On September 17, 2026, the European Commission formally adopted the proposed EU KIDS Act, a regulation that would set a single age threshold for social media use across all 27 member states, according to the Commission’s own announcement. commission.europa.eu says children under 13 would be barred from social media accounts entirely, those aged 13 to under 15 could only access platforms through a ‘mini account’ controlled by a parent or guardian, with a one-hour daily limit and restricted contacts, and only from age 15 could a young person open and manage an account of their own.
The proposal reverses the existing burden of proof in EU tech law. Instead of regulators having to prove a platform is unsafe, very large platforms will now have to prove to an independent auditor that their services are ‘safe by design’ for minors, per the Commission’s own filing. commission.europa.eu states that enforcement will build on the Digital Services Act’s existing compliance architecture, meaning Brussels regulators, not national parliaments or courts, will judge whether platforms meet the standard.
Age checks are meant to run through an EU-built verification app rather than through platforms collecting identity documents directly, according to the Commission’s own description of the system. The Commission states the app is designed so that it tells a platform only whether a user is above or below a threshold, without retaining identity documents or biometric data. Whether that architecture will function as advertised across 450 million people and 27 legal systems, and whether member states will build the promised free access points for people without digital ID, remains untested, since the app is still being piloted in only seven countries as of this proposal.
A privacy lawyer’s professional read
The IAPP, a professional body for privacy officers, published its own technical breakdown of the proposal shortly after it was unveiled, noting that the KIDS Act layers a new age-assurance mandate onto the existing Digital Services Act and General Data Protection Regulation frameworks. iapp.org describes the compliance burden platforms will face in proving safety by design to auditors, a mechanism that effectively places Brussels appointees, rather than elected national legislatures, in the position of setting the operative safety bar for what children may see online.
Von der Leyen, in remarks accompanying the proposal, said children are growing up in the most online-mediated childhood in history and that the Commission’s job is to help them navigate a safer digital world, according to the Commission’s own press statement. That framing rests on the presumption that a single, centrally designed identity and access system is preferable to the patchwork of national laws and individual parental decisions the KIDS Act would supersede, a presumption the Commission asserts but does not test against any comparator with a track record.
How the outlets framed it
The Epoch Times framed the plan as a centralising power grab, reporting that a single Commission president is pushing a bloc-wide identity and access architecture that could require expanded verification infrastructure and that sits uneasily against Washington’s preference for parental discretion over federal mandates, according to theepochtimes.com. The Commission’s own materials and the IAPP’s technical explainer, by contrast, present the same proposal as a protective, privacy-preserving child-safety measure that shifts legal burden onto platforms rather than families. The gap between these framings is not about the mechanics, which both sides describe similarly, but about who should hold the authority to decide: Brussels regulators and auditors, or national governments and parents making case-by-case judgments.
Whichever framing proves more accurate in practice, the KIDS Act would still need approval from the European Parliament and the Council of the EU before becoming law, and its pilot programme covers only seven of 27 member states so far, meaning the system von der Leyen described in her State of the Union address remains, for now, a proposal rather than an operating reality.
