The European Commission’s proposal for an EU KIDS Act, presented by Ursula von der Leyen on 17 September 2026, does something the bloc’s digital rulebook has so far avoided. It sets a number. Children under 13 would be barred outright from social media platforms, and 15 would become the EU-wide minimum age at which a minor may open an account in their own right. After a decade in which European regulators preferred process obligations to bright lines, Brussels has chosen a threshold and invited twenty-seven parliaments to defend it.
The choice is consequential because bright lines are testable. Risk-assessment duties of the kind embedded in the Digital Services Act are enforced through negotiation between a regulator and a company over the adequacy of internal procedures, a contest in which the better-resourced party usually holds the advantage. An age floor is different. Either a platform can demonstrate that its under-13 population is close to zero or it cannot. That clarity is the proposal’s principal strength, and it is also the source of its central difficulty, because enforcing an age limit requires knowing users’ ages, and knowing users’ ages requires some form of verification.
This is the hinge on which the entire file will turn. Europe has spent years insisting on data minimisation as a foundational principle, and age assurance pulls in the opposite direction by inviting platforms to collect identity documents or biometric estimates from every user, adults included. The technical answer exists in the form of zero-knowledge attestations, where a trusted issuer confirms that a person is above a threshold without revealing who they are, and the Commission’s work on the European Digital Identity Wallet provides the obvious rails. Whether that infrastructure will be mature and widely adopted by the time the obligations bite is a question the legislative text cannot settle on its own.
The scope is broader than the phrase “social media” implies. The proposal reaches video-sharing platforms, online games and, notably, AI companions and chatbots. Including conversational agents is the most forward-looking element of the package. Recommender feeds shape what a young person sees; a synthetic companion shapes how a young person relates, and the developmental literature on parasocial attachment gives ample reason to treat the two as distinct categories of risk. That Brussels has legislated for the second before a mass-market harm has crystallised is unusual, and arguably overdue.
Equally significant is the turn against design itself. The proposal would prohibit profiling-based recommender feeds for minors, infinite scrolling, reward mechanics, push notifications during sleeping hours, and unsolicited contact from strangers. This is a direct attack on the engagement-optimisation model rather than on any particular piece of content, and it reflects an intellectual shift within European regulation. The older theory held that platforms were dangerous because of what circulated on them. The newer theory holds that they are dangerous because of how they are built. Content moderation treats symptoms; design rules address the mechanism.
The commercial consequences follow from that. Attention-maximising architecture is not a bolt-on feature but the revenue engine of consumer internet services, and requiring a chronological, non-personalised, notification-quiet experience for a substantial share of European teenagers removes a meaningful portion of the monetisable inventory. Expect the affected firms to argue that a service without personalisation is a service without relevance, and expect European publishers and game developers, who did not design the incentive structure but must now live under it, to press for careful scoping of what counts as a reward mechanic.
The text now passes to the European Parliament and the Council, where the age thresholds are the most likely casualty. Member states with existing national rules will push in different directions, and the exact figures of 13 and 15 have more political than empirical precision behind them. The more durable achievement may be the design provisions, which attract less public argument while doing most of the regulatory work.
Whatever emerges, the framing has moved. Europe is no longer asking platforms to police what children encounter. It is asking whether children should encounter these products in their current form at all.
