EU KIDS Act: 5 things you need to know

Last week, the EU Commission published a proposal for the EU KIDS Act. This draft regulation includes a graduated series of age restrictions on children’s social media access and an extensive package of design and functionality restrictions for a host of online services. If agreed in its current form, children under 15 would be prohibited from opening their own social media or video sharing accounts on sites with “risky features” (which would capture most household name platforms). Children aged 13 and 14 would only be permitted parent-supervised accounts with limited functionality and children under 13 would not be allowed accounts at all (subject to a narrow exception for video-sharing platforms designed for them). Beyond these headline age restrictions, here are five key things to know about the Act’s proposals: 

1. Services in scope: The proposals don’t just apply to social media companies but would introduce a wide range of restrictions and obligations impacting services across the digital ecosystem. They would also impact video sharing platforms, online games, AI chatbots and companions, and app stores. The most onerous obligations would be reserved for those platforms designated “Very Large Online Platforms” (VLOPs) under the EU’s Digital Services Act (DSA). 
    
2. Design obligations: The Commission has emphasised that most of the Act addresses how services are built, and safety-by-design for children. The proposals would prohibit services from being designed to “encourage compulsive or excessive use” by minors. To support this, certain features would be restricted or prohibited for children. These would include: autoplay and infinite scroll without breaks, certain push notifications, rewards for posting or streaming to mass audiences and streaks that encourage daily usage. Services would need to implement screen time limits to protect sleep and school hours. New restrictions would also be placed on recommender systems and livestreaming, while additional rules would ban stranger contact without pre-approval. 
    
3. Age assurance: New robust and prescriptive rules on age assurance are central to the KIDS Act. The Act would require child-safety protections to be applied to all users by default unless the user is established to be an adult (using age assurance, unless the provider can otherwise establish this with a high-degree of confidence). Unlike the DSA or current UK online safety and data privacy rules that have (to date) provided services with broad discretion around age assurance methods, the draft KIDS Act includes more concrete rules. For example, self-declaration is ruled out, age assurance solutions would need to involve zero-knowledge-proof, and social media services would need use EU-certified age verification solutions. 

4. Compliance plans and enforcement: Existing VLOPs would be required to notify compliance plans to the Commission, outlining how they would meet the requirements of the KIDS Act, within 30 days of the Act entering into application. The plans would need to be submitted to an independent auditor, appointed at the expense of the VLOP, for review. The Commission views these requirements as “reversing the burden of proof”, as large providers would need to explain up front how they would comply with the rules.

   The KIDS Act proposals carry across the enforcement framework from the DSA and AI Act (for AI chatbots and companions) to apply to KIDS Act breaches, with their penalty levels also carried across. 

5. Timing: The KIDS Act will now be debated by the European Parliament, EU Council and Commission according to normal EU procedure. A number of elements are likely to be controversial, including the approach to age assurance and the age limits envisaged (early reports suggest that some Member States, including Spain, are already pushing for a higher age limit for social media access). While the Commission is calling for urgency, it could be 12 months or more before the Act passes into law. Most requirements would then start applying six months later. 

Our view

The EU isn’t the first territory out of the gate on social media age restrictions and it shows. While the UK’s social media ban proposals (discussed here) were described as being “Australia-plus”, the EUs proposals can perhaps best be described as Australia-plus-plus. These fulsome proposals represent the Commission’s response to significant national pressure to protect minors. Yet, they also go beyond what many predicted and mark a concrete shift in approach from the DSA. This is significant for two reasons. First, there is an implicit recognition, including in the EU’s materials accompanying the Act, that the DSA has failed to impose the hard-edged rules required to keep children safe online. Second, if agreed in its current form, the Act would represent a significant transfer of power to Brussels, by giving the Commission more granular control over platform design and social media usage than it has had to date under the DSA. 

As the new KIDS Act could reshape how young people experience the internet, how online services are designed and how much power over all this sits with the Commission, we should expect more debate.