Proposal for an EU KIDS Act, COM(2026) 681 — Source Summary

The EU KIDS Act proposal ("EU Keeping Internet Digital Spaces Accountable and Trustworthy") is a draft Regulation of the European Parliament and of the Council, adopted by the European Commission in Brussels on 17 September 2026 as COM(2026) 681 final. It would set a harmonised minimum age of 15 for autonomous accounts on online social networking and video-sharing services that have listed risky features, allow guardian-set limited accounts from 13, impose safety-by-design obligations on social media, video-sharing platforms, online games, software application stores, AI companions and general conversational chatbots, make certified EU age verification the only permitted method for enforcing the minimum age, and enforce the regime through the Digital Services Act (DSA) and the AI Act. The structured legislation page is EU KIDS Act (proposed Regulation on the protection of minors online).

Provenance

The raw file is a verbatim extraction of the 99-page PDF text layer published on the Commission's newsroom document repository and linked from the digital-strategy library page for the proposal (landing page: digital-strategy.ec.europa.eu). Authenticity was verified on 2026-09-18 against the canonical host and against the Commission's press release and FAQ of the same date. The capture is complete in substance, but one anomaly was not resolved: the risk conditions in Article 6(1) are lettered (d) to (h) with no points (a) to (c), in both of two independent parses of the PDF. Recital 21, which describes the risky features, maps onto (d) to (h) only. Whether points (a) to (c) are absent from the published PDF or were lost in extraction has not been established.

The document contains no personal data of private individuals.

Background and rationale (explanatory memorandum)

The memorandum opens with the statement that only half of children aged 9 to 16 across Europe say they feel safe online, and lists harms to minors' health and development including reduced physical activity, myopia, reduced sleep, depressive and anxious symptoms, lower self-esteem, effects on learning and cognitive development, eating disorders, decreased empathy, loneliness and addictive behaviours, together with cyberbullying, child sexual abuse and grooming.

Political origin. Commission President Ursula von der Leyen announced in her 2025 State of the Union address that she would commission an expert panel on child safety online. After a process in the first half of 2026 involving more than 60 experts from health, child psychology and psychiatry, computer and social science, and representatives of industry, parents and youth, the co-chairs of the Special Panel on Child Safety Online presented their recommendations in July 2026. According to recital 2, the co-chairs' report rests on six guiding principles (a developmental approach; equality and diversity; protection of minors; accountability of digital services and consumer rights; empowerment and media education; children's rights and participation) and recommends EU-wide access restrictions to social media, harmonised safety-by-design rules and proportionate, privacy-preserving age assurance, covering "the entirety of the digital environment" under the label "social media+". The co-chairs also met the Office of the UN High Commissioner for Human Rights, think tanks, industry and the European Data Protection Board.

Prior calls for action. The memorandum cites the Jutland Declaration of October 2025, signed by 25 Member States, calling for age verification; European Council conclusions of October 2025 and March 2026 on protecting minors online, including through a digital age of majority; and a November 2025 European Parliament report that called for a harmonised digital age limit of 16 for social media, video-sharing platforms and AI companions unless parents or guardians authorise otherwise, a harmonised age of 13 below which no minor could access social media, further legislation on age-appropriate design and safety by design, and a European approach to age assurance.

Fragmentation. Italy, France, Norway, Greece, Austria, Poland and Belgium notified draft national legislation limiting minors' access to certain digital services under the Technical Regulations Information System (TRIS) in 2025 and 2026, Norway also notifying its legislation in May 2026; consultations or drafts were under way in almost all other Member States, and Sweden and Germany had run inquiries on national drafts. The memorandum states that national proposals differ in scope, in age limits (from 13 to 16, sometimes dependent on parental consent) and in the restrictions imposed, and that the resulting divergence risks fragmenting the single market and giving minors uneven protection.

Evidence and consultation. The memorandum and the financial statement cite:

• a Eurobarometer survey conducted between March and April 2026 of more than 26,000 people aged 13 to 18 and more than 12,000 parents across all 27 Member States, in which nine in ten adolescents reported encountering at least one harmful or distressing piece of content online in the previous three months; 54% of parents and 45% of 13-to-18-year-olds considered age delays an effective solution, and 47% of parents and 48% of adolescents called for better implementation of existing rules;
• a 2024 call for evidence (more than 170 responses) and a 2025 public consultation (more than 300 inputs) held for the Commission's guidelines on the protection of minors under DSA Article 28, a majority of which viewed those measures positively; the proposal describes the guidelines' measures as "largely codified" by it;
• ten DSA preliminary findings concerning the protection of minors, including on addictive design, safe accounts and age assurance;
• the President's Youth Advisory Group, of more than 30 young representatives, whose meeting the text dates to December 2026; a December 2025 Safer Internet Forum involving over 200 children, young people and stakeholders on "Why age matters"; consultation of 5,000 children through the EU Children's Participation Platform on digital fairness; the Digital Fairness Act call for evidence opened on 17 July 2025 for 12 weeks; and an Audiovisual Media Services Directive consultation launched on 10 February 2026;
• cooperation with regulators in Australia, the United Kingdom, Brazil and Japan, and a Commission-procured study on the fundamental-rights impacts and economic costs of age assurance;
• in the financial statement, surveys finding that across six countries 34% of 9-to-11-year-olds report having a social media profile, and an OECD finding that only 2 of 50 online services studied systematically require age assurance at account creation. The statement refers to "the recent experience in Australia" as showing that such a change takes time.

