Smiling Faces and Safer Online Spaces: An Overview of the Proposed EU KIDS Act

Over the past 12 months, more regulatory attention has been focused on protecting children online. In the U.S., states like California and New Jersey have recently enacted legislation designed to protect children from the dangers of AI tools like chatbots and companions, along with requiring age-appropriate design codes for online services accessible to children. On the international stage, regulators across the pond are contemplating similar legislation.

The European Commission published the proposed EU KIDS Act on September 17, 2026 (the Proposed Act). This proposal reflects the EU’s continuing effort to strengthen protections for children online by harmonizing existing EU requirements. The Proposed Act’s stated aim is to avoid a fragmented regulatory landscape that increases compliance complexity and, in turn, may impede companies’ ability to effectively protect children in practice.

While the EU KIDS Act has not yet been enacted, businesses should begin to familiarize themselves with the Proposed Act as this draft, or a version close to it, may ultimately become law.

Proposed Act Overview. The Proposed Act is structured as follows:

• Chapter I – General Provisions
• Chapter II – Delayed Creation and Use of Accounts for Minors on Online Social Networking Services and Video-Sharing Platform Services
• Chapter III – Safety By Design 
• Chapter IV – Verification of Parental Responsibility
• Chapter V – Age Assurance
• Chapter VI – Measures to Support Minors
• Chapter VII – Competences, Supervision and Enforcement
• Chapter VIII – Implementing and Delegated Acts
• Chapter IX – Final Provisions

Who Would the Proposed Act Apply to?

The Proposed Act would apply to providers of the following services or systems accessible to minors (i.e., any natural person under the age of 18):

• online social networking services;
• video-sharing platform services;
• software application stores
• online games;
• operating systems;
• AI companions; and
• general conversational chatbots.

Extraterritorial Scope. Like the GDPR, the Proposed Act would have extraterritorial reach. If enacted, it would apply to entities located outside the EU that provide the systems and services described above to minors in EU markets.

Exempt Entities. Notably, the Proposed Act would exempt certain entities, including providers of:

• non-profit online encyclopedias;
• non-profit educational and scientific repositories;
• services and systems that are designed for primarily educational purposes, and operated by educational establishments or organizations, or on their behalf;
• open-source software-developing and-sharing platforms, unless the platform itself constitutes an AI system in scope of the Act or the EU AI Act;
• services and systems specifically developed and operated for the sole purpose of scientific research and development; and
• services and systems designed, developed and operated by public authorities and for exclusive use of those public authorities or on their behalf.

What Are the Obligations under the Proposed Act?

While the Act imposes several obligations, an overview of the key requirements are outlined below.

1. Delayed Access to Social Media and Video Platforms. The Proposed Act places heightened emphasis on the dangers of online social networking and video-sharing platform services, and places limitations on account creation and access for these services based on age categories.

As drafted, the Proposed Act restricts access to social media and video-sharing services based on the following tiers:

• Under 13 – Minors in this age category are generally prohibited from accessing the covered services or creating accounts to use those services. However, a narrow exception exists as outlined in Chapter II of the Proposed Act to permit providers of certain video-sharing platform services to allow children under 13 to access qualifying, age-appropriate video-sharing services through a guardian’s own account, subject to strict safeguards.
• 13-14 – The Proposed Act permits guardians to create accounts for the covered services for minors ages 13-14 with limited access features, including a one-hour daily usage limit.
• 15+ –Minors in this category may unilaterally access the covered services and create accounts on those services. However, covered providers must still ensure the safety features and mechanisms required by the Proposed Act are in place to protect their safety.

• Safety By Design. Safety by design requirements in Chapter III make up the core of the Proposed Act. The required safeguards vary by service type, but generally seek to ensure a high level of privacy, safety, and security for minors by default.

• Online Social Networking and Video-Sharing Platform Provider Obligations. Covered providers would be required to implement measures addressing, among other things:
  • Addictive Features. Addictive or excessive-use design, including features that encourage prolonged or compulsive engagement.
  • Recommender Systems. Ensuring safe recommender systems (e.g., recommended friend requests) that do not exploit minors’ vulnerabilities or attention.
  • Safety Settings. Default privacy and safety settings, including restrictions on geolocation and tracking, microphone and camera access, contact synchronization, account recommendations, and push notifications during core sleep hours and school time.
  • Contact and Interaction Safeguards. Contact and interaction risks, including safeguards limiting unsolicited contact, group additions, and the visibility of minors’ accounts and content, while enabling minors to block other users.
  • Safe and Secure Economic Transactions. Economic transactions, including clear, real-time disclosures when a transaction is occurring and safeguards against excessive, impulsive, or unwanted spending by minors.

