The European Commission has taken a significant step towards enhancing child online safety by formally adopting the proposed EU KIDS Act. This landmark legislation aims to set a new standard for protecting minors in the digital realm across the entire European Union.
Key Protections for Young Digital Citizens
A central tenet of the EU KIDS Act is the prohibition of social media platforms from allowing access to children under the age of 13. Furthermore, the act establishes a minimum age of 15 for establishing an independent account on social media services throughout the EU, introducing a tiered approach to online access for minors.
In a pivotal shift, the burden of proof is now inverted. Service providers will be required to demonstrate that their products are designed with age-appropriateness and safety as core features from the outset.
“Our children are using the most advanced technologies ever created. Yet, when these technologies were first developed, the well-being of children was not taken into account. The EU KIDS Act inverts the burden of proof: it is up to the platforms to prove that their products are safe by design. At the same time, we are giving power back to parents, providing them with tools to help their children explore the digital world more safely,” stated European Commission President Ursula von der Leyen.
Four Pillars of the EU KIDS Act
1. Delayed Social Media Access Mechanism
Under the proposed act, children must be at least 15 years old to create their own independent social media accounts. For children aged 13 to 14, a parental control mode will be mandatory. Guardians can set up sub-accounts, allowing these children to log in and use suitable social media and video-sharing platforms under parental supervision. These sub-accounts will feature built-in safety measures, such as limiting the number of contacts and capping daily usage to one hour.
Children younger than 13, but older than three, will be prohibited from using social media directly. However, they may access child-oriented video-sharing services through accounts managed by their guardians. Platforms must provide simple tools for parents to restrict device usage to these child-specific services and set a daily usage limit of one hour when a device is shared.
2. Safety by Design Principles
The EU KIDS Act imposes several mandatory obligations on all online services, including social media, video-sharing platforms, online games, AI companion programs, and AI chatbots, that cater to users under 18. Prohibited features include those designed to be addictive, recommendation feeds based on user profiling that could lead minors into harmful content, infinite scrolling, reward mechanisms, push notifications during sleep hours, and unsolicited contact from strangers.
AI companion programs and chatbots must be in a default off-state and cannot simulate interpersonal relationships to foster emotional dependency. Personal profiles for minors will be set to private by default, with location, camera, and microphone permissions turned off. Online services must also provide easy-to-use blocking and reporting functions for minors, effective time management tools, and adjustable safety recommendation systems.
3. Privacy-Conscious Age Verification
Online services and app stores will be required to implement age verification tools. The EU is developing its own age verification application that aims for the highest level of privacy protection by not retaining identity documents or biometric data. Member states will play an active role in building this ecosystem.
Social media and video-sharing platforms must conduct age verification when users create new accounts. For existing accounts, service providers will need to estimate user age using reasonable indirect indicators, such as account registration dates and credit card information.
4. Robust Enforcement and Oversight
The inversion of the burden of proof places the onus on very large online platform operators to prove their services are safe by design. These platforms will be obligated to submit compliance plans to the European Commission and independent auditors. Independent auditors will thoroughly assess new services and features. If compliance plans are found to be deficient, the Commission can demand corrective measures.
This regulatory framework builds upon the existing Digital Services Act and the AI Act, leveraging established mechanisms and resources. The proposal includes accelerated procedures for dealing with non-compliant platforms, with investigations into violations expected to be completed within 90 days.
Next Steps
The legislative proposal has now been submitted to the European Parliament and the Council of the EU for deliberation and voting. Given the urgent need for comprehensive child protection measures at the EU level, the legislative process is expected to be expedited.