Impacts. The accompanying staff working document is described as an analytical document containing a problem definition, an explanation of the approach followed and an assessment of impacts; it builds on the report of the Special Panel's co-chairs, on DSA enforcement data, and on impact assessments for the DSA, the Digital Markets Act, the AI Act, the proposed Regulation to prevent and combat child sexual abuse, the recast child sexual abuse Directive, the forthcoming Digital Fairness Act and the Audiovisual Media Services Directive. The memorandum expects marginal costs of most safety-by-design requirements to be limited because they already appear in the DSA Article 28 guidelines, and the compliance-plan and audit duties to fall on providers with a very large user base (45 million monthly active users). It states that the costs of age assurance and parental tools cannot be conclusively determined, especially for small and micro providers of social networking, video-sharing and game services not previously subject to Article 28, and that the EU age verification solution will mitigate them. Small and micro enterprises are not exempted, on the ground that they "may equally provide harms to minors."

Fundamental rights. The memorandum presents the access delay as limited to account creation on a defined set of services with features "proven to be harmful," so that the limitation on children's freedom of expression under Articles 11(1) and 24(1) of the Charter remains proportionate, and cites UN Committee on the Rights of the Child General comment 25 for the safety-by-design requirements. It states that age verification is mandated only for the access delay, for new accounts and for existing accounts where the provider cannot tell with a high degree of confidence that the holder is above the threshold.

Structure of the proposal

Scope and definitions (Articles 1–3)

Article 1 states that the Regulation "specifies and complements" the DSA (Regulation (EU) 2022/2065) and "complements" the AI Act (Regulation (EU) 2024/1689), and that it establishes a harmonised minimum age for accounts on social networking and video-sharing services, harmonised safety requirements, and harmonised rules on age assurance.

Article 2(1) covers providers of seven categories of service or system accessible to minors: online social networking services, video-sharing platform services, software application stores, online games, operating systems, AI companions and general conversational chatbots. The first five are covered wherever the provider is established if offered to recipients in the Union; the two AI categories are covered when placed on the market or put into service in the Union, irrespective of where the provider is established. Article 2(4) exempts not-for-profit online encyclopaedias; not-for-profit educational and scientific repositories; services designed for primarily educational purposes and operated by or for educational establishments; open-source software-developing and -sharing platforms, unless the platform itself is an AI system in scope of this Regulation or the AI Act; services built solely for scientific research and development; and services built by and for the exclusive use of public authorities. The Commission may add to or remove from this list by delegated act (Article 2(5)). Under Article 2(6), social networks, video-sharing platforms and video gaming platforms subject to DSA Article 28(1) that comply with the Regulation are deemed to comply with that article for matters it covers, including AI systems deployed as a platform functionality; recital 14 adds that compliance does not prove compliance with Article 28(1) on matters the Regulation does not cover. Article 2(7) states the Regulation is without prejudice to the Audiovisual Media Services Directive, EU consumer-protection and product-safety law (including the Unfair Commercial Practices Directive and the AI Act), the GDPR and ePrivacy Directive, and Directive (EU) 2024/1385 on violence against women.

Article 3 imports the DSA's definitions of online platform, recipient of the service, online interface and recommender system; the Digital Markets Act's definitions of online social networking service, video-sharing platform service, software application store and operating system; and the AI Act's definitions of AI system, general-purpose AI system and provider. Its own definitions include:

• Minor or child: any natural person under 18; guardian: a person holding parental responsibility under national law.
• AI companion: "an AI system, including a general-purpose AI system, that provides sustained, personalised interaction or companionship which simulates or facilitates a social, emotional or interpersonal relationship with a user."
• General conversational chatbot: "a general-purpose AI system with general conversational functionalities for direct interaction with users that is capable of providing assistance across multiple domains and tasks," excluding systems limited to a specialised service, task or pre-defined functions, including customer-service, business-operation, technical-support, transactional, educational, information-retrieval, industrial and manufacturing applications.
• Online games: a video game or a video gaming platform, the latter being a DSA online platform generating visual feedback in a simulated environment; recital 12 treats games available only on physical media with no online component as out of scope, and a game with video-sharing features as a game.
• Age verification: establishing "with a high degree of certainty" whether a user has attained an age threshold on the basis of identification documents or other reliable verified sources; age assurance: methods to determine, estimate or verify age, "excluding self-declaration"; age signal, proof of age attestation (an electronic attestation of attributes under the eIDAS Regulation), EU age verification solution, the EU Age Verification Scheme and the two EU lists; and tools for guardians.

