On 17 September 2026 the European Commission published its proposal for the EU Keeping Internet Digital Spaces Accountable and Trustworthy Act – the KIDS Act.
This is a proposal, not law yet. It still has to go through the European Parliament and the Council, so the final rules may change. But the overall direction is clear enough for companies to start preparing, as some of the required changes will also take longer to build than the legislation itself may take to pass.
Who it applies to
The proposal covers a broad range of digital services, including social networking services, video-sharing platforms, online games, AI companions and general-purpose chatbots. It also introduces specific obligations for app stores and other parts of the digital ecosystem.
Some of the AI categories are new or broader than those found in existing regulation. The proposal specifically addresses “AI companions”, which are systems designed to provide sustained, personalised interaction that simulates or facilitates a social, emotional or interpersonal relationship. Features that maintain a personalised interaction over time may therefore be relevant when assessing whether a service falls within this category. For example, if you ship a consumer-facing assistant, assume you are in scope until advised otherwise.
Similarly, some of the exemptions are narrower. Not-for-profit encyclopaedias, educational and scientific repositories, services run by educational establishments, open-source platforms and public authority services are currently out of scope, while small and micro enterprises are in.
Age rules
The proposed rules apply to social networking and video-sharing services that include certain features considered particularly relevant to risks for minors. These include allowing contact from people outside a user’s existing connections, recommender systems based on profiling, infinite scrolling or other design features intended to prolong engagement, notifications designed to bring users back to the service, and live broadcasting to an undefined audience.
Where those are present:
Under 13: children would generally not be permitted to create or maintain their own accounts on covered services. Services specifically designed for young children may provide access through a parent’s account, subject to additional safeguards, including limits on personalisation and recommender systems, a daily one-hour time limit and parental controls.
Ages 13 and 14: access would be subject to parental involvement. A parent or guardian would be required to establish the account and retain control over it. The proposed safeguards include a one-hour daily limit, restrictions on who can contact the child and parental controls. Providers would also need to verify that the adult exercising parental control has parental responsibility.
Ages 15 and over: users would be permitted to hold their own accounts, but the proposed safety-by-design requirements would continue to apply.
The proposal would establish these age thresholds at EU level rather than leaving Member States free to set higher minimum ages. That is intended to create a common EU framework rather than a patchwork of national age thresholds.
The proposal also contains transitional measures for existing accounts. Within six months after the relevant provisions begin to apply, providers would have to identify accounts belonging to users under 15 and take the measures required by the legislation, including disabling accounts where appropriate. The proposal also addresses cases where a provider cannot establish a user’s age. Where a provider already holds sufficiently reliable age information or an age estimate based on information or signals already available to it, the proposal contemplates using that information rather than requiring the user to undergo a new age-verification process in every case.
Age checks
For services subject to the proposed access restrictions, self-declaration would not be sufficient. The proposal would require stronger age-assurance measures, with specific requirements for the services covered by the EU-level age restrictions.
The Commission proposes a European approach based on privacy-preserving age verification, which would allow a service to establish that a user has reached a particular age threshold without receiving unnecessary identity information. The Commission has also proposed a free EU age-verification solution, with the European Digital Identity Wallet expected to provide an additional route as the EU digital identity framework develops.
For services outside the specific access restrictions, the proposal allows other age-assurance approaches, provided that they meet the relevant requirements for accuracy, reliability, security, proportionality and privacy. Businesses should therefore assess the method they use against the requirements that ultimately apply to their service rather than assuming that one technology will be appropriate in every case.
Potential changes to product/service design
The proposal could require significant changes to products and services that are within scope, particularly where they contain features that may encourage excessive engagement or expose children to inappropriate contact or content.
1) Addictive or engagement-driven design. Restrictions on features such as infinite scrolling, autoplay, engagement-driven notifications and other design mechanisms that encourage prolonged use. The proposal also addresses streaks and rewards associated with broadcasting or engagement, and time-management tools that would need to take account of children’s school and sleep schedules.
2) Recommender systems. Additional safeguards around recommender systems used by minors, including restrictions on profiling-based personalisation and requirements for safer alternatives. Businesses should assess what data their recommendation systems use, whether data from outside the service feeds into recommendations, and whether users can easily reset or change their feed.
3) Default settings. Review whether camera and microphone access, geolocation, tracking and push notifications are enabled by default for minors and whether the proposed rules require safer defaults.
4) Contact and communications. Address the risks associated with contact from strangers and unwanted group invitations, group-joining, blocking and livestreaming functions against the proposed requirements.
5) Purchases. Safeguards intended to reduce risks from unwanted or impulsive purchases by minors, purchasing flows, payment controls and parental-control mechanisms.
Companies should begin with a scope assessment
First, determine whether the service falls within the categories covered by the proposal and whether it has any of the features that trigger additional obligations. This is particularly important for businesses that have recently added an AI assistant, chatbot, recommendation system or social functionality to an existing product.
Second, map the product’s features against the proposed requirements. For social networking and video-sharing services, particular attention should be paid to recommender systems, contact from strangers, engagement-driven design, notifications, livestreaming and group functionality.
Third, start assessing age-assurance options. The proposed EU framework is still being developed, so businesses should monitor the certification and implementation arrangements rather than assuming that a particular provider or technology will ultimately satisfy the final requirements.
Fourth, review recommender systems and default settings. These changes may involve substantial product and engineering work, particularly where recommendation logic, data architecture or core product defaults need to be redesigned.
Next steps
The KIDS Act is only a proposal. The text can still change as it goes through the EU legislative process. But some of the proposed requirements — changes to recommender systems, default settings, age assurance and product design — would take real engineering and procurement work to deliver. That work takes time. So if you might be in scope, treat the proposal as a planning document now. Keep tracking the negotiations, and adjust your plans as the final requirements become clear.
If you would like to discuss how the KIDS Act affects your services, get in touch with us.
Image by Freepik.
