On 17 September 2026, the European Commission published its Proposal for the EU KIDS Act – ‘EU Keeping Internet Digital Spaces Accountable and Trustworthy’ (the “EU Kids Act”), alongside a Communication from the Commission to the European Parliament and Council on online child safety (the “Communication”).
The EU Kids Act contains proposals related to:
- Staggered age restrictions on social media platforms;
- Safety-by-design obligations for online platforms which have users under the age of 18;
- Age assurance / verification measures; and
- A supervision and enforcement regime for the obligations under the EU Kids Act.
Background
The EU Kids Act follows the recommendations of the Co-Chairs of a Special Panel of experts on child safety online, whose report was presented to Commission President Ursula von der Leyen in July 2026. The Commission notes that only half of children aged 9-16 across Europe report feeling safe online, with cited risks including reduced physical activity, sleep disruption, anxiety, decreased self-esteem, eating disorders, cyberbullying, grooming and child sexual abuse.
The Commission also points to a proliferation of divergent national initiatives, noting that Italy, France, Norway, Greece, Austria, Poland and Belgium notified draft legislation restricting minors’ access to digital services in 2025 and 2026, with consultations or draft legislation under discussion in almost all other Member States. The Irish government stated that they would explore national measures in the absence of an EU-wide proposal. Certain member states, such as Germany, are continuing to explore interim measures while the EU Kids Act negotiations are ongoing. The Commission considers that these national measures risk fragmenting the internal market, reducing legal certainty and increasing compliance costs, while leaving an uneven level of protection for children across the EU.
The EU Kids Act is designed to specify and complement the existing obligations on providers of online platforms under Article 28 of the Digital Services Act (Regulation (EU) 2022/2065) (“DSA”) and the AI Act (Regulation (EU) 2024/1689).
Scope of the EU Kids Act
The EU Kids Act will apply to providers of online social networking services, video-sharing platform services, software application stores, online games, operating systems, AI companions and general conversational chatbots that are accessible to minors. Providers established outside the EU are in scope where they offer these services to recipients located in the Union, or, in the case of AI companions and general conversational chatbots, where they place the system on the market or put it into service in the Union.
The EU Kids Act is drafted to cross-reference definitions from a range of other EU regulations in this sector including the Digital Markets Act (Regulation (EU) 2022/1925) (the “DMA”), the DSA and the EU AI Act. We have explained some of the most important definitions for understanding the scope of the EU Kids Act in the table below:
| Term | Definition |
| “online platform” | a hosting service that, at the request of a recipient of the service, stores and disseminates information to the public, unless that activity is a minor and purely ancillary feature of another service or a minor functionality of the principal service and, for objective and technical reasons, cannot be used without that other service, and the integration of the feature or functionality into the other service is not a means to circumvent the applicability of this Regulation. |
| “online social networking service” | a platform that enables end users to connect and communicate with each other, share content and discover other users and content across multiple devices and, in particular, via chats, posts, videos and recommendations. |
| “video-sharing platform service” | a service… where the principal purpose of the service or of a dissociable section thereof or an essential functionality of the service is devoted to providing programmes, user-generated videos, or both, to the general public, for which the video-sharing platform provider does not have editorial responsibility, in order to inform, entertain or educate, by means of electronic communications networks… and the organisation of which is determined by the video-sharing platform provider, including by automatic means or algorithms in particular by displaying, tagging and sequencing. |
| “software application stores” | a type of online intermediation services, which is focused on software applications as the intermediated product or service. |
| “operating system” | a system software that controls the basic functions of the hardware or software and enables software applications to run on it. |
| “AI system” | a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. |
| “general-purpose AI system” | an AI system which is based on a general-purpose AI model and which has the capability to serve a variety of purposes, both for direct use as well as for integration in other AI systems. |
| “general conversation chatbot” | a general-purpose AI system with general conversational functionalities for direct interaction with users that is capable of providing assistance across multiple domains and tasks; this definition excludes AI systems whose conversational functionality is limited to a specialised service, task or pre-defined set of functions, including specialised customer-service, business operation, technical-support, transactional, educational, information-retrieval, industrial or manufacturing AI applications |
Certain categories of online service will be excluded from the scope of the EU Kids Act, including not-for-profit online encyclopaedias, not-for-profit educational and scientific repositories, services operated by educational establishments for primarily educational purposes, open-source software-development and sharing platforms (unless they themselves constitute an in-scope AI system), services operated solely for scientific research, and services designed, developed and operated by public authorities for their own exclusive use.
