On  September 17, the European Commission introduced the 'EU Keeping Internet Digital Spaces Accountable and Trustworthy' proposal, also referred to as the EU Kids Act. The new piece of legislation responds to ongoing global conversation on social media bans for children and aims to ensure a safe and secure online environment. Contrary to the legislative action seen globally thus far, the Commission proposes a gradual approach calibrated for different age categories. Alongside age-dependent access limitations, the act also mandates platforms to ensure safe design by default for all underage users.

The EU Kids Act is applicable to the following types of services: online social networking services, video-sharing platforms, software application stores, online games, operating systems, AI companions and general conversational chatbots. When defining these services, the EU Kids Act makes direct references to existing legislation, specifically the DSA, AI Act and DMA, while complementing that with a set of new terms, most importantly 'AI companion' and 'general conversational chatbot'. A number of services are explicitly excluded from the regulation, including not-for-profit online encyclopaedias and services that are designed primarily for  educational purposes. The proposed regulation complements and builds upon the Guidelines on the protection of minors online, pursuant to Article 28 of the DSA. Importantly, it transforms several safeguards from the guidelines – particularly those in chapter III (related to safety-by-design, protective default settings, recommender systems, addictive features, etc.) and in chapter V (related to age assurance principles and solutions) – into legally binding obligations.

Delayed Access for Minors - The Key Innovation

The proposed regulation creates tiers of access to online social networking services and video-sharing platforms determined by the users’ age. Social media access is to be completely banned for all children under 13. Between the ages of 13 and 15, teenagers will have limited access to social media, with a one-hour-per-day time limit and limited features. The “mini accounts” will have to be set up and supervised by legal guardians. From the age of 15 and above, teenagers will be able to set up autonomous accounts, while safe design rules will still apply (more on the safe design rules below) (Art. 6).

With regard to video-sharing platforms, children aged 3 to 13 will have limited, supervised access to specific children-appropriate content through guardians’ own personal account, given that specific safety conditions under Art. 7(1) are met (Art. 7). For teenagers who are between 13-15 years old, the same rules apply on video-sharing platforms as on social media (guardian tools always switched on (Art. 20), maximum 1 hour/day access, guardian pre-approval of new contacts and a cap on the number of contacts).

The ban on autonomous accounts for children under 15 pertains to social networking services and video-sharing platforms that pose a risk to privacy, safety or security. These risks include live streaming, open communication with accounts that are not pre-approved, use of recommender systems for profiling, contact recommendation systems, and functionalities that drive engagement (Art. 6).

 Safety-by-design - New Rules for the Service Providers

The proposed regulation also imposes extensive safety-by-design obligations on providers of all services outlined above. The services must ensure a high level of privacy, safety and security, and can only derogate from the requirements when it has been established that the user is an adult. The safety-by-design obligations vary depending on the type of service.  

Social networking services and video-sharing platforms must refrain from design and functionalities that encourage excessive use (addictive design), including features such as automatic play of content and uninterrupted content consumption, and rewards for content sharing and real-time broadcasting (Art. 9).  The recommender systems deployed by the platforms must give priority to explicit user-stated preferences, disable implicit engagement-based signals by default, avoid using personal data collected from outside the service, and offer an easily accessible non-profiling option with an easy preference reset (Art. 10). To ensure safe settings, providers must, by default, turn off geolocation and other tracking features, access to microphone and camera, recommendations of other accounts, synchronisation of contacts, and push notifications (Art. 11). Additionally, providers must put in place safeguards to protect contacts between minors and other recipients of the service (such as preventing other recipients from initiating direct contact with the minor without pre-approval and enabling minors to anonymously block other accounts) and limit the visibility of any information shared by minors (Art. 12). Finally, providers must disclose information about economic transactions in the minor's home-country currency even for virtual-currency purchases (Art. 13).

AI companions and general conversational chatbot services must adhere to specialised rules: limiting addictive design (particularly design features simulating relationships likely to create "emotional dependencies"), ensuring safe settings and transparency on economic transactions, restricting access for minors below 13 to guardian-enabled use only, and conducting pre-deployment testing and post-market monitoring for psychological and developmental harms. Where an AI companion or a general conversational chatbot is deployed as a functionality of a different service, providers must deactivate the functionality by default and offer an easy opt-out option (Art. 14).

