European Commission proposes common age-verification system and stricter safety-by-design rules as part of the EU KIDS Act

The European Union is moving towards a common framework for protecting children and teenagers online, combining age verification with restrictions on social-media access and stronger safety requirements for digital platforms.

The European Commission has proposed the EU KIDS Act — EU Keeping Internet Digital Spaces Accountable and Trustworthy — which would establish common rules for minors across the bloc. The proposal would introduce age-based access to social media while requiring online services used by children to adopt stronger privacy and safety protections by default.

At the centre of the framework is a privacy-preserving age-verification system developed by the European Commission. Instead of requiring users to repeatedly submit identity documents directly to individual platforms, the proposed system is designed to provide platforms with confirmation that a user meets a particular age threshold without revealing unnecessary personal information.

The KIDS Act is still a legislative proposal and must go through the EU's legislative process before it can become law. Its provisions could therefore change during negotiations between the European Parliament and EU member states.

How the EU Age-Verification App Works

The European Commission's age-verification solution is designed around the principle that platforms should be able to establish whether a person satisfies an age requirement without receiving the person's full identity information.

A user would first establish their age through an authorised process. Depending on the implementation, this could involve a biometric passport or identity card, a national electronic ID, a participating third-party application such as a banking app, or an in-person verification route.

The verification system then generates a digital proof of age.

When a user accesses an age-restricted service, the platform can receive a confirmation that the required age threshold has been met rather than receiving the underlying identity document.

The Commission describes the technology as privacy-preserving and based on zero-knowledge proof principles. The objective is to prevent platforms from using age-verification information to identify, track or profile users unnecessarily.

No Direct Sharing of Identity Documents With Platforms

One of the most important features of the proposed system is the separation between identity verification and the online platform.

Under the Commission's proposed approach, the platform would not need to see a user's passport or identity card. Instead, an independent certified age-verification solution would provide the required age confirmation.

The Commission's KIDS Act FAQ states that the platform would receive essentially a yes-or-no answer regarding whether a user meets the applicable age threshold. The proposed system is designed so that it cannot identify, locate, track or profile users.

This approach is intended to address one of the central concerns surrounding online age checks: protecting children without creating a new system through which platforms can collect additional sensitive personal information.

Free Age Verification Across EU Countries

The European Commission has said that member states should ensure that citizens have access to a free means of proving their age.

The technology can be deployed as a standalone application or integrated into European Digital Identity Wallets. The Commission has also developed an open-source technical blueprint that member states and other organisations can customise for their own implementations.

The Commission expects the solution to become available across the EU by the end of 2026, subject to member-state deployment. Several countries have already been involved in testing and customising the technology.

What the EU KIDS Act Proposes for Different Age Groups

Age verification is only one part of the proposed legislation.

The KIDS Act would introduce a graduated system for social-media access.

Under 13

Children under 13 would not be permitted to independently access social-media services under the proposal.

They could continue to use specially designed child-friendly video-sharing services through accounts managed by a parent or guardian.

From 13 to Under 15

Children aged 13 and 14 would be able to use certain social-media services through parent-managed "mini accounts".

These accounts would have restricted functionality, parental controls and a proposed maximum screen-time limit of one hour per day. Social contacts would also be subject to additional safeguards.

From 15 Onwards

From age 15, young people would be able to open and manage their own social-media accounts under the proposed framework.

Platforms would nevertheless remain subject to safety requirements designed specifically for minors.

The Proposal Covers More Than Social Media

The proposed rules extend beyond conventional social-media platforms.

The European Commission says the framework would apply to services used by minors, including video-sharing platforms, online games and AI companions and chatbots.

This is significant because children's online experiences increasingly extend across multiple types of digital services.

Rather than treating social media as a standalone issue, the proposal attempts to address the broader digital environment in which minors interact with content, algorithms, games and AI systems.

Safety by Design Becomes a Core Requirement

The KIDS Act would also change the focus from simply controlling children's access to requiring platforms to make their services safer by design.

Under the proposal, services used by minors would have to limit features that can encourage excessive or prolonged use.

These include mechanisms such as infinite scrolling, certain reward mechanisms and push notifications during sleeping hours. Children's profiles would also be private by default, while unsolicited contact from strangers would be restricted.

The proposal would also make it easier for young users to block or mute other users.

The broader objective is to shift part of the responsibility from children and parents towards the design and operation of digital platforms.

Recommendation Algorithms Also Come Under Scrutiny

Another important element concerns how online content is recommended to minors.

The proposed framework seeks to reduce the use of engagement-driven mechanisms that can encourage excessive consumption of content.

For minors, platforms would face requirements aimed at ensuring that recommendations prioritise safety and age appropriateness rather than simply maximising engagement.

The proposal also addresses tracking-based personalisation and other forms of profiling involving children.

This could have implications for how social-media companies design feeds, advertising systems and recommendation engines for younger users.

AI Companions and Chatbots Face New Restrictions

The EU proposal also addresses the growing use of artificial-intelligence companions and chatbots by minors.

