European Commission unveils EU KIDS Act

A day after European Commission President Ursula von der Leyen teased the EU KIDS Act during the State of the Union address to European Parliament, the Commission formally rolled out the proposal, which contains bracketed age restrictions and platform requirements around minors' access to social media. 

The proposed regulation imposes a blanket ban on children under age 13 from creating social media accounts, following in the footsteps of both Australia and the U.K., which have introduced bans on children under 15 and 16 years old, respectively, from establishing social media accounts. 

Beyond the under-13 ban, the EU proposal would allow children ages 13 and 14 to create limited social media accounts that can be accessed only through a parent or guardian's own account and would be designed to only allow "child-friendly video-sharing services," according to the proposal. Children ages 15 and older would be allowed establish full accounts under the regulation, as proposed. 

"Today, our children are engaging with the most sophisticated technologies ever created. Technology that was never created with their wellbeing in mind," von der Leyen said in a statement following the adoption of the proposal. "Our KIDS Act is reversing the burden of proof — it is for platforms to show they are safe by design. And we put parents back in the driving seat, giving them the tools to help their children navigate a safer online world."

The KIDS Act requires very large online platforms, as designated by the Digital Services Act, to demonstrate to the Commission their products and services are built with safety-by-design principles. It calls for banning addictive design features, "profiling-based recommender feeds," infinite scrolling capabilities, reward tricks, push notifications during sleeping hours and the ability for strangers to contact minors unsolicited. 

Additionally, it carries proposed requirements for implementation of "privacy preserving" age assurance tools. One acceptable method for platforms will be to integrate with the European Commission's open-source EU Age Verification Solution that is expected to be released by the end of the year. 

These requirements apply to any VLOP offering social media services, video sharing, online video games and artificial intelligence companions and chatbots to users under age 18.

Enforcement provisions

On the enforcement side, the KIDS Act, as von der Leyen indicated, shifts the "burden of proof" onto VLOPs for demonstrating adherence to safety by design principles. All platforms must submit compliance plans to the European Commission and subject any new product or service to an independent auditor. The Commission can then issue corrective measures to a platform based on the auditor's report.

Investigations stemming from alleged violations of the KIDS Act are to be fast-tracked by the Commission and conclude within 90 days. Penalties for violations can be as high as 6% of global annual revenue. VLOPs will also be required to pay a fee to cover the cost of regulators' supervisory efforts.

"With our EU KIDS Act, we make sure our children can enjoy their rights online — to learn, stay connected and explore," European Commission Executive Vice President for Tech Sovereignty, Security and Democracy Henna Virkkunen said in a statement. "We also give parents the tools to accompany their kids to navigate a safe digital world. All of this by keeping the pressure high on platforms, because they must prove their services do not harm."

Privacy advocates, tech industry weigh in

Skepticism exists around how the Commission's age assurance scheme can be effectively implemented without compromising individuals' privacy online, according to both advocates and platforms. Additionally, critics of Australia's youth social media ban have said the law has not worked as intended, and teenagers are finding relatively easy workarounds to access social media just as they were before the ban took effect, as identified by Australia's eSafety Commissioner in August. 

Speaking to The New York Times following von der Leyen's 16 Sept. address, European Consumer Organisation Director Agustín Reyna said existing age verification proposals are not a "silver bullet." 

"Children clearly need better protection online, but age verification is not a silver bullet and would raise serious privacy and data protection concerns of its own," Reyna said.

Tech lobbying group CCIA Europe also flagged potential privacy concerns in the age assurance requirements. 

"Collecting age information, identity credentials, and data linking children with ⁠parents or guardians at this scale would undoubtedly create an attractive target for cybercriminals," CCIA Senior Vice President for Europe Daniel Friedlaender told Reuters. "The Kids Act creates legal overlap and duplication that ultimately weaken protections for children and consumers."