Germany · de.indymedia · · 4h
EU Kids Act: EU Commission wants to add age controls to the internet
Deutsch (original) · Auto-translated to English
In the future, people will have their age checked for many social media, video platforms, apps and games. And if adults set up an account for children, they should prove that they have custody rights. This and more is contained in the EU Commission's draft of the EU Kids Act, which we are publishing here.
Driven by the international debate about a social media ban, the EU Commission has prepared its own draft law: the EU Kids Act. Tomorrow, September 17th, EU Commission President Ursula von der Leyen and EU Commissioner Henna Virkkunen want to introduce him.
We have the first key points of the planned regulationhttps://netzpolitik.org/2026/eckpoints-geleakt-eu-commission-will-social...summarized. Comprehensive age controls have already played a central role there. The minimum age for own accounts, for example on Instagram or TikTok, should be 15 years.
The nowhttps://cdn.netzpolitik.org/wp-upload/2026/09/2026-09-15_COM_EU-Kids-Act...Version of the complete billshows: The planned controls go even further than initially assumed. Adults and children therefore expect many new hurdles in everyday digital life. The overview.
- Age controls for social media accounts
- Age controls for chatbots, apps and games
- A regulation that makes no sense whatsoever
- Parents should prove that they are parents
- Parent accounts allow little leeway
- Guidelines for the protection of minors should become law
- Fundamental rights of children and adults “massively” impaired
Age controls for social media accounts
The draft envisages various types of age checks in several places on the Internet. First of all, it's about controls for accountssocial mediaandVideo platforms(Article 6) that are classified as risky. A corresponding service is already considered risky for minors if, for example, you can contact strangers there or view a feed with personalized content.
In order to distinguish between younger and older people, the services concerned should be required to carry out strict age verification (“age verification”), for exampleEU age control app, which is based on ID card data, or with similar tools. That is, tooall adults must allow themselves to be controlled. There should only be exceptions for existing accounts where there is no suspicion that they belong to minors, for example because they have existed for years (Article 32).
Social media (“social networking services”) are not explicitly defined in the draft, but are in the related Digital Markets Act (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02022R1925-2...). Should the definition of the DMA also apply to the Kids Act, social media are platforms on which users can “contact and communicate with each other, share content and discover other users and content”. This means that all sorts of smaller forums or image boards could also be affected and therefore have to introduce age controls. The Kids Act explicitly statesno exceptions for small businessesbefore.
The full social media experience should only be allowed at the age of 18 - with functions such as endless scrolling, feeds optimized for strong influence, contact with strangers and a fireworks display of app notifications. From the age of 15, young people are allowed to have at least one account of their own in a reduced youth protection version.
Age controls for chatbots, apps and games
The second wave of age controls will affect significantly more services. An account no longer plays a role for this part of the law; The mere access is regulated. The EU is therefore going beyond the social media ban in Australia, which only affects accounts. The affected online services will be available in the futureonly openly accessible in a child-friendly versionbe. Otherwise, they should check the age of their users (Article 8).
According to the draft, the following are affected:social mediaandVideo platformsalsoOnline games,ChatbotsandAI Companionsas well as Software marketplaces. This is likely to affect many popular online services: from games like Roblox or Fortnite to chatbots like ChatGPT and Claude to the Apple App Store, the Google Play Store or the gaming platform Steam.
There is a special feature for software marketplaces: They should, therefore, advertise their offersAppsandgames,withAge labelsand ensure before installation that users are not too young (Article 16). Such labels already exist, although they are not uniform and EU-wide. This is exactly what the EU Commission now wants to stipulate. As a result, providers would have tohttps://de.statista.com/statistics/data/studies/208599/umfrage/anzahl-der...from millions of titlesrevise. Also alternative marketplaces likehttps://f-droid.org/de/">F‑Droidcould fall under regulation.
The type of age checks is less narrowly defined for the services mentioned here. The EU Commission only writes about “age assurance”. This is an umbrella term that, according to the draft, combines several approaches to age controls (Article 3). This includes, on the one hand, “age verification”, i.e. the strictest methods that are based on evidence such as ID data; on the other hand, “age estimation”, i.e. alternative methods that are based on estimates, such as a biometric scan of the face.
–––
The work of netzpolitik.org is financed by donations from our readers.
Become part of this unique community and support our public interest-oriented, advertising- and tracking-free journalismhttps://netzpolitik.org/spenden/?via=rss">nowwith a donation.
–––
The plans for comprehensive age controls raise the question of which places on the Internet actually pose no risks for minors. The EU Commission lists a number of things for this purposeExceptionswhich should not be covered by the EU Kids Act (Article 2). These include non-commercial onesOnline encyclopedias, which probably includes Wikipedia, services forEducation,Scienceand publicAdministrationas well as platforms for developmentmore open source software.
A regulation that makes no sense whatsoever
From the beginning, the debate about age controls was dominated by –https://netzpolitik.org/2025/australisches-gutachten-unternehmen-von-alters...– Concern accompanies that the controls lay the foundation for mass surveillance and ID requirements online. Apparently the EU Commission wants to raise these concernsAge verification requirementsdisperse.
According to the draft law, “age assurance” must have a “high level of accuracy, reliability, security, robustness, low level of intervention, data protection and non-discrimination” (Article 27). The crux of the matter: These claims can use technologies to determine agehttps://netzpolitik.org/2026/alterskontrollen-der-pudding-wird-uns-auf-d...actually not fulfilled. The more precise and robust a control is supposed to be, the deeper the intervention is and the greater the compromises in terms of participation or privacy. Age estimation in particular cannot meet these requirements. Because assessments, for example via facial scans,https://www.forbes.com/sites/janicegassam/2025/08/13/ai-age-checks-are-h...not exactlyand still require sensitive biometric data from people.