Anti-circumvention and compliance plans (Articles 4–5)

Article 4 bars providers in scope from any behaviour that undermines effective compliance, whether contractual, commercial, technical, behavioural or through interface design, and from knowingly and intentionally circumventing their obligations. Recital 18 gives as examples asking minors to lower sensitive settings at sign-up, enticing them to circumvent the access delay, and secondary accounts created to evade safety-by-design measures.

Article 5 applies to social networking and video-sharing services designated as very large online platforms (VLOPs) under DSA Article 33. Such a provider must notify the Commission of a detailed compliance plan covering Chapters II to V within 4 months of its designation, or within 30 days of the Regulation's entry into application if already designated. It must commission, at its own expense and at no more than market rates, an audit of the plan by independent auditors who have or retain expertise in the protection and rights of the child, paediatric medicine and child psychiatry, developmental science, age assurance, the design of online interfaces and recommender systems, and data protection and security. DSA Article 37(2) and (3), on auditor access and independence, apply by analogy, and employees who communicate with the auditors are protected from adverse action. The auditors send a draft report on which the provider may comment within 15 days, then issue a final report to the Commission and the provider within two months of receiving the plan; the provider publishes a non-confidential summary. If the Commission decides the plan has shortcomings, the provider has 30 days to submit a corrective action plan, with each measure implemented within a period of not more than 60 days, verified by the auditor. Neither the final report nor the Commission's action or inaction constitutes a finding of compliance. After the first notification, providers report annually as part of their DSA Article 34 risk assessments, and compliance is folded into their DSA Article 37 audits. The Commission may adopt implementing acts setting audit templates.

Delayed access to social media (Articles 6–7)

Minimum age of 15. Article 6(1) bars providers of social networking and video-sharing services from allowing a person under 15 to create an account or use the service through an account created for or attributed to them, where the service poses a risk to the privacy, safety or security of minors under 15. A service poses such a risk if it meets any of the listed conditions (lettered (d) to (h) in the captured text): it lets account holders transmit content in real time to an indeterminate number of recipients, including live streaming; lets them contact or interact with recipients outside their pre-existing connections or subscriptions; uses a recommender system based on profiling as defined in GDPR Article 4(4); uses a recommender system that suggests contacts or information not provided by pre-existing connections; or deploys functionalities intended or reasonably foreseeable to enable uninterrupted consumption, incentivise interaction, or send automated notifications prompting the user to start or resume use. The Commission may add equivalent features by delegated act (Article 6(6)). Recital 20 describes an "EU-wide access restriction to social media+ for under 13-year-olds" as necessary, characterises ages 13 to 15 as "the peak of developmental vulnerability," and leaves higher national or EU minimum ages for pornographic or gambling content unaffected. Recital 21 explains the account-based design of the rule: the risky features are typically offered only through accounts, and use without an account poses a lower risk. Under Article 6(5), where providers rely on consent as a GDPR legal basis, the rule applies in parallel with the GDPR's Article 8 age limits.

Guardian-set accounts from 13. By derogation, Article 6(2) lets providers allow guardians to set up accounts with limited features for minors above 13 and below 15, provided at least that the Article 20 guardian tools are always activated; guardians can set a daily time limit that "shall not exceed one hour per day"; and guardians can pre-approve new contacts and cap the number of contacts. The provider must establish that the person creating the account holds parental responsibility (Article 26) and verify that the minor has reached 13. Recital 22 states that such an account "should be an account of the holder of the parental responsibility and not of the respective minor," and that the derogation is unavailable where the provider's terms set a minimum age above 13.

Existing accounts. Article 6(4) requires providers, by 6 months after the Regulation's entry into application, to establish whether holders of existing accounts are under 15 and to disable the accounts of those who are or whose age cannot be established.

Guardian-controlled access below 13. Article 7 lets providers of video-sharing platforms specifically designed for children under 13 allow a guardian to give such a child limited access through the guardian's own account, with no account created for or attributed to the child. Conditions include express permission in the provider's terms with a stated age range; a published assessment of the service's impact on minors in that range (compliance with Chapter III does not by itself mitigate the risks); published criteria for content that is not age-appropriate, which is then withheld; features adapted to the declared age; and all personalisation, recommender systems and search of other users' content turned off unless the published assessment shows activation is in the child's best interests. Guardian tools are on by default; the guardian declares the child's age, and access may not be enabled for a child under 3; the guardian can set a maximum daily duration not exceeding one hour, supervise displayed content, approve and remove the child's contacts, and suspend access at any time. Access ends when the child reaches 13. Nothing in Article 7 requires any provider to admit under-13s (Article 7(2)).

Safety by design (Articles 8–13)

General obligation. Article 8 requires providers of social networks, video-sharing platforms, online games, AI companions, general conversational chatbots and app stores to ensure a high level of privacy, safety and security of minors, whether or not the service is used with an account, and to design their services to the Chapter III requirements by default, derogating only after establishing through age assurance that the user is an adult. Where a social network or video-sharing platform deploys an AI companion or chatbot as a functionality, only Sections III, V and VI apply to that AI system (Article 8(3)).

