The EU Kids Act Turns Child Safety Into Age Checks

Ursula von der Leyen told the European Parliament on September 16 that children under 13 will be barred from social media. The EU Kids Act, due to be tabled on September 17 with tech chief Henna Virkkunen, also sets 15 as the age for a personal account.

A leaked legal text dated September 15 goes further than that floor. It would require age checks at sign-up, at game download, and across AI chatbots and app stores, and it would ask adults to pass the same gate.

No Social Media Under 13, No Personal Account Under 15

In Strasbourg she called the pattern “a great capture of our children.” Young Europeans, she said, now spend four to six hours per day on screens, pulled into feeds built to keep them scrolling. She said the Commission would take “a gradual and differentiated approach,” because “each age has its own sensitivities.”

No social media under the age of 13. No personal account under the age of 15.

Ursula von der Leyen, President of the European Commission, State of the Union address, Strasbourg, September 16, 2026

From 13 until a child turns 15, she said, only mini accounts set up and supervised by parents would be allowed, with limited features and a time restriction. Between 15 and 18, “safe design will be an obligation for the platforms.” She added that platforms “will have to prove that they are safe,” reversing the burden of proof. The line in her No social media under the age of 13 passage is the political floor. The leaked draft does not match it line for line.

SPEECH VERSUS THE LEAKED DRAFT

The draft Communication, titled “An EU approach to online child safety” and marked COM(2026) 680/2, still carried a blank Strasbourg date line when it circulated. A separate leaked proposal, COM(2026) 681-3, is the statutory text. Both can still move before they are formally tabled, and both still need the European Parliament and the 27 member states.

App Stores, Chatbots and Games Sit in the Same Net

The speech sold a social media rule. The leaked proposal classifies a wider set as “Social Media+”: social networks, video-sharing platforms, and online games that pose design risks for minors, plus AI chatbots and AI companions described as tools that can give mental health and personal development advice. Education services, public-authority tools, industrial AI, office AI, non-commercial encyclopedias, science services, and open-source software platforms are written out of scope.

Software app stores sit in a special lane. They would have to put consistent age labels on titles and block a download when the user is too young, a duty that would hit mobile stores and PC storefronts alike. One account of the legislative draft also names operating systems. There is no small-company carve-out in the leaked proposal, so smaller forums could be pulled in if they let strangers meet, share, and follow a personalised feed.

SERVICES THE LEAKED TEXT WOULD COVER

• Social networks and video platforms: Age verification at new-account opening, using the EU tool or a public equivalent.
• Online games: An age rating on every title, enforced in the store at the moment of download.
• AI chatbots and companions: Access rules plus co-regulatory safety duties, on top of the design bans that apply to every in-scope service.
• Software app stores: Catalogue-wide age labels and a check before installation.
• Existing accounts: Proportionate checks rather than a mass re-verification, with examples such as old accounts or accounts tied to the holder’s own card.

Safe-design duties would run to 18 on every in-scope service: no infinite scrolling, no artificial notifications, no rewards for coming back, recommender systems that go beyond engagement, private defaults, and a block on strangers starting chats. “Safe by design” is still a slogan in the speech. Until the adopted articles define it, companies will argue it means a quieter feed, and critics will argue it means a content filter wearing a child-safety badge.

Brussels Already Built the Age-Check App

The Kids Act would make checks obligatory. The machinery is already on the table. The Commission says its age verification app is technically ready as of April 2026, after a blueprint issued in July 2025 and a pilot with member states and platforms.

A user downloads the app, certifies age with a biometric passport or ID card, a national eID, a banking app, or an in-person check such as a post office, and stores only the fact of being over a threshold. No name and no birthday stay on the device, according to the Commission. When a site asks, the app answers a yes/no question, for example that the user is over 18, using zero-knowledge proofs so the site does not learn who the person is and cannot string visits together.

Member states, or private firms, would ship the actual apps. Users could pick among them, and the Commission says it will list trusted ones and work with Apple and Google to whitelist official copies. Seven frontrunners are named: Cyprus, Denmark, France, Greece, Ireland, Italy and Spain. A available by 31 December 2026 recommendation, adopted on April 29, 2026, asks every member state to offer the tool as a stand-alone app, inside the European Digital Identity Wallet, or both. The recommendation is not binding. The Kids Act would be.

The Commission’s own FAQ concedes a VPN can still dodge a check, then compares that leak to a shop that still asks for ID before selling alcohol. That is the practical limit of the whole design. The louder problem is the population that has to walk through it. Because a platform cannot know who is 14 without asking everyone, adults would have to prove they are over a set age to keep a new Instagram, TikTok, YouTube or game account. The leaked proposal even tries to write that “any age assurance measure shall be zero knowledge proof,” a sentence that treats a cryptographic method as if it were an adjective and a hint that the drafting is still rough.

The political pitch was in Strasbourg. The Commission’s own recording of the State of the Union puts the children section at about 1 hour 12 minutes.

Parents Would Need to Prove They Are Parents

For a 13- or 14-year-old, the leaked proposal does not stop at a parent ticking a box. A guardian who wants to open an introductory account on a risky social or video service would have to show three things: their own age, the child’s age (at least 13), and a proof of parental responsibility. Member states would be told to create a certificate of parental responsibility that is easy to obtain, including for disabled people, refugees, and adults who lack the usual papers.

Until that paperwork exists, the draft allows a self-declaration. It also contemplates lookups against state databases. There is no working pipe today that lets TikTok, Instagram or YouTube ingest a European parental-responsibility certificate, so the law is asking for an infrastructure that still has to be built.

