EU KIDS Act: What Could Change for Minors and Age Verification
The EU has proposed new rules on minors' access to social media, games and AI. Here is what the EU KIDS Act includes and what does not apply yet.
On 17 September the European Commission presented the EU KIDS Act, a proposal to protect minors online. It covers social networks, video services, online games, AI companions and chatbots.
What makes it interesting is that it doesn't stop at illegal content. It targets the design of the services themselves: how an app is built when a child or a teenager is the one using it. It also aims to replace the patchwork of national rules with one common level of protection across the EU.
First, though, the most important point: this is not a law in force. It is a proposal. The European Parliament and the Council of member states still have to examine it and agree on a final text, and until then everything below could change.
What age limits are proposed
The proposal draws three categories.
- Under 13: no social media account at all.
- Ages 13 and 14: a restricted "mini" account, created and controlled by a parent or guardian. It has fewer features, age-appropriate content and a limit of one hour a day.
- 15 and over: their own independent account.
What changes for platforms
This is the core of the proposal. The burden of proof moves to the companies themselves. Saying a service is meant for adults is no longer enough. They have to show it is designed to be safe for children. The big platforms, with 45 million or more monthly active users in the EU, would have to submit a compliance plan before coming into contact with minors.
Among other things, the proposal restricts:
- Personalised ads aimed at minors.
- Content recommendations built on a user profile.
- Endless scrolling with no breaks.
- Reward mechanisms that push people towards prolonged use.
- Unsolicited contact from strangers.
- Notifications during sleeping hours, defined as eight consecutive hours between 10 p.m. and 8 a.m.
Children's profiles would be private by default, and access to location, camera and microphone would start switched off. AI companions and chatbots would also be off by default for minors and, in the Commission's words, would no longer be allowed to act in ways that make children emotionally dependent on them.
How age verification would work
An age rule doesn't work if nobody can check it. The proposal relies on certified verification solutions that are independent of the platforms. The options include the European age verification app, which according to the Commission does not retain identity documents or biometric data, as well as the European digital identity wallet.
The idea is simple: the service learns only that the user falls in the right age category, not who they are. In practice, everything comes down to implementation. A good system asks for only the data that is strictly necessary and leaves no history behind that could be used for tracking. For the different methods and what each means for privacy, we have covered online age verification separately.
Where a VPN comes in
A VPN changes the IP address a service sees. If a check relies only on the geographic region of the IP, that can make a difference.
It does not change your age, though, and it does not necessarily bypass a check based on certified digital identity, parental approval or any other independent element. Nor does it remove your legal obligations or a service's terms. A VPN protects the connection and hides your real IP. It is not proof of age.
What parents and users should watch for
For now you don't need to change anything. But when you run into an age verification system, it is worth asking:
- What data does it ask for?
- Who stores it, and for how long?
- Can the platform learn exactly who I am?
- Is there an alternative for people who don't have the specific document?
- What happens in the event of a data breach?
Protecting children and protecting privacy are not opposed by nature. They collide when an age check ends up creating new, permanent databases of sensitive personal data. That is why how the check is implemented matters more than the fact that it exists.
What applies today
In Greece and in the European Union there is no blanket ban on VPNs, and the EU KIDS Act changes none of that while it remains a proposal.
What is worth watching is the direction. Platforms will need to know with more certainty whether they are dealing with a child or an adult, and the challenge is to learn that without collecting more personal data. The topic fits into the wider picture of new digital privacy rules across Europe. Whether the right balance is found will show in the final text and in how it is applied.
K1VPN closely follows developments in online privacy and security, and offers a strict no-logs policy for user data, modern VPN protocols for every need and a genuine 48-hour free trial before any commitment.