Addictive design. Article 9 bars social networks and video-sharing platforms from designing, organising or operating their services in a way intended or reasonably foreseeable to encourage compulsive or excessive use by minors, and deems four features to do so: autoplay and uninterrupted consumption without effective, regular interruption; undermining a minor's decision to stop, such as notifications not triggered by the minor's own activity; incentivising or rewarding minors to share content or broadcast to mass audiences; and incentivising engagement at regular times or with greater frequency, including by penalties or lost benefits. Providers must also ensure time-limited access and interruption of use, designed to protect school time and core sleep hours. Recital 27 defines core sleep hours as at least eight consecutive hours between 22:00 and 08:00 local time and school time by national law or practice, adjustable by guardians, and names autoscroll, autoreplay, infinite scroll and artificially timed notifications as examples.

Recommender systems. Article 10 requires recommender optimisation that does not exploit minors' vulnerability or attention and includes evaluation metrics for quality, safety and mental-health outcomes, through at least: primary weight to explicit user-stated preferences; recommendations based on implicit engagement-based signals disabled by default (recital 28 gives time spent viewing and click-through rates as examples); no reliance on minors' personal data collected outside the service; and no exposure to information that may pose a risk, including if encountered repeatedly, which recital 28 links to "rabbit holes" and "filter bubbles." Minors must be offered tools to change the recommender's parameters, delete previous preferences, and choose at least one option not based on profiling, presented at account creation without steering them toward the profiling option.

Safe settings. Article 11 requires high-protection defaults, with at least geolocation and tracking, microphone and camera, account recommendations and contact synchronisation, and push notifications turned off by default. Defaults may be changed only where the minor is above 15 and has been clearly informed and has explicitly consented; geolocation turns off when the session ends. Features that pose a risk to minors must not be available to them, including features that increase social comparison or disproportionately embellish or idealise the minor's image; recital 29 excludes harmless filters "such as those mimicking animals" and names visible reaction counts as a social-comparison feature.

Contacts and visibility. Article 12 requires that nobody can initiate direct contact with a minor without the minor's pre-approval; minors are excluded from contact recommendations; they are added to groups only with explicit agreement; and they can block others without being identified to them. Recipients not accepted by the minor cannot see the minor's account information or content by default, users without accounts never can, minors' contact details are not disclosed, others cannot download or screenshot minors' contact, location, account information or content, and minors cannot host live streams by default.

Economic transactions. Article 13 requires real-time notice to a minor that a transaction is an economic transaction, display of the monetary value of virtual-currency purchases in the official currency of the minor's Member State of habitual residence, and a ban on design leading to excessive, impulsive or unwanted spending, including exposure to variable reward systems. Recital 31 refers to loot boxes and to friction between content and the purchase of related products.

AI companions and general conversational chatbots (Article 14)

Article 14(1) requires providers of AI companions and general conversational chatbots to take proportionate and effective measures to ensure a high level of protection of the health, safety, fundamental rights, well-being and development of minors who may access their systems, including at least:

• avoiding "design features and system behaviours that simulate interpersonal relations that are likely to create emotional dependencies," and applying Article 9(1) and (3) on addictive design and time management;
• applying the Article 11 safe settings, including ensuring that by default the system "does not use information or analysis derived from a minor's prior interactions in subsequent interactions," except where necessary to protect the minor's safety; recital 32 describes this as disabling "persistent conversational memory" by default;
• applying the Article 13 rules on economic transactions;
• enabling access for children under 13 only through the Article 20 guardian tools;
• state-of-the-art evaluation and testing for risks to minors' health, safety, fundamental rights and physical, mental and emotional well-being, and appropriate safeguards, before placing the system on the market or putting it into service; recital 32 adds testing at regular intervals thereafter;
• post-market monitoring to identify and mitigate harms and emerging risks, including detecting and responding to serious incidents involving minors, unless the system is provided by a micro or small enterprise.

Where an AI companion or chatbot is a functionality of a social network, video-sharing platform or online game, the host provider must ensure it is not activated automatically or displayed prominently, minors are not encouraged to use it, and minors can opt out easily at any time (Article 14(2)); recital 34 gives placement at the top of a minor's contacts list as an example of nudging. Providers adhering to a code of conduct the Commission has assessed as adequate may rely on it to demonstrate compliance (Article 14(3)). Recital 33 states that where a companion or chatbot is built on a general-purpose AI model with systemic risk, mitigations under AI Act Article 55 may be relied upon, and DSA Articles 34 and 35 risk assessments may be taken into account for platform-embedded systems, but that neither is sufficient on its own for compliance. See AI Companions.

Online games and app stores (Articles 15–17)

Online games. Article 15 applies to games the rules on compulsive use (Article 9(1) and 9(2)(b) and (d)), safe settings (Article 11(1)) and parts of the contact rules (Article 12(1) and 12(3)(c)); makes guardian tools mandatory and under-13 access possible only through them; and requires safeguards against a game being used to entice minors into contacts on other services, which recital 36 suggests may include restricting link-outs and warning messages. Video gaming platforms that let users create and upload games must provide the software and organisational means for those games to comply. Adherence to a code of conduct assessed as adequate under Article 17 may be relied upon; recital 39 names the Pan-European Game Information (PEGI) system and code as a benchmark.