The following sentence from the draft law is particularly strange: “Any age assurance measure shall be zero knowledge proof” (Article 28). The EU Commission uses one herehttps://de.wikipedia.org/wiki/Null-Wissen-Beweis">Technical termfrom encryption technologylike an adjective - but it's a noun. The English word “proof” here does not mean “protected”, but rather “evidence”.
Zero Knowledge Proof is a process that is intended to ensure the anonymity of users, for example when proving their age. But there are also other methods. Zero knowledge proof is not even mandatory in the EU's age control app. In short: the regulation proposed by the EU Commission, according to which “every” measure for age control “uses this procedure”be"should, makes no sense grammatically or in terms of content. This is a reference tolack of technical expertiseof the design.
Parents should prove that they are parents
The EU Commission's plans present special hurdles for parents and legal guardians. You should take action and get a parent account if your child under 15 wants to be on TikTok or Instagram, for example (Article 6).
That's what they should doParentsor legal guardians provide three pieces of evidence. Firstly, thatProof of age for yourself, because everyone needs it. Second, oneProof of age for your child,who must be at least 13 years old. And thirdly, a kindProof of custody– to prove that they are actually allowed to set up an account for the child in question (Article 26).
There is currently no infrastructure with which platforms such as TikTok, Instagram or YouTube could receive and check such evidence. It is precisely this control apparatus that the EU Commission wants to create. The EU Commission describes several possible procedures in its draft law. At least for the time being, it could be sufficient for legal guardians to simply confirm their role (“self declaration”). The draft also names state databases from which online services can query information about custody rights.
It goes on to say that Member States should provide a way “by which a legal guardian may obtain and present a certificate of parental responsibility for a minor” (Article 31). Supposedly, this new proof is intended to protect privacy and be easily accessible - even for people with disabilities or limited digital skills, also for refugees or for people who lack the typical papers for the children for whom they are responsible. This begs the question: Has there ever been a government credential that is easily accessible to such diverse groups?
Parent accounts allow little leeway
TheParent accountsAccording to the EU Commission, they are said to be very powerful. When it comes to risky social media and video platforms, parents should advise in advanceConfirm every new contact your child hascan (Article 6). However, you should be able to set how long your child can use the accountno more than an hour a day.
Mind you: This is about 13 and 14 year olds, i.e. young people who are increasingly independent, often already on their first dates or riding e-scooters. Depending on the structure of the parents' accounts, adults may have little scope to reduce control, for example because they already have more confidence in their child.
Guidelines for the protection of minors should become law
Many provisions in the draft describe binding onesStandards for more child and youth protectionon the net. The basis for this is thehttps://netzpolitik.org/2025/jugendschutz-leitlinien-eu-kommission-gabe-...the EU Commission explains how online providers have to protect minors under the Digital Services Act (DSA). However, these guidelines are not binding - the EU Kids Act would make the regulations into law.
Tech companies are likely to be up in arms against some of them because they make money from their users' attention, even if it could harm their well-being. This is roughly what the draft looks likeProhibition of addictive functionsfor minors, aimed at social media and video platforms.
Accordingly, they may not design their services in such a way as to “incentivize compulsive or excessive use by minors” (Article 9). Specifically, the law names widespread psychological tricks used by tech companies such as automatically starting videos, app notifications or rewards for regular use. Further regulations concern recommendation systems (Article 10) or contact options with strangers (Article 12).
Fundamental rights of children and adults “massively” impaired
Several experts and committees have already commented on social media bans and age controls in advance, more on this in ourhttps://netzpolitik.org/2026/eckpoints-geleakt-eu-commission-will-social...Article.
An initial assessment of the specific draft law comes from the spokespersonChaos Computer Clubs, Elina Eickstädt. “The proposal from the EU Commission that has become known meets almost all of the concerns we have with regard to age assessment online,” she writes when asked. The proposal would “spell the end of free and anonymous internet use.” Meanwhile, essential technical questions remained unresolved. The concept of parent accounts poses “immense danger in terms of monitoring by parents”.
The EU Commission's proposal will “massively affect the fundamental rights of children and adults,” warns Svea Windwehr, co-chair of the Association for Digital PolicyD64. Online platforms are important places for young people to experience community. “Putting these rooms under parental supervision and limiting access to them to one hour a day deeply encroaches on the right to social participation,” writes Windwehr. Not all children have trusting relationships with their parents or guardians. “These young people in particular are being deprived of spaces in which they could receive support.”
Windwehr also warns against age checks for everyone, especially with the age check app touted by the EU Commission. As things stand, the app “does not meet basic privacy requirements” and threatens to “exclude millions of people without access to digital identities.” With the planned age controls, the Commission cannot ensure “that the privacy, security and social participation of millions are protected”.
The protection against harmful designs and functions planned by the EU Commission does not go to the root, criticizes Simeon de BrouwerEDRi, the umbrella organization of organizations for digital freedom rights. “If design is harmful to 13-year-olds, it doesn’t magically become safe at their 15th or 18th birthday,” he writes. The EU Commission is trying to “clumsily” shield young people from exploitative systems.
As soon as the EU Commission has officially presented its draft, the EU Parliament and the Council of Ministers can deal with it.
–––
The work of netzpolitik.org is financed by donations from our readers.
Become part of this unique community and support our public interest-oriented, advertising- and tracking-free journalismhttps://netzpolitik.org/spenden/?via=rss">nowwith a donation.
Read the full story at the source
Source: de.indymedia