Once the mini account exists, the parent app is meant to be strict. Parents could have to approve each new contact in advance. They could set a time limit, but not above one hour a day, according to the leaked articles. That is a hard cap on 13- and 14-year-olds, including teens who already travel to school alone. Families that cannot complete the three proofs, or will not, do not get a softer setting. They get no account.

France’s Top Court Struck Down the Same Floor

On August 14, 2026, France’s Constitutional Council struck down Article 1 of a national law that would have barred under-15s from social media. Parliament had adopted that bill on July 21, with the Senate voting 243 to 2 and 100 abstentions. President Emmanuel Macron had wanted it in force for the new school year.

The contested provisions constitute an infringement that is neither appropriate, necessary, nor proportionate to the freedom of expression and communication of under-15s, and they failed to set the legal safeguards needed to protect private life.

Constitutional Council of France, decision of August 14, 2026, as summarised in the Council’s communiqué

The judges also held that a blanket bar on every service that lets people connect was too broad, covering not only Instagram and TikTok but collaboration tools, messaging, and games with a social layer. The law did not let a parent authorise access even after being told the risks. And because platforms would have had to ask everyone their age, adults would have been forced to identify themselves to use an ordinary account, which the Council tied to the right to private life.

Macron asked Prime Minister Sébastien Lecornu for a new draft that can survive that test, aiming for spring 2027. Brussels is now walking toward a similar age limit, plus a wider age-check duty, with that ruling on the books. The leaked EU text tries to answer one of the French objections by keeping a parental path at 13 and 14 instead of a total bar to 15. It does not answer the other one. Adults still have to prove they are adults.

Very Large Platforms Face a 30-Day Feature Hold

Enforcement is modelled on the Digital Services Act and the AI Act, with the burden of proof on the company. Very large online platforms and search engines would file a compliance plan. The Commission would have 30 days to give a positive opinion before a new service, feature or function could ship. The draft is silent on whether that hold applies to every feature or only to those that reach minors, which is the difference between a child-safety review and a general product veto.

Companies would also pay a supervisory fee to fund EU-level oversight. The leaked papers do not set a rate. Complaints from minors, or about minors, would get priority. A leaked legislative draft puts fines at up to 6% of worldwide annual turnover. That is the same ceiling the DSA already uses for confirmed breaches.

Meta Platforms reported full-year 2025 revenue of $200.97 billion. Six percent of that figure is about $12.1 billion. That number is an illustration of the leaked ceiling, not a fine that has been issued.

FROM DSA FILES TO A STATUTE

1. February 6, 2026: The Commission issues preliminary Digital Services Act findings against TikTok over addictive design, including infinite scroll, autoplay, push notifications and recommenders.
2. April 29, 2026: The age-check app is declared technically ready, and a recommendation tells member states to deploy it by the end of the year.
3. July 10, 2026: Preliminary findings against Meta target the same design pattern on Instagram, again with a possible 6% turnover fine if confirmed.
4. August 14, 2026: France’s Constitutional Council voids the national under-15 social media ban.
5. September 10, 2026: California Governor Gavin Newsom signs a package that bars addictive features, including autoplay and algorithmic feeds, for users under 16.
6. September 16, 2026: Von der Leyen sets the 13 and 15 floors in Strasbourg and says the Kids Act will be proposed the next day.

Those DSA files are still at the preliminary stage. The Kids Act would convert the same design fights (scroll, autoplay, notifications, recommenders) into a statute that also names games, chatbots and stores. A Digital Fairness Act, still promised for autumn 2026, is meant to handle addictive design for adults in a wider consumer rulebook.

Member States Are Already Drafting Their Own Bans

Brussels is late to its own capitals. A footnote in the draft says legislation is being prepared or negotiated in 17 of the 27 member states. France, Greece, Austria, Denmark, Spain, Belgium, Italy, Germany, Poland and the Netherlands have all been moving. Spain and the Netherlands asked in the days before the leak to bring games and AI companions inside the EU net. The Commission’s pitch is one rule instead of 27, and legal certainty for firms that sell across the single market.

Von der Leyen said the special panel she convened had looked at Australia, which last year barred under-16s from social media, and at other countries that had already moved. She did not claim those bans are leak-proof. California’s September 10 package takes a different cut: it does not ban accounts for under-16s, it strips the feed features that keep them scrolling, and it adds separate chatbot rules, including independent child-safety audits.

THE SCREEN-TIME FIGURES BRUSSELS CITES

• School days: A June 2026 Eurobarometer cited in the draft puts average teen time online at 4.5 hours.
• Weekends: The same survey puts the figure at 6.1 hours, rising to 7.5 hours for those who started social media before age 10, against 5.7 hours for those who started after 14.
• Harm: The draft says one in three teenagers report stress, social exclusion or concentration problems, one in four children see harmful content, one in four faces online sexual solicitation before 18 (a Childlight figure), and one in ten feels pressure to share intimate pictures.

None of those survey lines writes the age limit for her. They are the evidence section the Commission wants under the political floor. The text that lands on September 17 will still be a proposal. It has to survive the same arguments that killed France’s Article 1: a bar that is too blunt, a check that identifies adults, and a parental lock that some families cannot operate. The age-check app is on a separate clock, with a 31 December 2026 target already in a recommendation, and that tool can spread even if the Kids Act is cut to pieces in the Council.