The European Commission adopted the EU KIDS Act on 17 September, and the headline that travelled fastest was the number. No social media accounts below thirteen. A Union-wide minimum of fifteen for an independent account. Supervised accounts with restricted features in between. Age thresholds are easy to report and easy to argue about, which is precisely why they have absorbed most of the attention. They are also the least interesting part of the proposal.
The structurally significant change is the reversal of the burden of proof. Under the existing framework, regulators must generally demonstrate that a service has caused or risks causing harm before intervening. The KIDS Act inverts that: providers must show that their services are age-appropriate and safe by design. This shifts the evidentiary burden from an under-resourced supervisory apparatus onto companies with the engineering data to answer the question. It is closer in spirit to pharmaceutical or product safety regulation than to the notice-and-action tradition that has governed online platforms in Europe for two decades.
The second significant choice is scope. The proposal does not confine itself to social media. It covers video-sharing platforms, online games, and — most consequentially — AI chatbots and companion applications. Extending a child-safety regime to conversational AI at the point of drafting, rather than retrofitting it three years after a harm becomes visible, is an unusual instance of European regulation attempting to arrive early. Whether the definitions hold as the product category mutates is another question. Companion applications are a moving target, and legislative text written in 2026 will be interpreted against products that do not yet exist.
The third element is behavioural rather than access-based. The proposal targets design features rather than content: a prohibition on addictive mechanics, on infinite scroll, on push notifications delivered to children during sleeping hours. This is the most defensible part of the package on the evidence, because the causal link between engagement-maximising design and displaced sleep is considerably better established than the link between screen exposure and any particular psychological outcome. It is also the part that platforms will find hardest to litigate, since a notification schedule is a verifiable engineering fact rather than a contested editorial judgement.
The enforcement architecture rests on penalties of up to six per cent of global annual turnover. That figure is calibrated to be material for the largest firms rather than merely irritating, and it signals that the Commission intends this to sit alongside the Digital Services Act as a first-order compliance obligation rather than a peripheral one.
The unresolved problem is verification. An age threshold is only as good as the mechanism that enforces it, and Europe does not currently possess a deployed, privacy-preserving age assurance infrastructure at continental scale. The credible options each carry a cost. Document-based verification creates identity databases that are attractive targets and that many member states are constitutionally uncomfortable with. Inference from behavioural signals is precisely the profiling the Union has spent a decade restricting. Device-level or wallet-based attestation is the most promising route, but it depends on national digital identity rollouts that are proceeding at very different speeds across the twenty-seven. A regime that mandates age gating without solving assurance will either be unenforced or will be enforced through the most privacy-invasive method available, which would be a perverse outcome for a legal order that treats data protection as a fundamental right.
There is also a jurisdictional question the text cannot settle on its own. Family law, the age of digital consent and the regulation of parental authority sit close to national competence, and the existing data protection framework already permits member states to set their own digital consent age between thirteen and sixteen. Harmonising upward to fifteen will be read in some capitals as a competence question rather than a child-safety one.
None of this is settled. The Commission has proposed; Parliament and Council will now spend the better part of two years negotiating. The age numbers will move. The burden reversal and the inclusion of AI companions are the provisions worth watching, because they will shape what European platform regulation looks like long after the arguments about thirteen versus fifteen have been forgotten.