Rules for providers of online games focus mainly on preventing excessive use, ensuring privacy, safety and security, providing access to tools for guardians, and preventing gaming platforms from being used to initiate risk-posing contacts on other platforms(Art. 15). Lastly, the regulation also outlines rules for application stores. They must implement an age-rating system assessing age-appropriateness of apps and at the same time ensure that access to age-inappropriate apps is not possible once rated. To achieve that, application stores are obliged to verify the age of users (Art. 16).

Simultaneously, all the above-mentioned platforms are required to ensure agency of minors by enabling them to easily submit feedback on content, search results, prompts and information suggested. They shall provide an easy way to control how minors navigate through and create content on the service (Art. 18). Providers must also create an easy mechanism to report risk-posing content, accounts or behaviours on the services, ensure that minors have access to support and information sources when encountering illegal or harmful content, and display warnings when minors are likely to publish or to be exposed to content or interactions presenting risks (Art. 19). Finally, minors and their guardians must have an opportunity to mandate not-for-profit bodies to exercise their rights, modelled closely on DSA Art. 86 (Art. 21).

How Will the Verification of Parental Responsibility Work?

Before a child’s guardian can act on the capacity to supervise the child’s presence on social networking and video-sharing services, it has to be established that the person in question has parental responsibility over the child. To prove this, one of the three instruments can be utilised. Guardians can use proofs from official databases of the Member States, prior-relationship signals the provider already has, or (until a future delegated act) simple self-declaration, all subject to strict privacy and safety rules (Art. 26).

Age Assurances

The EU Kids Act mandates the involved services to provide age assurances, which have to adhere to strict accuracy, security, and privacy standards. The solutions cannot allow the identification of the recipient nor locate, track, target, advertise to or profile them for any purpose. They can only collect the strictly necessary minimum of data and are banned from processing it further. The regulation also highlights that any age assurance must be a zero-knowledge proof (Art. 27, Art. 28).

Chapter V stipulates that providers, in complying with Art. 6 (delayed creation and use of accounts), must rely solely on an EU age verification solution using an EU proof of age attestation, provided by a third party. The deployed solutions shall comply with the requirements of the EU Age Verification Scheme. To comply with the general obligations on safety-by-design and obligations for software application stores, the providers are not always obliged to use an age-verification solution. Instead, they may rely on other age-assurance solutions, including age estimation. Self-declaration will not suffice as proof, either for age verification or as one of the other age-assurance solutions (Art. 29).

For the existing accounts, the service providers must verify users’ age using age verification solutions. They, however, do not have such an obligation where they can establish with high confidence that the user is above the minimum age set in Article 6. In relation to safety-by-design rules, the providers also do not have to assess the age if they can confidently establish that the user is above 18. The same applies to providers of application stores (Art. 32).

Enforcement

The enforcement section of the EU Kids Act draws significantly on the DSA and AI Act. In other words, enforcement rules and sanctions under the DSA will apply to relevant services, i.e. online social networking services, video-sharing platforms, online games that are video gaming platforms, and software application stores. Similarly, enforcement from the AI Act will apply to providers of AI companions and general conversational chatbots. At the same time, authorities outlined in the DSA and AI Act, respectively, will be responsible for supervision. For providers of online games that are video games, the Member States must establish a responsible national authority that will supervise them. Simultaneously, national data protection authorities will supervise compliance with the GDPR aspects of the EU Kids Act (Art. 34).

The regulation will apply 6 months after coming into force. Once the Kids Act comes into force, services designated as VLOPs will have only 30 days to submit their compliance plan. Services designated as VLOPs after the regulation has come into force will have up to four months from the point of designation to submit a compliance plan. To prove their compliance, these services will have to, at their own expense, commission an audit of the compliance plan by one or more independent auditors with proven expertise in a relevant field. Subsequently, providers must report annually on their compliance, as  part of the annual risk assessment mandated by Article 34 of the DSA (Art. 5). Notably, before that happens, the regulation must pass the Council and Parliament votes.