The EU KIDS Act: From moderation to mandatory design

What it means for product design, age assurance and data protection

On September 17, 2026, the European Commission (Commission) adopted its proposal for the EU KIDS Act (Keeping Internet Digital Spaces Accountable and Trustworthy), a new regulation aimed at strengthening the protection of minors online. It applies to the digital services and products children use every day: social media, video sharing platforms, online games, app stores and AI companions or chatbots.

Until now, the protection of minors online rested on a general legal obligation under existing EU law (notably Article 28 of the Digital Services Act (DSA)), fleshed out mainly through nonbinding European Commission guidelines that left considerable room for each platform’s own interpretation. The KIDS Act changes that starting point. It converts a defined set of design choices (how accounts are created, how notifications and recommender systems operate, as well as how AI chatbots are allowed to interact with a child) into specific legal requirements. Its reach is broad. It covers providers of social networks, video-sharing platforms, app stores, online games, operating systems, AI companions and general conversational chatbots accessible to minors, wherever they are established, as long as they offer their services to users in the EU or place their AI systems on the EU market.

There is no size threshold and small and micro enterprises are not exempted; only a closed list of low-risk services (such as not-for-profit encyclopedias, educational services and services run by public authorities) falls outside.

Nor does the KIDS Act start from a blank page. Sectors such as video games already operate under well-established self-regulatory codes, Pan-European Game Information (PEGI) age ratings among them and audiovisual content is subject to its own sectoral rules on the protection of minors, both of which the proposal builds on rather than replaces. That shift, from broad principle to specific obligation, is what matters most for those subject to the regulation, more than any individual age.

I. Why this matters beyond compliance

• The cost stops being purely legal and becomes a product cost – The safety by design rules in the proposal (limits on infinite scroll and reward mechanics, default settings for recommender systems, mandatory time and contact controls) are requirements about how a product is built, not policies written after the fact, and the largest platforms must prove compliance through independent audits. That moves the decision from the legal department to the product team and, with it, the question of who inside the organization actually owns the risk.
• Age verification becomes critical infrastructure and a data protection question –The regulation builds on the EU Digital Identity framework and the EU Age Verification Scheme, as well as requires every member state to offer at least one free, privacy preserving way to verify a user’s age. Simply asking a user to state their age is no longer enough to count as compliance. Verifying the age of every user, however, means processing data about adults and minors at scale. Providers will need a clear legal basis under the General Data Protection Regulation (GDPR), a data protection impact assessment and a solution that respects data minimization. To give an example, the Spanish data protection authority (AEPD) has already set out principles for age verification built on non-identification and non-traceability, which are a useful benchmark for the choices now to be made.
• Meeting the KIDS Act does not automatically mean meeting the DSA –Complying with the new rules is treated as sufficient for the matters they cover, but the proposal is explicit that this does not prove compliance with the DSA’s broader minor protection obligation as a whole, since some aspects, security among them, remain outside the KIDS Act altogether. A platform can therefore tick every KIDS Act box and still fall short under the wider DSA duty. That gap is worth mapping now, before an audit finds it first.
• This is still an open text, not a closed rule – The proposal has only just entered the ordinary legislative procedure before Parliament and the European Council. There is a real window to help shape the final wording, and providers who engage with that process now are in a better position than those who simply wait for a final version to comply with.

II. The main obligations, briefly

• Age-based access –The proposal sets three tiers for social networks and video sharing services. Below 13, no account at all, save that video platforms built specifically for young children may exceptionally allow access, but only through the guardian’s own account, never a separate one for the child. At 13 and 14, a guardian can set up a limited account on the minor’s behalf, capped at one hour of use a day, with guardian controls that must stay active at all times and new contacts requiring the guardian’s approval beforehand. From 15, the minor may open their own account. Note that this does not align with the age of digital consent under Article 8 GDPR, which Spain sets at 14: for the 13-14 tier, providers will need to work out who consents to which processing.
• Accounts that already exist – Providers have six months from the moment that the regulation starts applying to work out which existing account holders are under 15, and to disable any account that turns out to belong to a minor in that bracket, or whose age simply cannot be confirmed. In practice this is a large-scale automated exercise affecting adults as well as minors. Providers should plan for GDPR issues around automated decisions, what happens to the data of disabled accounts and complaints from adults wrongly caught.
• Safety built into the product – The proposal bans features designed to encourage compulsive or excessive use, and requires services to protect school hours and sleep time. Recommender systems must give priority to what a minor explicitly asks for, switch off recommendations based on implicit engagement signals by default and always offer at least one option that is not based on profiling. AI companions and chatbots come with a specific rule of their own. They must be designed so as not to foster emotional dependency in a minor.
• App stores as gatekeepers – Software application stores must run an age rating system and block minors from downloading apps rated as not appropriate for their age.
• Closer supervision for very large platforms – Platforms designated as very large online platforms must submit a compliance plan within four months of that designation, commission an independent audit whose final report is due within two months, and, if the Commission finds gaps, submit a corrective action plan within 30 days. Each corrective measure must then be implemented within a period set by the provider in that plan, which may not exceed 60 days. Importantly, none of this (not the audit or the commission’s silence on it) amounts to a formal finding that the platform is compliant.
• Enforcement – The proposal does not create a new enforcement system, it relies on the existing structures under the DSA and the AI Act, so the Commission supervises very large online platforms and national authorities supervise other providers. What changes is the pace. Where the Commission opens proceedings within its exclusive competence, it must communicate preliminary findings within 30 days and endeavors to adopt a final decision within 90 days.

