EU’s under-13 ban is only a proposal

The European Commission on 17 September proposed the EU KIDS Act, a regulation that would set different access rules by age for social media, online games, AI companions and video-sharing services. Several outlets described this as an EU ban already in force. It is not. The proposal (COM(2026) 681) must still pass through the European Parliament and the Council (where national ministers negotiate and can rewrite the text) before it becomes law (Commission announcement). Two questions sit at the centre of that negotiation: whether countries may impose stricter limits than Brussels proposes, and how platforms can verify a child's age without creating a new privacy problem.

What the proposal would do

The KIDS Act creates four age bands. Under 13, no access. At 13 and 14, a parent could open a restricted account with a one-hour daily limit, approved contacts only and cameras off by default. From 15, teenagers could manage their own accounts. Mandatory safety settings, such as private-by-default profiles and limits on infinite scrolling, would apply to everyone under 18 (Commission package).

The legal burden falls on platforms, not families. Providers would have to build the access gates, enforce the default settings and submit compliance reports to independent auditors, whose findings national regulators would then act on (DG CONNECT). The scope runs wider than social media: it covers online games that pose relevant risks, AI chatbots and app stores (COM(2026) 681, BiometricUpdate).

The existing Digital Services Act already bans advertising targeted at known minors through profiling, but sets no minimum access age (DSA). The KIDS Act would turn that broad child-safety duty into specific rules: concrete age lines, product defaults and evidence platforms must provide to regulators.

National ministers disagree on the numbers

Denmark, Spain and France all back EU-level action but want different thresholds. Danish digitalisation minister Christina Egelund wants a flat ban below 15 with no parental workaround for younger teenagers (DR). Spain's pending organic bill would set the line at 16 (La Moncloa). France's own attempt at national rules collapsed in 2026 when the Conseil constitutionnel (France's constitutional court) struck down a social-media age bill for disproportionately restricting expression and failing to define adequate privacy safeguards (Conseil constitutionnel).

These are early national positions, not settled Council blocs. They become legislative leverage only if ministers build coalitions during negotiations. But the disagreement exposes a deeper ambiguity in the Commission's own text. Brussels describes the proposal as creating "one age across the European Union," yet also calls 15 an EU-wide "minimum age" (Artículo14, Berlingske). Those two phrases point in different directions. If the regulation leaves countries no room to impose a higher age, Denmark's 15 and Spain's 16 are legally incompatible. If it sets only a floor, countries could go higher. The Commission's public messaging has not clarified which it intends.

Age checks remain the proposal's weak point

Every age rule depends on knowing how old a user actually is. The Commission has published a verification tool meant to confirm that someone is above an age limit without disclosing their identity (Commission age-verification solution). Germany's digital industry association Bitkom warned that the national eID is generally unavailable before 16, making a system relying only on the EU digital identity wallet impractical for the children it is supposed to cover (Bitkom). France's data-protection authority CNIL considers self-declaration useless, document uploads risky and facial estimation unreliable (CNIL). Australia's government trial of age-assurance technologies found no single method that works reliably (Australian trial).

France's constitutional defeat sharpens the stakes. The Conseil constitutionnel tested a national law against French fundamental rights and found it wanting. An EU regulation would face equivalent scrutiny under the EU Charter of Fundamental Rights, which protects freedom of expression (Article 11), privacy (Article 7) and personal data (Article 8) (EU Charter). Any challenge would land at the Court of Justice of the EU in Luxembourg, applying a similar proportionality test.

The Commission has drawn the age lines. Parliament and national ministers must now decide whether those lines are uniform across the bloc and how platforms can enforce them without collecting more personal data than the rules were designed to protect.