• AI Companion and General Conversational Chatbot Providers.

Implement Proportionate and Effective Safety Measures. Providers would need to implement proportionate and effective measures to protect minors’ health, safety, fundamental rights, and well-being. At a minimum, the Proposed Act requires covered entities to  implement measures  contemplating addictive designs and features that simulate interpersonal relationships in ways likely to create emotional dependency; safe settings; transaction transparency; guardian-enabled access for users below age 12; pre-deployment testing and evaluation; and post-market monitoring for emerging risks and harms.

• Additional Safety Measures for Companions/Bots Incorporated into Online Social Networking or Video-Sharing Platforms. Where an AI companion or chatbot is integrated into a covered social networking or video-sharing service, the provider would also need to ensure the feature is not enabled by default for minors, does not encourage minors to use it, and can be readily disabled.

• Online Game Providers.

• Implement Safety Measures. Online game providers would be required to adopt measures designed to prevent compulsive or excessive use by minors, provide high privacy, safety, and security settings, protect interactions between minors and other users, and make guardian tools available.

• Mitigate Off-Game Contact. Covered providers would also need safeguards against using games to entice minors to move interactions to other services that may create additional privacy or safety risks.

• Age Assurance. The Proposed Act would require an age-assurance framework to support its Delayed Access rules and Safety By Design obligations. Where age assurance is required, covered providers would need to use methods that are effective, reliable, secure, non-discriminatory, and privacy-preserving.  While the Proposed Act does not mandate a particular age assurance tool or provider, the European Commission has developed an age verification app that may support providers’ age-assurance efforts, although it has not yet been made available to the public.

Additionally, app stores would have separate obligations to apply and make available age ratings for software applications. This is consistent with recent App Store Accountability laws that have surfaced in the United States over the last year.

• Child-Friendly Reporting and Support Tools for Minors. Covered providers would need to offer reporting mechanisms that minors can easily find, understand, and use to report content, accounts, groups, features, or conduct that they believe threatens their privacy, safety, or security. Providers would be expected to address reports from minors promptly and without undue delay, inform minors of the action taken or available remedies, and provide child-appropriate support throughout the process.

• Tools for Guardians. The Proposed Act would require covered providers to offer effective, accessible, and user-friendly tools for guardians that (i) are tailored to the age of the minor, taking due account of the minor’s gradual development; (ii) are easy to use, access and activate; (iii) ensure that changes can only be made with the same degree of authorization that is required for the initial activation of the tools; (iv) are effective and cannot be easily circumvented or undermined by the design; (v) do not disproportionately restrict minors’ rights; and (vi) respect minors’ agency and privacy. Providers would also need to inform guardians about available tools and encourage their use along with ensuring minors are informed when any guardian tool is being used.

• Complaints and Collective Actions. The Proposed Act would permit minors, guardians, and qualifying nonprofit organizations acting on their behalf to file complaints with the relevant supervisory authority concerning alleged violations. This complaint mechanism would supplement the Proposed Act’s broader enforcement framework, which relies on existing EU enforcement structures and contemplates expedited enforcement procedures.

What’s Next?

The Proposed Act will now be examined by the European Parliament and the Council, who will negotiate and decide on the final text before it becomes law.

While the exact implementation date of the Proposed Act is uncertain, one thing is for certain, regulators in the U.S. and abroad are focused on protecting children online now more than ever. Understanding how your business’ services are used by minors, and what features could pose a risk to them or the information they provide, is an analysis all businesses must consider.

Taft will continue to monitor the EU KIDS Act for updates and new developments. If you have questions about this proposed regulation, or about EU privacy laws more broadly, Taft’s Privacy, Security & AI attorneys are available to assist. As always, please sign up to receive emails of our latest posts here on Privacy and Data Security Insights, and follow us on LinkedIn for the latest in privacy, security and artificial intelligence legal news.