Notably, the EU Kids Act proposal does not exempt small and micro enterprises from its scope, on the basis that such providers may equally give rise to harms to minors.
Key provisions
A harmonised minimum age for social media accounts
The focus of much of the discussion surrounding the EU Kids Act is a new EU-wide minimum age of 15 for creating fully-featured accounts on online social networking services or video-sharing platform services, where that service poses a risk to the privacy, safety or security of minors below that age (for example, because it allows real-time content dissemination, contact with unknown users, includes profiling-based recommender systems, or has design features intended to encourage uninterrupted or compulsive use). Providers will be permitted, however, to allow a guardian to set up a limited-functionality account for a child aged between 13 and 15, subject to verification of parental responsibility. Certain video-sharing platform services specifically designed for younger children may also be accessed by children below 13, exclusively through a guardian-controlled account.
Chapter II, Section I, which addresses delayed access for minors, applies only to online social networking services and video-sharing platform services, and does not extend to other online platforms, video games or AI platforms. Section II addresses guardian-controlled access for video-sharing online platforms only (ie, default parental controls including a maximum use time of 1 hour per day for users under 13 years old).
Safety-by-design obligations
Providers of in-scope social networking services, video-sharing platforms, AI companions, general conversational chatbots and online games must implement a range of safety-by-design measures where minors are using the service. These include prohibitions on design features intended, or reasonably foreseeable, to encourage compulsive or excessive use (such as infinite scrolling and engagement-driven notifications); restrictions on profiling-based recommender systems; high-privacy default account settings that cannot be changed without a user’s explicit consent (provided the user is over 15 years old); restrictions on unsolicited contact from other users; and transparency requirements around in-service economic transactions, including a prohibition on exposing minors to variable reward systems such as loot boxes.
AI companions and general conversational chatbots are subject to additional requirements, including measures to prevent features likely to create emotional dependency and a default prohibition on persistent conversational memory of interactions with minors.
These safety-by-design requirements within the EU Kids Act are only obligatory where minors are using the platform, it is expected that further general obligations will be included in the Digital Fairness Act proposal later this year. This proposal is currently scheduled for 11 November 2026.
Age-assurance
Providers of social networking services and video-sharing platforms must perform age verification when a new account is opened, and the EU Kids Act envisages this being carried out principally through an EU age verification solution built on a ‘zero-knowledge proof’ model, certified under an EU Age Verification Scheme. Self-declaration of age will not be sufficient for compliance. The EU Kids Act is proposed to be less prescriptive for providers of AI chatbots, online games, or software application stores, who may use alternative age assurance solutions provided it meets the requirements in relation to accuracy, reliability, robustness, non-intrusiveness, privacy, data protection and non-discrimination. The Commission’s FAQs on the EU Kids Act are clear that platforms themselves will not be verifying age, it will be verified through independent certified solutions.
It is not necessary to carry out age verification for existing accounts where the provider can establish, with a high degree of certainty, that the user is not a minor (eg, on the basis of account creation date, or credit card details). For other safety-by-design obligations, providers may rely on age verification or other age assurance methods that meet stated criteria of accuracy, reliability, robustness, security, non-intrusiveness and non-discrimination. Additionally, where a provider of an operating system has obtained an age signal from a specific user, they are required to share this age signal with providers of other online platforms who are in scope of the EU Kids Act.
Software application stores and online games
Under the EU Kids Act, providers of software application stores will be required to operate an age-rating system and prevent minors from accessing or purchasing applications, including online games, that are not age-appropriate. Online games will separately be subject to safety-by-design obligations addressing addictive design and unsolicited contact risks.
Parental / guardian controls
Effective and user-friendly tools for guardians will be be mandatory for providers of online social networking services, video-sharing platform services, AI companions, general conversational chatbots and online games. The controls must be tailored to the age of the minor, easy to use etc. The tools must include mechanisms to ensure time limited access, and to enable reporting of content by guardians on behalf of minors. The Commission will be empowered to adopt a delegated act to lay down technical and operational requirements for these tools for guardians. These tools are complimented by provisions for verification of parental responsibility, which may initially be based on self-declaration until a delegated act is adopted to specify signals indicating parental responsibility.