App stores. Article 16 requires software application stores to age-rate every app with a system that takes account of minors' evolving capacities, to prevent minors from accessing or buying apps rated inappropriate for their age and, where the store becomes aware of them, apps subject to a higher EU or national minimum age, to assess users' age under Chapter V (including through guardian tools), to allow under-13 access only through guardian tools, to publish their rating methodology, criteria and sources, and to allow the certified EU age verification solution to be offered in the store. Article 17 directs the Commission to facilitate Union-level codes of conduct on age rating and online games, to be drawn up by one year after the Regulation's entry into application, covering mutual recognition of ratings, criteria for violent, sexual, gambling and self-harm content, in-app purchases, contact risks and addictive design, free and independent dispute resolution for app developers, harmonised labels, and monitoring; the Commission is to assess them by 42 months after entry into force.

Agency, reporting, guardian tools and complaints (Articles 18–21)

Article 18 requires information and controls to be accessible and understandable to minors (in the official languages of each Member State served, for VLOPs), tools giving minors immediate and durable control over and feedback on content, prompts, suggestions and search results, and settings that can be changed temporarily and easily reset. Article 19 requires child-friendly reporting mechanisms whose reports from minors are handled "as a priority and without undue delay," support and authoritative information, including after a report, and warning messages where minors are likely to publish or encounter risky content; restrictions imposed after such reports count as visibility restrictions under DSA Article 17(1)(a). Recital 42 names national online safety apps such as e-Enfance's 3018 application and a forthcoming European Online Safety App.

Article 20 requires tools for guardians that are age-tailored, easy to use, protected by the same authorisation as their activation, effective and hard to circumvent, not disproportionately restrictive of minors' rights, and respectful of minors' agency and privacy. Minors must be informed when a tool is in use; providers must remind guardians of the tools; the tools must integrate time limits, settings management and reporting on the minor's behalf; and VLOPs must make them interoperable with third-party guardian tools under the conditions of DMA Article 6. Recital 43 lists warnings about repeated searches related to suicide, self-harm or eating disorders among possible features.

Article 21 gives minors and guardians the right to mandate a not-for-profit body to exercise their rights, and gives them and such bodies the right to complain to the competent national authority or, for AI companions and chatbots under its exclusive competence under AI Act Article 75(1), to the European AI Office (EU AI Office).

Other due diligence (Articles 22–25)

Very large online platforms in scope must monitor, test and evaluate the effectiveness of their Chapter III measures as part of their DSA Article 34 risk assessments (Article 22); recital 45 asks them to keep supporting documents for at least three years. The Commission is to facilitate voluntary codes of conduct and assess their adequacy after consulting the European Board for Digital Services or the European Artificial Intelligence Board (Article 23); recital 40 states that adherence may indicate compliance with measure-based obligations but cannot derogate from prohibitions. Providers without an EU establishment must designate a legal representative, and may extend a mandate already given under the DSA or the AI Act (Article 24). Article 25 empowers the Commission to amend the listed measures in Articles 9(2), 10(2), 11(1), 12(1), 12(2), 14(1), 15(1) and 18(2) by delegated act on the basis of identified emerging risks.

Parental responsibility and age assurance (Articles 26–32)

Parental responsibility. Article 26 lets providers establish parental responsibility from Member State official databases, from signals they already hold from past engagement, or, at least until a delegated act specifies signals, from self-declaration backed by reasonable verification efforts, in a privacy-preserving manner that does not enable locating, tracking, targeting or profiling the adult or child. Article 31(1) to (3) require each Member State to provide at least one free, privacy-preserving electronic means for a guardian to obtain and present an attestation of parental responsibility, based on authentic national sources, accessible to people with disabilities or limited digital skills and to refugee and displaced families, with alternative procedures where standard civil-status documents are unavailable.

Principles. Article 27 requires age assurance to provide a high level of accuracy, reliability, security, robustness, non-intrusiveness, privacy and data protection, and non-discrimination; recital 50 states that self-declaration alone is not sufficient. Article 28 provides that age assurance must not enable identification of the user or be used to locate, track, target, advertise to or profile users; that providers and their age-assurance partners process no more personal data than strictly necessary and do not combine it with other data; that measures be state of the art and "zero knowledge proof"; and that an age signal may be stored at account level solely to avoid repeated checks.

