On 17 September 2026, the European Commission published a proposal for a new EU Regulation titled the 'EU KIDS ACT – EU Keeping Internet Digital Spaces Accountable and Trustworthy'. 

The proposal represents one of the most significant and wide-ranging EU legislative interventions targeting the online safety of children to date, introducing harmonised obligations across the EU on a broad set of digital services.

At a glance

• The EU KIDS Act introduces EU-wide child safety obligations for social media platforms, video-sharing services, online games, AI companions and more. 
• Four core pillars: social media age restrictions, safety-by-design, age assurance and enforcement. 
• Non-EU platforms and AI providers may be caught in the proposed new rules. 
• The EU KIDS Act builds on and complements existing digital regulatory frameworks including the Digital Services Act (DSA) and EU AI Act. 

Background 

The Commission frames the initiative as a response to substantial online risks to minors' health, development and wellbeing, including: cyberbullying, child sexual abuse, grooming, and the mental and physical health impacts of excessive or harmful digital engagement. The Commission President, Ursula von der Leyen, emphasised that technology was not created with children’s wellbeing in mind. 

The proposal follows recommendations from a Special Panel on Child Safety Online and is intended to establish EU-wide access restrictions, safety-by-design rules, and proportionate privacy-preserving age assurance, with coverage extending beyond just social media platforms to a range of other services (as further detailed below). 

A key driver is also the growing patchwork of Member State initiatives on age restrictions, with varying scope and age limits, the proposal seeks to harmonise diverging national rules to ensure uniform protection of children across the EU. 

Who will be impacted? 

The 4 Pillars of the EU KIDS Act

The Act has four key pillars:

1. Social media delay

Pillar one introduces a gradual uptake of social media and video-sharing platforms, with an EU-wide minimum age of 15 for minors to create autonomous accounts. 

2. Safety-by-design requirements 

Pillar two introduces wide-ranging safety-by-design requirements. Providers must apply these protections by default and may only derogate once they have established the user is an adult using compliant age assurance. 

Key obligations include:

• Addictive design and time management: Providers must not design their services in a way that encourages compulsive or excessive use and should ensure time-limited access and interruption of usage in ways that protect school time and core sleep hours for minors. 
• Recommender systems: Providers must prioritise explicit preferences, disable by default recommendations based on implicit engagement signals for minors, and offer tools to control or reset preferences and choose at least one non-profiling option. 
• Default safe settings: Geolocation/tracking, microphone/camera access, account recommendations, contact sync and push notifications must be switched off by default for minors, and certain harmful features must be made unavailable to them. 
• Contact and interaction safeguards: Providers must limit the ability to initiate direct contact with minors, apply default limits on visibility of minors' information and content, and disable livestreaming by default for minors. 
• Economic transactions: Providers must clearly disclose that a transaction is taking place, display the real-money value, and prohibit design patterns that lead to excessive, impulsive or unwanted spending and exposure to variable reward systems for minors. 

3. Age assurance framework

Age assurance is a core focus of the new proposal. Pillar three establishes a dedicated age assurance framework, requiring the implementation of age assurance solutions to be accurate, reliable, robust, non-intrusive, privacy-preserving and non-discriminatory, with specific data-protection constraints. Self-declaration is explicitly stated to be insufficient for compliance purposes. 

The data protection constraints are significant. Providers must not enable identification of the recipient or locate, track, target, advertise to, or profile users. Providers must also not process more personal data than strictly necessary to determine whether an age threshold has been met, and must not further process, share, or combine that data.

Where the delayed access rules apply (i.e., the rules that apply to under 15s) providers must rely exclusively on a certified EU age verification solution using an EU proof of age attestation supplied by a certified third party and listed on Commission-maintained EU lists. For safety-by-design and app-store obligations, providers may use alternative age assurance solutions, provided they can demonstrate compliance with the same substantive quality and data protection requirements.

Providers must verify the age of users opening an account, as well as the age of users who already have an account once the rules enter into force. 

4. Enforcement and interaction with existing EU Digital Regulatory Architecture 

Pillar four, does not create an entirely new enforcement regime. Instead, it builds on and complements the existing frameworks under the DSA and the EU AI Act, while introducing targeted additions.

Member States must ensure that authorities already designated under DSA, Article 49 and EU AI Act, Articles 70 and 74 are competent to supervise and enforce the Act for providers within their remit, and Member State authorities may not adopt decisions that contradict a decision of the EU Commission.

Whilst the Act is intended to sit alongside and supplement various other EU digital regulatory instruments, none of those instruments were designed with children’s online safety specifically in mind, despite containing provisions targeted at children’s safety and experiences online. The DSA imposes certain child safety obligations, most notably Article 28, which requires online platforms accessible to minors to put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security for minors on their service.

The Audiovisual Media Services Directive (AVMSD), similarly requires video-sharing platform providers to take appropriate measures to protect minors from harmful content. In Ireland, Coimisiún na Meán has further operationalised these obligations under the AVMSD through its Online Safety Code, which came into effect in 2024 and imposes binding rules on designated online services regarding the protection of children from harmful online content. However, the European Commission has concluded that these existing measures, while important, are insufficient to adequately protect children in the digital environment. The EU KIDS Act seeks to bridge that gap.

Why is this important to businesses now?

Whilst the proposal remains subject to negotiation, the direction of travel is clear. The EU KIDS Act reflects a growing international consensus that stronger protections for children online are needed. Similar initiatives have already been introduced in the United Kingdom, Australia and France, signalling that regulatory action in this space is accelerating globally.

If you are an online business, offering one of the services listed above, and that service is accessible by children in the EU there is a high likelihood that you may be caught by a raft of new rules and obligations in the not-so-distant future. Readiness is therefore key, particularly as businesses must audit existing services within six months of the Act applying. Some practical steps that businesses can begin considering now include: 

• Data mapping existing services against the 4 pillars detailed in the Act. 
• Reviewing age assurance mechanisms particularly where businesses are currently relying on self-declaration which the Commission has explicitly stated is insufficient. 
• Assess safety-by-design requirements across existing products and services. The obligations are extensive and amending product design and underlying systems takes time.  

Timeline and next steps

The Commission is currently inviting feedback from children, parents, guardians, teachers and educators as well as online platforms covered by the proposal. The feedback period closes on 26 November 2026. The proposal will then be subject to the ordinary legislative procedure meaning it will now be negotiated between the European Parliament and the Council of the EU before it can be adopted. The timeline for adoption will therefore depend on the pace of those negotiations. It is worth noting, however, that the proposal contains a built-in application timetable. The Act will enter into force 20 days after publication in the Official Journal and will apply from six months after entry into force.

lf this is something you would like to discuss further, we would be delighted to hear from you. Please do not hesitate to get in touch with our Data, privacy and cybersecurity team to see how we can help.