The EU KIDS Act: is your service already safe for children?

The internet is a dangerous place for minors. Cyberbullying, grooming, sleep disorders, anxiety, depression and eating disorders are just a handful of the harms linked to online services. Only half of children between the ages of 9 and 16 feel safe online. These concerns have driven new EU legislation: the Keeping Internet Digital Spaces Accountable and Trustworthy Regulation (the "KIDS Act"). Despite its American ring, this regulation is a European initiative designed to protect minors from the many risks the internet presents, including addictive design patterns, contact with strangers, and inappropriate content.

The draft consultation version of the KIDS Act was published last September. The proposal is broad in scope, its requirements are stringent, and fines can reach up to 6% of global annual turnover.

For now, it remains a consultation draft, open for responses until 3 December. This makes it the ideal moment to get up to speed with the KIDS Act before the final version lands and brings a raft of new obligations with it. You can still submit a response and influence the final text. This blog sets out the key provisions so you know what to expect.

Who does the KIDS Act apply to?

The KIDS Act builds on obligations already imposed on platforms under the Digital Services Act (DSA), in particular Article 28. That article requires online platform providers to ensure a high level of privacy, safety, and protection for minors. The KIDS Act elaborates on those obligations in detail.

Seven specific types of regulated service fall within its scope:

• Online social networking services

• Video-sharing platform services

• Software application stores

• Online games

• Operating systems

• AI companions

• General conversational chatbots

The Act distinguishes between three age groups: minors under 13, minors between 13 and 15, and minors between 15 and 18. Stricter rules apply to younger children.

General principles

Before looking at the service-specific rules, it is worth understanding the three general principles that apply whenever your service falls within the scope of the KIDS Act.

First, regulated services must implement independent EU age verification before a user can create an account. This verification must be accurate, reliable, secure, robust, non-intrusive, non-discriminatory, and must provide privacy and data protection. Simply ticking a box or entering a date of birth is no longer sufficient.

Age verification must be based on identity documents or other verified identification sources, such as the forthcoming EU digital wallet. The precise requirements vary by service type. The European Commission will establish a list of recognised age-verification providers and may issue guidelines to clarify what compliant verification looks like in practice.

Second, providers of regulated services must offer guardian tools, enabling parents and guardians to restrict the use of a service and its associated features. In addition, reporting buttons for inappropriate content or unwanted contact must be genuinely comprehensible and accessible to minors.

Third, regulated services must apply the principles of privacy by design and safety by design. In practice, this means that minors' accounts are set by default to the most privacy-friendly and safest settings. Under the current draft, this includes disabling chat with strangers, turning off geolocation, and setting profiles to private by default.

Service-specific rules

Because a software application store operates very differently from a video game or a general conversational chatbot, the KIDS Act supplements the general obligations with requirements tailored to each service type. Below is an overview of the key obligations per category.

Online social networking services

An online social networking service can be summarised as a platform that enables end users to connect and communicate with one another across multiple devices, share content, and discover content created by others. This covers platforms such as Instagram, Snapchat, and TikTok.

Under the KIDS Act, online social networking services must observe a minimum age requirement. In its current form, the Act prohibits minors under 13 from creating a social media account.

For minors between 13 and 15, accounts on most online social networking services may only be created by a parent or guardian. This rule does not apply where the service poses no risk to the child. Under the KIDS Act, an online social networking service is considered risk-free for minors if it does not include any of the following features:

• Live streaming

• Communication with third parties

• Profiling-based recommendation systems

• Friend suggestions

• Continuous content consumption features

• Engagement-stimulating interactions

• Automated notifications encouraging (repeated) use of the service

Accounts created for minors between 13 and 15 must also be equipped with guardian tools, including:

• Screen time limits

• Prior guardian approval for new contacts

• Control over privacy settings such as geolocation, camera, microphone, contact synchronisation, and push notifications

Privacy by design and safety by design for online social networking services means, among other things, a non-profiling feed, no infinite scrolling or autoplay, and geolocation, camera, microphone, contact synchronisation, and push notifications all turned off by default. These features may only be enabled by a guardian through the dedicated guardian tools.

Minors between 15 and 18 are permitted to create their own accounts, but privacy and safety by design remain the default. Any deviation from those defaults should be a deliberate choice made by the minor themselves.