Verification for the minimum age. For Article 6, Article 29(1) and (2) require providers to rely "exclusively" on an EU age verification solution using an EU proof of age attestation, provided by a third party, certified by a public authority as conforming to the EU Age Verification Scheme, and listed on the EU lists the Commission maintains (Article 30(1)). European Digital Identity Wallets certified under the eIDAS Regulation that meet the scheme's requirements are deemed certified (Article 29(3)). For the safety-by-design duties under Article 8(1) and for app stores, providers may instead use other age-assurance solutions that they can show meet Articles 27 and 28 (Article 29(4)). Users must have a free electronic complaint mechanism against an incorrect age outcome, for which online platforms may use the DSA Article 20 system (Article 29(5)). Operating-system providers that hold a compliant age signal must, with the user's consent, share it with in-scope providers that need it (Article 29(6)). The Commission adopts implementing acts specifying the scheme, which must be interoperable with the European Digital Identity Wallets and may include a trust mark, and delegated acts on alternative age-assurance solutions and operating-system signal sharing (Article 30). Recital 17 ties the definitions to Commission Recommendation (EU) 2026/1035 of 29 April 2026 on a common framework for EU-wide age verification.

Member State duties. Member States must ensure the availability of means of obtaining a proof of age attestation, make at least one certified EU age verification solution available free of charge to citizens and residents, accredit certifying public authorities, notify certified solutions to the Commission, and recognise solutions listed by any other Member State (Article 31(4) to (7)). Recital 60 gives biometric identity cards and passports, digital identity schemes, third-party applications and in-person verification as examples of means.

Existing accounts. Article 32 requires providers to check existing accounts with an age verification solution but exempts them where they can establish with a high degree of confidence that the holder has reached the minimum age, and exempts providers under Article 8(1) and app stores from assessing age where they can establish with high confidence the user is not a minor. VLOPs must submit a plan to the competent authority describing how they will comply and any reliance on the exceptions. Recital 61 gives previously and legitimately acquired credit-card details as an example of reliable information, and recital 62 asks that the plan, submitted before the six-month deadline, describe the complete age-determination pipeline and report accuracy, precision and recall for underage users with a full confusion matrix in granular age buckets, plus separate statistical evidence where the year of account creation is relied on. See Age Verification.

National support measures (Article 33)

Member States must adopt national strategies giving minors and guardians free and confidential help channels for harms including unwanted contact and cyberbullying, information on risks and protections including digital literacy, and other relevant information, building on the Safer Internet Centres, and communicate them to the Commission by 12 months after entry into force. The activities may draw on EU funding under the multiannual financial framework.

Supervision, enforcement and penalties (Articles 34–38)

Allocation. Article 34 applies DSA Chapter IV to the supervision and enforcement of obligations on social networks, video-sharing platforms, online games that are video gaming platforms, and app stores, and AI Act Chapter IX to obligations on AI companions and general conversational chatbots. Member States must make their DSA Article 49 authorities and AI Act Article 70 and 74 authorities competent for the Regulation, and the Commission's DSA Chapter IV Section 4 powers and AI Act Article 75a to 75d and Article 99 powers extend to it. Recital 64 gives the Commission exclusive powers over VLOPs. Video games that are not platforms are supervised by a competent authority of the Member State of the provider's main establishment, with the powers of DSA Article 51 and national penalty rules under DSA Article 52 (Article 34(5)). GDPR supervisory authorities monitor the personal-data processing needed to comply, in particular under Articles 27 to 29, and may fine infringements of those data-protection obligations under GDPR Article 83 up to the amount in Article 83(5) (Article 34(6)). National authorities may not take decisions that run counter to a Commission decision (Article 34(7)).

Fines for AI companions and chatbots. Non-compliance by providers of AI companions and general conversational chatbots is subject to administrative fines under AI Act Article 99 "not exceeding 6 % of the total worldwide annual turnover of the undertaking providing the AI companion or the general conversational chatbot in the preceding financial year where that provider has been found to have acted intentionally or negligently" (Article 34(2)). The proposal sets no separate fine ceiling for platforms, app stores or video gaming platforms, which fall under the DSA's enforcement chapter.

Expedited procedure. For VLOPs and for AI systems under the Commission's exclusive supervision, Article 35 provides that when the Commission opens proceedings under DSA Article 66 or AI Act Article 75a, it "shall endeavour to" communicate preliminary findings within "[30] working days" (the figure bracketed in the text) and adopt a final decision within 90 working days of opening. The explanatory memorandum and recital 68 state the same targets as 30 days and 90 days without the word "working"; the financial statement uses 30 and 90 working days in one passage and 30 and 90 days in another, and describes the timelines as "unprecedented."

Supervisory fee. Article 36 has the Commission charge an annual fee, per in-scope service or system, on VLOPs that are or embed social networks, video-sharing platforms or app stores, and on providers of AI companions, chatbots and video gaming platforms under its supervision. The total covers the Commission's costs in the preceding calendar year, including staff, the set-up, maintenance and operation of the EU Age Verification Scheme, enforcement and capability development. Each provider's fee may not exceed 0.03% of its worldwide annual net income in the preceding financial year, and DSA Article 43 rules apply.

