EU KIDS Act: How Brussels’ Social Media Ban Reshapes the Internet’s Architecture

The proposal reaches into video-sharing platforms, online games, app stores and AI companions, challenging a basic assumption of the consumer internet: that platforms can attract users first and manage the risks around them afterwards. Under the proposed system, the platform would have to change.

From parental control to platform liability

The most consequential feature of the legislation is not the age threshold itself but where responsibility sits.

Children under 13 would be excluded from social media altogether. Those aged 13 to 15 could use social and video-sharing platforms only through parent-controlled “mini-accounts”, limited to one hour of use a day. Autonomous, self-managed accounts would become available from 15. Everyone under 18 would remain subject to mandatory safety-by-design requirements.

That represents a substantial departure from the model that has governed much of the internet to date. Age restrictions have often relied on self-declaration, parental supervision or individual platforms setting their own safeguards. The KIDS Act instead assumes that the architecture of the service must prevent or limit harmful behaviour before it reaches the user.

The distinction matters because many of the mechanisms targeted by Brussels are not pieces of content. They are mechanisms for keeping people engaged.

For under-18s, platforms would have to eliminate infinite scrolling, profiling-based recommendation feeds, gamified rewards, personalised advertising and recommendation systems capable of pushing users towards increasingly extreme or compulsive content. Push notifications would be prohibited during an eight-hour night-time period. Profiles would be private by default, while geolocation, cameras and microphones would be switched off automatically.

Blocking, reporting and muting would have to be straightforward.

The policy therefore treats the design of a digital service as part of the regulatory problem. The question is no longer simply whether a platform hosts harmful material. It is whether the way the platform is built can itself create predictable risks for children.

That puts the EU closer to product-safety regulation than traditional internet moderation.

The AI problem is different

The inclusion of AI companions may prove even more significant than the social media restrictions.

The proposal would require AI companions and conversational chatbots used by minors to be switched off by default. Systems would also be prohibited from simulating interpersonal relationships in ways that encourage emotional dependency, romance or pseudo-friendship, or exploit loneliness and fear.

That is a different regulatory target from offensive content or misinformation. It concerns the relationship between a user and a machine.

Services built around persistent memory and personalised interaction can make an AI system appear less like software and more like a social presence. The KIDS Act treats that possibility as a structural risk when the user is a child.

Character.AI, for example, has already removed unrestricted chats for under-18s and introduced break reminders, content classifiers and crisis links. But the proposed European framework would go beyond individual safeguards. It would establish a legal boundary around the kind of relationship an AI system may simulate for a young user.

That distinction could become increasingly important as conversational AI moves into mainstream consumer products. Brussels is effectively attempting to regulate a category of behaviour before synthetic intimacy becomes as embedded in youth culture as social feeds are today.

The identity layer underneath the rules

None of this works without knowing who is under 13, who is between 13 and 15, and who is an adult.

That is where the proposal reaches beyond content and platform design into the underlying infrastructure of the web.

Platforms would have to verify age at account creation using certified independent systems. The proposed European age-verification application would use zero-knowledge proof principles, allowing a service to receive confirmation that a person has crossed a particular age threshold without receiving the person's identity documents or precise date of birth. The European Digital Identity Wallet could provide another route.

In principle, a platform would receive an answer such as “over 15: yes” rather than a passport, biometric record or full identity profile.

That distinction is central to the political and technical viability of the system. Age assurance can either become a narrowly designed verification layer or evolve into a much broader infrastructure for identifying internet users.

Civil liberties groups, including the Electronic Frontier Foundation, have warned about the second possibility. Their concern is that compulsory age gates could normalise identity checks for everyone, including adults who have done nothing to trigger restrictions. That could weaken anonymous browsing and create valuable targets for cybercriminals.

The technology proposed by Brussels is designed to reduce that risk through data minimisation. Whether the wider ecosystem around it can preserve the same principle is another question.

The tension is difficult to remove. A system that reliably distinguishes a 12-year-old from a 30-year-old needs some trusted mechanism for establishing age. A system that does so across much of the internet also creates a new layer of infrastructure between the individual and the service they want to use.

The KIDS Act would therefore not merely regulate platforms. It would help determine how identity itself is established online.

Big Tech gets a different set of incentives

The enforcement model is designed to make compliance a corporate responsibility rather than a parental one.

Platforms with more than 45 million monthly active EU users would have to submit compliance plans and undergo independent audits. They would also pay a dedicated supervisory fee. Investigations into non-compliance would follow an accelerated 90-day procedure, while fines could reach 6 per cent of a company's global annual turnover.

That sanction mirrors the highest penalty tier under the Digital Services Act, creating a familiar enforcement architecture rather than an isolated child-protection regime.

For advertising-funded social media companies, the commercial implications are direct. Personalised advertising, profiling-based feeds and engagement mechanisms such as infinite scrolling are not peripheral design choices. They are closely connected to how large platforms monetise attention.

The proposal would require those mechanisms to be dismantled or substantially altered for minors.

The technology industry has challenged both the feasibility and the scope of the approach. CCIA Europe, representing companies including Google and Meta, has warned that collecting identity credentials and parent-child linking data at scale could create attractive targets for cybercriminals and produce legal overlap that weakens existing protections.

Epic Games chief executive Tim Sweeney has argued that the rules could be broad enough to affect gaming environments such as Fortnite.

Those objections expose the difficulty of drawing a clean line around “social media” in 2026. A teenager can encounter algorithmic recommendations, advertising, strangers and conversational AI inside a game, an app store or a video service as easily as on a conventional social network.

Brussels is responding by regulating the functions rather than relying entirely on the label attached to a product.

Europe is trying to avoid a patchwork

The timing is also connected to a growing divergence between national approaches.

Australia's legislation banning social media for under-16s took full effect in December 2025, giving European policymakers an early example of a platform-liability model. Within Europe, France has approved an under-15 restriction scheduled for 2027, Greece has adopted a framework effective from January 1, 2027, Spain has announced plans for an under-16 restriction based on age checks, and Norway is preparing legislation for an under-16 ban.

Other member states, including Denmark, Austria, Italy, Slovenia, the Netherlands, Poland and Finland, are debating or consulting on different approaches.

The result is a familiar European problem: national experimentation can quickly become a single-market problem.

A platform operating across 27 countries could face different age thresholds, parental-consent requirements and verification systems in each market. The KIDS Act offers a route towards replacing that patchwork with one framework.

It also extends an existing Brussels regulatory logic. The Digital Services Act already imposes systemic-risk obligations on the largest platforms. The GDPR governs the processing of children's data, while the AI Act addresses manipulative practices and certain forms of psychological harm. The KIDS Act would connect those strands around a specific population and add rules for conversational AI that previous age-assurance frameworks did not fully cover.

The legislative battle is still ahead

The proposal is not law.

It now enters the ordinary legislative procedure, meaning that the European Parliament and the Council of the EU must negotiate, amend and approve it before the framework can become binding across the bloc. There is currently no EU-wide prohibition on social media access for children under 13 while those negotiations continue.

That leaves the central conflict unresolved.

The Commission is proposing that online child safety should be treated as an architectural property of digital services: platforms would have to prove that their systems are safe for minors, rather than expecting children and parents to navigate systems designed primarily around engagement.

The industry challenge is that age verification, parental controls and restrictions on algorithms can themselves create new security, privacy and market problems. The civil-liberties challenge goes further: once age becomes a condition of access, the boundary between protecting children and identifying everyone becomes harder to keep entirely separate.