Video-sharing platform services

A video-sharing platform service is a service whose primary purpose is to offer programmes and/or user-generated videos to the general public, where the platform bears no editorial responsibility for the content. This covers services such as YouTube, Twitch, and Kik.

Minors under 13 may not create an account on a video-sharing platform service. However, they may use platforms specifically designed for minors through a parent or guardian's account. This possibility must be explicitly set out in the terms and conditions, including the minimum age for access. Providers must also produce and publish an assessment of the risks the platform poses to minors and the measures taken to mitigate them.

For minors under 13, use of the service is capped at one hour per day. All personalisation features, recommendation systems, and search functionality must be disabled by default and may only be enabled where the risk assessment shows this is in the minor's interest and has no adverse effect on their privacy, safety, or security.

Here too, privacy by design and safety by design are the guiding principles: no infinite scrolling, no streak rewards, and no algorithmic recommendation systems.

Software application stores

A software application store is an online intermediary service focused on providing software applications as a product or service. Think of the Google Play Store, the Apple App Store, or Steam.

Under the KIDS Act, software application stores take on a gatekeeping role. They are required to introduce an age-classification system in which apps are categorised according to the age groups for which they are suitable. Software application stores must ensure that minors are not shown applications that are not appropriate for their age. This also applies to applications subject to a statutory age restriction, such as gambling, alcohol, or investment applications.

Operating systems

An operating system is software that controls the basic functions of hardware or software. Examples include Microsoft Windows, Android, and iOS. Operating systems also take on a gatekeeping role under the KIDS Act. They must provide a secure and privacy-friendly default environment for minors' accounts and must facilitate device-level interoperability with age-verification applications.

Online games

The KIDS Act divides online games into two sub-categories: video games and video game platforms. The definition of a video game is broad under the Act and covers, in essence, any electronic simulated environment for play or entertainment purposes. This includes games such as Call of Duty, Fortnite, and Candy Crush. Video game platforms include services like Roblox and Minecraft, where users can build environments and others can play within them.

Safety and privacy by design in online games means, among other things, that chat with strangers is off by default, that daily rewards are absent so as not to encourage excessive use, and that minors are not drawn into unsafe environments.

AI companions and general conversational chatbots

Finally, the KIDS Act addresses a category that barely existed four years ago but has since become a fixture in the lives of many minors (and adults): AI companions and general conversational chatbots. The risks these systems pose to minors are still largely unknown, but the EU is not waiting to find out.

A general conversational chatbot can be described as a general-purpose AI system with conversational functionality designed for direct interaction with users. Examples include ChatGPT, Claude, and Grok. An AI companion is a chatbot that provides ongoing, personalised interaction or companionship, simulating or facilitating a social, emotional, or interpersonal relationship with the user. Examples include Replika, Character.ai, and Snapchat's MyAI.

Minors under 13 may only access these AI systems under the direct supervision of a guardian. Minors aged 13 and over must be protected against emotional dependency on the chatbot. Data from previous conversations may not be used, and the chatbot must be off by default when integrated into an online social networking service or online game.

Providers of an AI companion or general conversational chatbot must carry out a risk assessment mapping the impact of the AI system on the mental health and development of minors. This assessment must be completed before the system is placed on the market.

What can you do now?

Although the KIDS Act may feel like a distant prospect, there are concrete steps you can take today. Organisations that treat these obligations as a box-ticking exercise risk falling behind. Acting now avoids costly last-minute redesigns and helps build trust with parents and users alike.

A good starting point is to identify which features of your service fall within the scope of the KIDS Act. From there, determine what changes are needed to bring those services into compliance. Update your software development process so that all future changes and new services are compliant from the outset. Review your services periodically to ensure ongoing compliance. It is also worth investigating how your platform can connect to the recognised EU age-attestation systems in the future: implementation takes considerable time and effort, so waiting until the last moment risks missing the deadline. Finally, raise awareness within your organisation. This helps you spot deviations early, act more quickly, and reduce both the likelihood and the impact of non-compliance.

Closing thoughts

The consultation draft of the KIDS Act leaves no room for doubt: the European Union is making the safety of minors' digital world a priority. For providers of digital services, this means that child safety is no longer an optional feature but a core element of how services are built.

Do you have questions about what the KIDS Act means for your app, platform, or game? Or would you like support with carrying out an impact assessment? We are happy to think it through with you.