Capabilities and incidents. Article 37 directs the Commission, with national authorities, to develop Union expertise on the protection of minors, including through secondment of national staff, especially regarding incidents. Article 38 has the Commission coordinate the assessment of incidents affecting minors across the Union and establish a voluntary administrative arrangement for rapid response; Member States set minimum preparedness levels and map incident protocols. Recital 73 gives dangerous challenges circulating among minors as an example of such an incident.

Delegated acts, review and application (Articles 39–43)

Delegated powers are conferred for five years from entry into force, tacitly renewable, revocable by Parliament or Council, and subject to a two-month objection period extendable by three months (Article 39). The Commission is assisted by a comitology committee named the Child Safety Committee (Article 40). Article 41 adds the Regulation to Annex I of the Representative Actions Directive (EU) 2020/1828. Article 42 requires a review report by 31 August 2030 (a bracketed date), evaluating in particular the effectiveness of Articles 6 and 7, the personal scope of Chapters II and III, and the impact on freedom of expression and information, followed by reports every four years.

All of these dates are bracketed placeholders in the proposal.

Legislative financial and digital statement

The statement is titled "Child Online Safety and Rights Act (CARE)," a name used nowhere else in the document. It estimates that implementation and enforcement require 85 full-time equivalents (FTE), of which 45 would be redeployed within the implementing directorates-general, 10 drawn from the Commission's redeployment pool, and 30 new posts financed from fees. In its narrative it states that authorised staffing under the DSA would rise by 30 FTE (15 permanent and 15 non-permanent) financed from the DSA supervisory fee, and that 10 non-permanent FTE would be redeployed within the Commission to reinforce the AI Office. Listed tasks include day-to-day supervision of VLOPs and of AI companions and chatbots under Commission supervision, work on the EU Age Verification Blueprint and Scheme, compliance assessment of candidate providers of age verification solutions and proof-of-age attestations, and "operation of a 24/7 crisis capability."

Financing is a top-up to the DSA supervisory fee, paid only by in-scope providers designated as VLOPs or very large online search engines; the statement records that the DSA fee has been collected since 2024 and has amounted to between EUR 40 and 60 million annually. Figures for 2028 to 2034, which the statement describes as indicative and dependent on the 2028–2034 multiannual financial framework negotiations, are in EUR million:

The digital-dimensions section states that the EU age verification solution is based on the Commission's EU age verification blueprint, which Member States or private entities may deploy as a stand-alone app or within a digital wallet; describes it as "double-blind," non-traceable and unlinkable, with the online service receiving only proof that the user is over the required age; notes that the technical requirements are published as open source at ageverification.dev; states that commercial age-assurance products may be used for the safety-by-design duties if they meet the criteria; and records that the Commission is building the EU Age Verification Scheme following Recommendation (EU) 2026/1035. Information exchange between authorities would use the DSA's AGORA system and the AI Act's existing structures.

Relation to other EU instruments

The proposal describes itself as specifying and complementing the DSA and complementing the AI Act, and uses the same Article 114 legal basis as both. It states that its safety-by-design provisions set in "hard law" specifications the Commission already included in its 2025 guidelines on the protection of minors under DSA Article 28 (C/2025/5519 of 10 October 2025), and that ongoing DSA Article 28 cases are unaffected. It states that it does not affect the AI Act's prohibitions, including on exploiting minors' vulnerabilities, or the obligations for high-risk systems, transparency and general-purpose AI models, and refers to "the recent changes" to the AI Act prohibiting AI systems that generate child sexual abuse material. It is without prejudice to the GDPR, whose authorities supervise its age-assurance data processing (General Data Protection Regulation (GDPR)), and to the Audiovisual Media Services Directive, whose ongoing evaluation and review will address minors as viewers; recital 10 provides that where other Union instruments regulate "similar, but not more specific, aspects" of in-scope services, "the latter should prevail." It borrows DMA definitions and the DMA Article 6 interoperability conditions. It anticipates a Digital Fairness Act and a revision of the Consumer Protection Cooperation Regulation, and positions itself alongside the Unfair Commercial Practices Directive, the proposed Regulation to prevent and combat child sexual abuse, the recast child sexual abuse Directive, Directive (EU) 2024/1385, the Better Internet for Kids strategy (BIK+) and the February 2026 Action plan against cyberbullying.

Drafting anomalies in the published text

As published, the proposal contains features consistent with a text not yet finalised:

• Application dates, the Article 17 deadlines, the Article 42 review date and the Article 35 figure of 30 working days appear in square brackets; the citations of the opinions of the European Economic and Social Committee and the Committee of the Regions, and the date of the European Data Protection Supervisor's opinion, are left blank.
• Article 6(1) letters its risk conditions (d) to (h), as noted under Provenance.
• Several cross-references do not match the provisions they describe: Article 7(5) refers to account creation "pursuant to Article 5(2)" where Article 6(2) governs such accounts; Article 8(1) refers to accounts under "Article 5(3) and Article 6(3)"; Article 14(1)(f) refers to harms "referred to in point (d)" (the under-13 access rule); Article 36(1) refers to supervisory competence "in accordance with Article 33" (national strategies) and Article 36(6) to "Article X"; delegated-act provisions refer variously to Article 39 and Article 40, which respectively govern the delegation and the committee procedure; and the financial statement refers to verification solutions under "Article 24."
• The financial statement's timeline differs from Article 43. It places the start of parental accounts, the AI companion and chatbot rules and the codes of conduct at twelve months after entry into application, and readiness for the expedited procedure at the same point, while Article 43 applies Article 14 from six months after entry into force with the rest of the Regulation and Article 35 from twelve months after entry into force.
• The financial statement's title, "Child Online Safety and Rights Act (CARE)," differs from the Regulation's title.
• The memorandum dates a meeting of the President's Youth Advisory Group to December 2026, after the proposal's own date.

