What does the EU's new KIDS Act mean for businesses?

Last week, the European Commission published the KIDS Act, the most ambitious piece of child safety regulation the EU has produced to date. It introduces a minimum age of 15 for most social media accounts and bans “addictive design” features that keep young users scrolling. But while this “social media ban” has grabbed many a headline, the KIDS Act sets out a political vision for a childproofed digital world – in which every player will be held accountable for the risks they pose to younger users. 

AI chatbots, video-sharing platforms, app stores and online games would all be captured by new age restrictions and safe design requirements. Obligations on recommender systems and transparent pricing practices could raise questions for ecommerce operators. This all makes the KIDS Act relevant for a much wider range of businesses in the online ecosystem and their ability to operate in Europe.

Why this, why now? 

European Commission President Ursula von der Leyen has made child safety online a flagship cause of her second mandate. She has done so in direct response to pressure from European capitals. In recent years, countries including France, Denmark, Spain and Greece have promoted increasingly ambitious initiatives at home to protect children online while calling for complementary EU-level action. Notably, French President Emmanuel Macron has long called for an EU-wide “digital age of majority” and nearly succeeded in writing this into French law. 

The KIDS Act is the Commission’s attempt to deliver a strong political response and pre-empt fragmentation at national level. Its gradual approach to age restrictions builds on the recommendations of a “Special Panel”, convened by von der Leyen earlier in the year. At the same time, it introduces different rules for different types of platforms and services - a lesson learned from national experiences, as it directly responds to the decision of France’s Constitutional Council last month. The Court found the blanket approach of the French digital majority bill to be disproportionate. 

Safety by design 

The KIDS Act’s flagship measure is a default age floor of 15 for independent account creation on social media and video-sharing platforms. Guardians are able to set up limited-feature accounts for 13- to 15-year-olds, which would only be accessible for one hour a day. Under-13s would only be allowed on video-sharing platforms specially designed for children, and once again only for one hour a day. Access is to be policed through strict age assurance and extensive parental controls.   

This architecture is embedded in a ‘safety by design’ principle requiring all platforms in scope to provide a child-proof experience by default – and until such time as they can determine that the user is not a minor. The shift of the burden of proof reinforces the Commission’s position that it is up to online platforms to prove that they are safe for children if they wish to continue operating in the EU.  

Different platforms, different rules 

The scope of services covered by the KIDS Act closely follows the "social media+" definition coined by the Commission's Special Panel. Very limited exemptions apply, including to not-for-profit encyclopaedias, educational and R&D platforms. The Commission also reserves the right to extend this scope of the legislation further in response to technological developments. 

For social media and video-sharing platforms, the law bans “addictive” design features, including unrestricted auto-play or “reward” features for engagement. It also prohibits certain image filters and livestreaming, while introducing new transparency obligations around pricing in virtual currencies. These platforms would also have to remain blocked for child users during school and sleep hours set by their guardian – the latter defined as a minimum of eight hours. 

AI companions and chatbots would be subject to similar addictive design and safe design restrictions to prevent “emotional dependencies”. They will be required to conduct risk assessments prior to being placed on the market, echoing requirements already introduced with the EU AI Act.  

Video games and app stores are also in scope, though the Commission acknowledges that they pose a lower level of risk and proposes a co-regulatory approach. They would be subject to similar safe design restrictions and parental control requirements to social media, but the exact rules for video games and app stores are to be set out in a code of conduct within 12 months of the KIDS Act becoming law. The Commission insists that app stores’ introduction of age verification does not let other providers off their own KIDS Act obligations.  

A new bar for age verification 

The proposal codifies the principle that self-declaration will not be sufficient to ensure compliance. Providers are instead required to verify age through a certified EU age verification solution, an EU proof-of-age attestation, or an EU Digital Identity Wallet.  

All age verification is to be based on zero-knowledge proof designs to ensure GDPR-compliance. However, to ease interoperability, operating systems holding a valid age signal will have to share it with other providers, so long as the user consents. 

The new obligations extend to verifying the identity of child users’ guardians. The KIDS Act requires that every Member State offer at least one free, privacy-preserving way for guardians to establish parental responsibility with the platforms in scope. These are to be based on official records (e.g. birth certificates or education records) or, temporarily, self-declaration by adults while more appropriate solutions are developed. 

Larger platforms are singled out 

As well as distinguishing between types of platforms, the KIDS Act is the latest example of EU ‘asymmetric’ regulation, affording special attention to large tech companies. Very Large Online Platforms (VLOPs) designated under the Digital Services Act (DSA) will have to submit independently audited compliance plans within tight deadlines. They will have to make their parental control tools interoperable with third-party tools, potentially creating a new market for such products in the EU. 

These very large platforms will also be subject to a new supervisory fee – on top of their existing DSA fee, which has already seen repeated litigation before the EU Court of Justice. 

Regulatory overlaps could complicate compliance 

The KIDS Act presents obvious overlaps with the DSA, the AI Act and the GDPR frameworks which will need to be addressed. Compliance with its obligations is folded into these existing laws, notably DSA Article 28, which already created child protection obligations for online platforms.  

Clearing up these overlaps could prove politically challenging. The KIDS Act’s restrictions on recommender systems and personalisation echo tense debates during the DSA legislative process. Similarly, the requirements for providers to 

conduct risk assessments prior to placing AI products on the market could give EU legislators the opportunity to relitigate a major point of contention during the design of 

the AI Act.  

The Commission will justify these measures as urgently needed and child-specific, but they raise questions about the EU’s ability to provide regulatory certainty for businesses – and to stick to its commitment to regulatory simplification. 

The way forward 

The Commission intends for the KIDS Act to set an EU-wide approach, which leaves ongoing initiatives by national governments in doubt. Most Member States are supportive of EU-level action and of waiting for the KIDS Act to become law – only Estonia has publicly opposed the initiative. But some, like France and Cyprus, have tabled new child protection bills since the KIDS Act announcement, intended to progress in parallel. This could raise significant compliance and legal certainty questions for affected businesses as the KIDS Act takes shape – and put the Commission’s promises for ‘regulatory simplification’ to the test. 

There is also the issue of the KIDS Act’s interplay with the Digital Fairness Act (DFA). Due to be tabled in the coming months, the DFA has been trailed by the Commission as the EU initiative set to regulate “addictive design”, unfair personalisation and virtual currencies. The DFA is intended to apply to most businesses and all online consumers, not just the experience of minors on the largest online platforms. 

The KIDS Act’s safe design obligations could therefore provide some early indication as to the direction that will be taken for ecommerce and online consumer protection under the DFA. Businesses selling products online in the EU might find “safety by design” scrutiny extended to a much wider set of practices and user experiences as a result.  

This blog was written by Miro Guzzini, Associate Director, and Sara Fornasiero, Manager, who both have extensive experience advising Flint’s clients on EU tech developments. Flint Global has exceptional people in Brussels, London and across Europe able to help clients navigate the continuously expanding tech regulation environment and achieve their commercial objectives.  

To find out more about how Flint can help you navigate and understand EU digital regulation, advise on the risks and opportunities of these developments, and support your investments, get in touch.