small enterprises. Embedded AI in social, video-sharing or gaming services must not auto-activate, receive prominent display or encourage minors' use; easy opt-out must remain available.

Safety Design and Service Implementation

Article 8 makes child-protective design the default, including accountless access, unless compliant age assurance establishes adulthood. Social and video-sharing services must prevent compulsive use, introduce meaningful interruptions and protect school time and core sleep hours. Recommenders must prioritise explicit preferences, disable implicit engagement-based recommendations by default, avoid off-service personal data and assess quality, safety and mental-health outcomes. Minors receive preference-reset tools and a nonprofiling option without manipulative steering. Geolocation, tracking, microphone, camera, contact synchronisation, account recommendations and push notifications are off by default. Changes require the specified age condition and informed explicit consent; location settings reset after sessions. Harmful social-comparison and image-distortion features are unavailable to minors.

Contact safeguards include prior approval, agreement to group entry, easy anonymous blocking, limited visibility, protection of contact details and restrictions on downloading or screenshotting minors' information or content. Transactions require clear real-time explanations and local-currency equivalents for purchasable virtual currency. Excessive-spending designs and variable reward systems are prohibited. Article 15 applies particular safeguards to games, including protection from diversion to risky external contacts and support for compliant user-created games. App stores must rate every application, publish rating methodology, prevent inappropriate access or purchases, respect higher legal age limits and admit certified EU age-verification solutions.

Articles 18–20 require understandable controls, durable effects from feedback, child-friendly reporting and support, and guardian tools respecting minors' privacy and agency. Tools must be age-tailored, secure and effective, and minors must be informed when they are used. Article 24 requires relevant non-EU providers to designate a representative or extend an existing qualifying DSA or AI Act mandate to support enforcement.

Monitoring, Audits and Evaluation

Article 5 requires designated very large social networking and video-sharing platforms to notify detailed compliance plans within four months of designation; already designated providers must do so within 30 days of application. Providers finance independent audits drawing on child rights, paediatrics, child psychiatry, developmental science, age assurance, interface and recommender design, and data protection and security expertise. Auditors receive relevant information and personnel access. Employees and contractors communicating with auditors must be protected from retaliation. Providers have 15 days to comment on a draft report. The final report reaches the Commission and provider simultaneously within two months of receipt of the plan, followed without undue delay by a public nonconfidential summary.

A Commission decision identifying shortcomings triggers a corrective plan within 30 days. Each measure must have an implementation period of no more than 60 days, verified by auditors. Neither an audit nor Commission inaction establishes compliance or restricts enforcement. Annual reporting and auditing integrate into DSA risk assessments and audits; Article 22 also requires VLOPs to monitor, test and evaluate safety measures. Article 14 retains separate AI pre-market and post-market duties, with its micro- and small-enterprise monitoring exception. Commission-assessed codes may demonstrate relevant AI or gaming compliance but do not confer blanket exemptions. Article 42 proposes a first review on the bracketed date 31 August 2030, assessing effectiveness, scope, internal-market outcomes and freedom of expression, with reports every four years.

Penalties, Complaints and Redress

Article 34 incorporates DSA enforcement for specified platform categories rather than a universal penalty schedule. Intentional or negligent breaches of covered AI-companion and chatbot duties attract AI Act Article 99 administrative fines of up to 6% of the undertaking's preceding-year worldwide annual turnover. Member States establish standalone video-game penalties using DSA Article 52. Data protection authorities may impose GDPR Article 83 fines within their competence, up to its Article 83(5) ceiling. These penalties are distinct from the supervisory fee's 0.03% net-income cap. The proposal does not establish a standalone general damages tariff.

Article 35 provides expedited Commission proceedings for designated VLOPs and AI systems under exclusive Commission supervision. The Commission must endeavour to communicate preliminary findings within the bracketed 30 working days and adopt a final decision within 90 working days after proceedings open; these are endeavour-based targets. Article 29 requires free electronic internal complaints about incorrect age-assurance outcomes. Article 19 requires prioritised handling of minors' reports and information on procedure and redress. Article 21 allows qualifying nonprofits to represent minors and guardians and complain to the competent authority where the recipient or user is located or established, or to the European AI Office for AI systems within its exclusive competence. Existing redress and representative-action rights remain preserved.

Relationship to Other EU Instruments

The proposal specifies and complements the Digital Services Act and complements the Artificial Intelligence Act. Article 2(6) deems qualifying social networking, video-sharing and video gaming platforms compliant with DSA Article 28(1) for covered matters when they comply with this regulation, including relevant AI functionalities. This is limited alignment, not a general DSA exemption. Under Article 8(3), only Chapter III Sections III, V and VI apply to AI companions or chatbots deployed as social-networking or video-sharing functionalities; AI-specific obligations remain relevant.

Article 2 preserves audiovisual-media, consumer-protection, product-safety, personal-data and other listed Union rules. Article 6 access restrictions operate alongside consent-based processing rules in Article 8 of the GDPR, not as their replacement. DMA definitions and relevant guardian-tool interoperability conditions are incorporated, while age attestations connect to the European Digital Identity Wallet framework. Article 41 proposes adding the instrument to Annex I of Directive (EU) 2020/1828 on representative actions. The explanatory memorandum places the proposal alongside BIK+, cyberbullying support and planned audiovisual-media and consumer-law work; those future initiatives remain distinct.

Age Assurance and International Alignment

Establishment-neutral scope harmonises cross-border provision to the Union. Article 31 establishes Union-wide mutual recognition of certified, listed EU age-verification solutions and proof-of-age attestations, not general recognition of third-country credentials. Article 29 requires a prescribed certified third-party solution for Article 6 account restrictions. Alternative assurance methods may serve designated safety-by-design and app-store purposes if they satisfy Articles 27 and 28. Article 32 allows the stated high-confidence exception for existing-account checks.

Age assurance must be accurate, reliable, secure, robust, nonintrusive and nondiscriminatory; every measure must use zero-knowledge proof. It must not identify, locate, track, target, advertise to or profile recipients. Strict minimisation and purpose limitation apply, with a narrow permission to retain an account-level threshold signal. Operating systems holding compliant age signals must enable sharing when required for compliance following user consent. Member States must provide accessible, free age-verification and parental-responsibility means, including alternatives for vulnerable families and people without standard documentation. The explanatory memorandum connects harmonisation to the Union's International Digital Strategy and global child-safety cooperation, without establishing a treaty or general external recognition regime.

Implementation Timeline

Sources and References