Differences between the Commission's explainer and the legal text

The Commission's FAQ "The KIDS Act explained" and its press release of the same date (Source: digital-strategy.ec.europa.eu; digital-strategy.ec.europa.eu) summarise the proposal in terms that differ from the text in several places:

• Expedited timelines. The FAQ gives "Preliminary findings within 30 days and a final decision targeted within 90 days." Article 35 states that the Commission "shall endeavour to" meet [30] working days and 90 working days, and applies only to VLOPs and AI systems under the Commission's exclusive supervision.
• The 6% ceiling. The FAQ states that fines "can reach 6% of total worldwide annual turnover." In the text, the 6% ceiling in Article 34(2) applies to providers of AI companions and general conversational chatbots, and only where the provider acted intentionally or negligently; platform obligations are enforced under DSA Chapter IV and data-protection obligations under the GDPR.
• Chatbots before market entry. The FAQ states that AI companions and chatbots "cannot be placed on the market until providers can demonstrate compliance" and have a monitoring mechanism. The text requires pre-market evaluation, testing and safeguards (Article 14(1)(e)) and post-market monitoring from which micro and small enterprises are exempt (Article 14(1)(f)); no article makes placing on the market conditional on a demonstration of compliance or on prior approval.
• Under-13 access. The FAQ's description of guardian access on video platforms for young children omits the text's floor of age 3 (Article 7(4)(b)) and the possibility of activating personalisation, recommender systems or search where the provider's published impact assessment shows it is in the child's best interests (Article 7(1)(h)).
• Age verification tools. The FAQ describes verification through a free EU age verification app "and, later," the European Digital Identity Wallet. The text sets no sequence: certified EU age verification solutions are required for the minimum age, compliant European Digital Identity Wallets are deemed certified, and other age-assurance methods remain permitted for safety-by-design duties and app stores.
• Recommender defaults. The FAQ states that tracking-based personalisation is off by default. The text disables by default recommendations based on implicit engagement-based signals and requires that at least one non-profiling option be offered, not that profiling-based recommendation be off by default.
• App stores. The FAQ states that app stores must carry the EU age verification app; Article 16(6) requires them to allow the certified EU age verification solution to be offered in their store.
• Auditors. The FAQ states that the Commission may object to an auditor whose independence is not ensured. The text applies DSA Article 37(2) and (3) on auditor independence by analogy and contains no separate objection power.

Key claims

High confidence (stated in the operative articles): the minimum age of 15 for accounts on social networking and video-sharing services meeting any listed risk condition; guardian-set accounts for 13-to-14-year-olds with a daily limit not exceeding one hour; guardian-controlled access below 13 only on child-specific video-sharing services and never below age 3; the Article 14 duties on AI companions and chatbots; exclusive reliance on certified EU age verification for the minimum age; enforcement through DSA Chapter IV and AI Act Chapter IX; the 6% ceiling for companion and chatbot providers acting intentionally or negligently; the fee cap of 0.03% of worldwide annual net income.

Lower confidence: every date and the 30-working-day figure are placeholders that may change; the completeness of Article 6(1) has not been confirmed against the PDF; the financial figures are described in the document itself as indicative. The proposal is not law and requires agreement by the Parliament and the Council.

Relationships

• supports: EU KIDS Act (proposed Regulation on the protection of minors online) — the primary text of the proposal.
• depends-on: Digital Services Act (EU) — specifies DSA Article 28 for minors, uses DSA Chapter IV enforcement and the DSA supervisory fee.
• depends-on: EU AI Act (Regulation 2024/1689) — complements the AI Act and uses its Chapter IX supervision and Article 99 fines for AI companions and chatbots.
• related: General Data Protection Regulation (GDPR) — GDPR authorities supervise age-assurance data processing; Article 8 age limits apply in parallel.
• related: Digital Markets Act (EU) — source of the service definitions and of the interoperability conditions for guardian tools.
• regulated-by: EU AI Office — complaint venue and supervisor for AI companions and chatbots under its exclusive competence.
• related: AI Companions — first EU statutory definitions of "AI companion" and "general conversational chatbot."
• related: Age Verification, AI and Children
• related: Ursula von der Leyen, European Parliament, European Data Protection Board (EDPB)
• related: Kids Internet and Digital Safety Act (KIDS Act, H.R. 7757) — unrelated U.S. bill (H.R. 7757) with the same short name.