III. Where the KIDS Act meets other rules

• GDPR – Age assurance, parental accounts and the review of existing accounts all involve processing personal data of children, who merit specific protection under the GDPR. The KIDS Act does not displace the GDPR. Both must be complied with at once, and data protection authorities will remain competent for the data side of these obligations.
• AI Act – The rule against AI companions fostering emotional dependency sits alongside the AI Act’s prohibition on AI systems that exploit vulnerabilities due to age (Article 5(1)(b)). Providers of chatbots used by minors will need to assess both.
• Consumer law and audiovisual rules – The ban on design features that encourage compulsive use overlaps with the Commission’s upcoming Digital Fairness Act on dark patterns and addictive design, and video sharing platforms remain subject to the Audiovisual Media Services Directive.
• National initiatives – The proposal also responds to a broader trend. Several member states, including Italy, France, Greece, Austria, Poland and Belgium, have notified draft laws restricting minors’ access to certain digital services, with age limits ranging from 13 to 16, and others, such as Spain with its draft Constitutional Law (Ley orgánica) on the protection of minors in digital environments, are moving in the same direction. The KIDS Act is expressly designed to replace these diverging national age limits with a single EU age, leaving room only for higher national minimum ages for specific content such as pornography or gambling. How pending national initiatives fit with the final text is likely to be one of the key questions for providers active across several member states.

IV. Next steps, and where the rule is heading

The proposal has been sent to national parliaments and now awaits the opinions of the European Economic and Social Committee and the Committee of the Regions. From there follows the ordinary legislative procedure: the European Parliament and the European Council each work out their own position, before negotiating a final version with the Commission. The text sets no date for when that process will conclude, so anything beyond this point is speculation, not fact.

Even before that negotiation begins, the direction of the proposal is clear. The Commission has chosen to turn what used to be guidance into binding, audited obligations, paired with an expedited enforcement procedure (preliminary findings within 30 days, a final decision targeted within 90 days) and built in review points from the outset. Whatever changes during negotiation, that underlying model (hard rules, independent audits and a faster enforcement clock) is unlikely to be negotiated away entirely. In practical terms, we suggest that affected companies:

• Map the services and features in scope (account creation, notifications, recommender systems and chatbots) against the proposal
• Run a gap analysis against Article 28 DSA and the Commission’s guidelines, since KIDS Act compliance will not cover everything
• Choose an age assurance solution and carry out the corresponding data protection impact assessment
• Assign ownership of the risk within product teams, with clear governance and reporting lines
• Consider engaging in the legislative process, through industry associations, the European Parliament rapporteurs or the member states’ permanent representations in Council

The proposal is at an early stage of the ordinary legislative procedure. The obligations described in this article reflect the text submitted by the Commission on September 17, 2026, and may change during negotiation.

A view from outside the EU: Colombia

The questions the KIDS Act tries to answer (at what age children should access social media, who verifies that age and how and how much of the burden falls on product design) are not unique to Europe. Legislators elsewhere are dealing with the same issues, often with different tools. Colombia offers a useful point of comparison.

The Colombian perspective

Colombia offers an interesting point of comparison because it is also incorporating the protection of minors into the design and operation of digital services. Law 2489 of 2025, regulated through Decree 769 of 2026, operates alongside the personal data protection regime established by Law 1581 of 2012. The framework covers telecommunications networks and services, digital platforms, applications, video games and AI systems accessible to minors in Colombia. A company should therefore assess its exposure even if its product is not deliberately aimed at children and adolescents. The applicable obligations vary depending on the service, the risk involved and the provider’s ability to address it. There are also specific exclusions for providers of content subject to editorial control.

For companies operating outside Colombia, it is necessary to examine the connection between their activities and the country. Law 1581 applies to personal data processing in Colombia and, in certain circumstances, to controllers and processors established abroad. There have been instances where the Colombian data protection authority (the Superintendencia de Industria y Comercio, or SIC) has asserted jurisdiction upon foreign entities. The mere accessibility of a service from Colombia however does not automatically make all obligations under local law applicable.

Companies should distinguish between access to a service, authorization to process personal data and age verification. Processing minors’ data must serve their best interests and respect their fundamental rights; parental consent does not suffice for all forms of processing. Age verification must be proportionate to risk and comply with data minimization. Decree 769 provides for privacy and security by design and by default, adaptable parental controls and features aimed at preventing compulsive use. In line with SIC rules, where AI involves personal data processing, risk management and privacy impact assessments are warranted.

Oversight is shared among authorities, including the Ministry of Information and Communication Technologies (Ministry of ICT) and the SIC, and breaches can lead to fines. For companies adapting their products to the European framework, this work offers an opportunity to review their operations in Colombia as well.

The Colombian perspective was contributed by Juan Nicolás Laverde, founder of Astra Legal, a Bogotá-based boutique advising on legal and regulatory matters across telecoms, media and tech. Its practice includes commercial and tech advisory, regulatory compliance and strategy and market entry and expansion, including matters involving connectivity, satellite services and digital platforms.

Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only, and is not intended to constitute or be relied upon as legal advice.