Under the proposed rules, AI companions and chatbots would be switched off by default for children. The Commission also proposes restrictions on AI systems behaving in ways that could encourage emotional dependency among young users.

The inclusion of AI services reflects the changing nature of children's digital activity, where interactions increasingly extend beyond conventional websites and social-media applications.

For technology companies, this could create additional compliance requirements for AI products that are accessible to or potentially used by minors.

Why Privacy Is Central to the Proposal

Age verification creates an inherent privacy challenge.

A system that requires every website to collect identity documents could potentially create large databases containing sensitive personal information.

The EU's proposed approach attempts to avoid that outcome by separating the verification of age from the platform itself.

The Commission's technology is designed so that an online service can determine whether a person is above or below a specified threshold without learning the person's identity or exact age.

The approach is intended to reduce repeated disclosure of personal information across multiple services.

The Technology Is Already Being Rolled Out

The age-verification technology is not being developed solely as a future component of the KIDS Act.

The European Commission announced in April 2026 that its age-verification solution was technically ready for deployment and urged member states to make it available to citizens by the end of 2026.

The technology can be adapted by individual countries while maintaining a common technical approach.

The Commission has also said that cybersecurity standards should be subject to independent third-party scrutiny as national implementations are rolled out.

How the EU Approach Differs From Australia

Countries around the world are experimenting with different approaches to online child safety.

Australia has taken a more direct age-based approach to social-media access, while the EU is proposing a common verification infrastructure alongside broader safety-by-design obligations.

The EU's approach attempts to standardise the technical process used to establish age across participating services rather than leaving every platform to develop completely separate systems.

This could make compliance more consistent across the bloc, although the effectiveness of the system will depend on implementation, enforcement and the ability of platforms to prevent circumvention.

France Highlights the Legal Challenges

The European debate also comes as individual countries have tested their own restrictions.

France's attempt to introduce a national social-media restriction for younger users faced constitutional scrutiny, illustrating the legal questions that can arise when governments seek to restrict access to digital services.

The EU's proposal is intended to establish a common framework rather than leaving each member state to develop substantially different age thresholds and platform requirements.

However, the KIDS Act itself must still pass through the EU legislative process and could face changes during negotiations.

Comparison With India's Framework

India's regulatory framework takes a different approach.

Under India's Information Technology Rules, online curated content is classified into age-based categories including U/A 13+, U/A 16+ and adult content. Platforms providing U/A 13+ or higher content must provide access-control mechanisms such as parental locks, while adult content requires a reliable age-verification mechanism.

India's framework therefore already contains elements of age gating and parental controls for certain categories of online content.

The EU proposal goes further in scope by combining age-based social-media access, a common age-verification infrastructure and broader safety-by-design obligations covering features such as recommendation systems, notifications, unsolicited contacts and AI companions.

India's 2026 online-gaming rules also expressly recognise safeguards such as age verification or age-gating mechanisms, time restrictions, parental controls and user-safety measures for online social games and esports.

What It Could Mean for Technology Platforms

If the KIDS Act becomes law in substantially its proposed form, major digital platforms operating in Europe could face significant changes to their products and compliance systems.

Social-media companies would need reliable age-verification processes for new accounts, while existing accounts would also be subject to the framework's requirements.

Platforms would need to review how recommendation algorithms, advertising, messaging, privacy settings, notifications and engagement features operate for minors.

The compliance burden could therefore extend well beyond simply adding an age-verification screen at sign-up.

Potential Impact on Digital Businesses

The proposal could have implications for companies operating social networks, video platforms, gaming services, app stores and AI products.

Businesses may need to invest in age-assurance technology, parental-control systems, child-specific product designs and compliance infrastructure.

For smaller companies, these requirements could represent a larger relative compliance burden than for major platforms with established trust-and-safety teams.

At the same time, a common EU framework could reduce the need for companies to build separate systems for different national rules if it successfully harmonises requirements across member states.

Implementation and Enforcement Will Be Critical

The effectiveness of the proposed framework will depend heavily on how it is implemented.

A technically robust age-verification system could reduce the need for platforms to collect identity documents directly, but no age-verification technology can eliminate every possibility of circumvention.

The legislation will also need to address issues such as access by children using another person's device, false information, account sharing and the treatment of users who do not have conventional digital identity documents.

The Commission's proposal seeks to address these issues through certified independent verification systems and platform-level obligations, but the practical details will become clearer as the legislative process progresses.

Market Outlook

The EU KIDS Act represents a potentially significant shift in how online platforms are expected to protect minors. Instead of relying primarily on parental controls or individual platform policies, the proposal combines age verification, age-based access rules, privacy safeguards and safety-by-design requirements in one framework.

For technology companies, the proposal could increase compliance costs while also creating demand for age-assurance, digital-identity, privacy and child-safety technologies.

For investors, the key areas to monitor will be the final legislative text, implementation timelines, compliance requirements for large platforms, the treatment of AI services and the technical adoption of the EU's age-verification system.

The immediate next step is the EU legislative process. Until the European Parliament and member states reach agreement, the proposed KIDS Act should be viewed as a framework under negotiation rather than a final set of enforceable rules.