Enforcement
The EU Kids Act builds on the existing enforcement architecture under the DSA and the AI Act, rather than requiring the appointment of a new stand-alone regulator by Member States. The Commission retains exclusive competence to supervise and enforce the obligations of providers designated as very large online platforms (“VLOPs”) under Article 33 of the DSA. Such providers must, within four months of their VLOP designation, notify the Commission of a compliance plan addressing the obligations under the EU Kids Act, supported by an independent audit.
Where the Commission launches proceedings related to a suspected infringement of the EU Kids Act, they are expected to aim to adopt a final infringement decision within 90 days of opening proceedings, and to communicate preliminary findings within 30 days. Enforcement of the EU Kids Act by the Commission will be funded via a supervisory fee integrated into the existing DSA supervisory fee regime.
For platforms which are not designated as VLOPs, supervision will be at a Member State level. Enforcement for intermediary services comes within the existing supervision and enforcement regime under the DSA, with supervision and enforcement for AI companions and general conversational chatbots coming within the EU AI Act (as established by the recent Regulation of AI Act 2026 discussed here). The national competent authorities already selected under these regulations will need to be empowered by Member States to enforce the EU Kids Act. Therefore, in Ireland, it is expected the Coimisiún na Meán, the Competition and Consumer Protection Commission, the AI Office of Ireland, among other regulators, will oversee the supervision and enforcement of the EU Kids Act.
Complementary Measures
The communication published by the Commission alongside the EU Kids Act proposal situates the proposal within a wider package of measures. The Commission has indicated it will also bring forward a Digital Fairness Act (scheduled for 11 November 2026), a revision of the Consumer Protection Cooperation Regulation, a revision of the Audiovisual Media Services Directive, an Action Plan on Protecting Children from Crime, and an Education package addressing digital and AI literacy in schools.
Importance of the EU Kids Act for providers
Any business providing online social networking services, video-sharing platforms, online games, software application stores, operating systems, AI companions or general conversational chatbots that are accessible to minors in the EU should begin considering the potential impact that the EU Kids Act will have now, notwithstanding that it remains subject to negotiation. This is particularly relevant for businesses relying on account-based social or communication features, recommender systems, in-app purchases or monetisation mechanics, or AI-driven conversational products.
While the EU Kids Act will introduce a wide range of obligations for such providers, it does present the potential benefit of avoiding a range of diverging national measures across the EU. In avoiding this fragmentation, the EU Kids Act may lead to reduced compliance costs for providers who can introduce EU-wide compliance measures.
Next steps
It is not yet clear precisely when the EU Kids Act requirements will come into effect, the EU legislative process is frequently lengthy (~18 months between the publication of a proposal and the final regulation being agreed). This process may be accelerated given the political momentum behind child safety online across the EU. During the course of trilogue negotiations involving the European Parliament and the Council of the European Union, there may be changes to the initial proposals which affect the obligations on providers of online platforms. We will monitor the negotiations closely and provide any relevant updates.
As the EU Kids Act is a regulation, it would have direct effect in each Member State once it enters into force, though implementing legislation will be required for certain aspects (such as to empower national regulators). As drafted, the EU Kids Act would enter into force on the twentieth day following its publication in the Official Journal, and would generally apply six months after that date, save that the compliance-plan notification obligation for VLOPs would apply from the date of entry into force, and the provisions on national preparedness measures and the Commission’s incident-response mechanism would apply twelve months after entry into force.
As mentioned, this EU-level proposal came before any wide-reaching proposal was progressed at a national level in Ireland. On 29 September 2026, a private member’s bill titled the Artificial Intelligence Companion Services (Protection of Children) Bill 2026 was initiated before Dáil Eireann, proposing to restrict children’s access AI companions / chatbots. It remains to be seen if any progress is made on this bill, given that AI chatbots are also addressed by the EU Kids Act (which, as noted in the Dáil Eireann debate surrounding the bill, was not anticipated when the bill was initially prepared).
Contact us
If you have any questions on the EU Kida Act, please contact any member of our Technology and Innovation Group or your usual Matheson contact.
