EU proposes a social media ban for under-13s

The European Commission has adopted the EU KIDS Act, a proposal for a regulation that sets common age rules across the European Union and rewrites how the services children use most are allowed to be built. It bans social media accounts for anyone under 13, opens the door to guardian-supervised accounts from 13, and sets 15 as the age at which a teenager can hold an account of their own.

What age rules would the EU KIDS Act set?

The proposal works as a staircase. Under 13, no account at all. From 13 to under 15, a guardian can set up a limited account and stays in control of it: parental tools are always on, the daily time limit is at most one hour, and a guardian approves contacts. From 15, young people can open their own account, in a service that the law would require to be safe for them.

Those age rules apply to social networking and video-sharing services with proven risky features. One narrow route is left open for younger children: on video platforms designed specifically for small children, a guardian may allow limited access through their own account, with no child account, no personalised feeds or search, a daily limit of up to one hour, and a switch the guardian can flip at any time.

How would age verification actually work?

Self-declared birthdays are explicitly not enough. Access would have to be gated by certified age verification, and the Commission's plan keeps the checking away from the platforms: age is confirmed through solutions independent of the service, including a free EU age verification app and, in time, the European Digital Identity Wallet. Platforms would not see identity documents and would learn only whether a user is above or below an age threshold, using zero knowledge proof so nobody can be identified, located, tracked or profiled. Every member state would have to offer at least one free way to prove age, including for people without digital ID.

Existing accounts would get a check too. Within six months of the rules applying, platforms must establish whether current account holders are under 15 and disable the accounts of those who are, or whose age cannot be established. Where a platform can already tell with high confidence that a user is an adult, no new check is required.

What does safe by design mean for games and apps?

The second half of the proposal is about how services are built, and it names the techniques it wants gone for minors: endless autoplay and infinite scrolling without real breaks, notifications designed to pull a child back that have nothing to do with anything the child did, rewards for posting or streaming to mass audiences, and streak mechanics that penalise a child for not returning every day. Services would also have to provide effective time limits and usage breaks designed to protect children's sleep and school time.

Recommender systems for minors would have to be optimised for safety, quality and mental health rather than engagement. What a child chose to follow comes first, personalisation based on tracking would be off by default, no data from outside the service could be used, and children would get an easy feed reset plus at least one option with no profiling at all. Contact is restricted as well: nobody could message a child without pre-approval, children would not appear in contact suggestions, they could not be added to groups without agreement, their content would be visible only to accepted contacts, screenshots and downloads would be blocked, and minors could not livestream by default.

Games are covered by the same safety-by-design duty. App stores would have to age-rate every app, videogames included, publish the methodology behind those ratings, stop children reaching or buying apps that are inappropriate for their age, and carry the EU age verification app.

Do AI chatbots face the same rules?

Yes. Companion and chatbot features accessible to minors could not use designs that simulate human relationships in ways likely to create emotional dependency, and by default they could not carry a child's earlier conversations into later ones. They would have to be tested for risks to children before launch and monitored afterwards. Under-13s could use them only through parental control tools, and a chatbot built into a platform or a game could not switch itself on, be pushed at children, or be difficult to turn off.

When would all this take effect?

Not yet, and not automatically. The Commission has adopted a proposal, which still has to be agreed by the European Parliament and the member states before it becomes law. Enforcement would build on the Digital Services Act and, for AI companions and chatbots, the AI Act. Very large online platforms with 45 million or more monthly users in the EU would have to hand over a detailed compliance plan for new services, features or functionalities, assessed within 30 days and rolled out only after a positive opinion from the Commission, with independently audited reports paid for by the platforms themselves rather than by taxpayers. The Commission wants expedited procedures that conclude investigations within 90 days, and some services are proposed for exemption, including encyclopaedias, educational platforms and digital news.

Our opinion

The clever part of the KIDS Act is not the age limit, it is where the paperwork lands. Requiring platforms with 45 million EU users to file an audited compliance plan before a new feature reaches children inverts the usual argument, in which regulators spend years proving harm after the fact while a feature quietly becomes normal. That said, the age architecture is the part most likely to wobble: a 13-to-15 tier that depends on guardians setting up and monitoring accounts assumes those guardians exist, have the time and share the child's device. Age assurance is also the piece most likely to be gamed and most likely to be resented, which is exactly why the zero knowledge proof framing matters, because a system that quietly builds an identity trail for every teenager would be a far worse outcome than a birthday box. The Commission has borrowed a little from the UK's Online Safety Act and a lot from the DSA's enforcement muscle, and the fights ahead will be about scope and timing rather than principle: expect platforms, games publishers and app stores to argue loudly that safe by design is expensive and that the exemptions are drawn too narrowly. It is a serious proposal with a real mechanism behind it, and the 90-day investigation target is the detail worth holding it to.