The EU Kids Act bans social media for under-13s

On Monday, September 14, the French government sent Brussels the new version of its social media law, one month to the day after the first one was struck down¹. On Thursday the 17th, Brussels answered by publishing its own². In between, Ursula von der Leyen had announced it to the Parliament in Strasbourg with a sentence that sums up the text. "Every day our children are engaging with some of the most sophisticated technology ever created. Technology that was not created with their wellbeing in mind."³

I followed the French law from its July vote to its fall on August 14, sold on the principle and skeptical about the lock. I also follow it as the father of a little girl. For now she seems to listen to what I tell her and to keep some distance, and I have no idea what she'll do once she's a preteen. I may well be the annoying dad, and she may well do the opposite of what I say. The European text picks up exactly where the Constitutional Council left the lawmakers, and it reaches well past social media, which settles most of my doubts and leaves me one.

Three ages instead of one cutoff

The Miller law shut the door on everyone under 15. The European regulation, proposed under the name EU KIDS Act⁴, builds a staircase. Under 13, no social media account at all, only video services designed for children, through an account a parent runs. From 13 to 15, a "mini-account" tied to a parent's, with at most one hour of use a day, contacts the parent approves one by one, and controls that can't be switched off. At 15, an account of your own, provided the service complies with the rest of the text⁵.

Those are, almost word for word, the three objections the Constitutional Council raised against the French law. The August 14 decision found the ban disproportionate because it applied regardless of age or service, and because no parent could authorize what they judged right for their own child⁶. The Brussels text adjusts by age, adjusts by service, and hands the mini-account to the parent. It reads like homework turned in after a look at the answer key, except that Brussels wrote it while Paris was still rereading its own.

The 15-year threshold is France's number, by the way. The European Parliament had asked for 16 in November 2025, by 483 votes to 92⁷. The negotiation now opening between Parliament and the 27 governments will turn on that figure too, and it will last months at best. None of what follows applies before 2027.

The text targets mechanisms more than logos

The core of the regulation is about how services are built. Any service minors use, up to age 18, must drop for them the infinite scroll and autoplay without breaks, the profiling-based recommendation feeds, the nighttime notifications, the rewards for coming back every day, and the "streaks" that punish whoever skips one⁵. Minors' profiles are private by default, location, camera, and microphone stay off until switched on, and no stranger gets to make first contact.

This is the part of the text that speaks to me most as a parent. I believe in talking things through and explaining, and I know what that weighs against friends who spend their evenings scrolling TikTok, or whatever replaces it once TikTok is declared too uncool. You don't pick your kids' friends. A text that takes infinite scroll away from all the friends at once does what no conversation at the dinner table can.

The burden of proof switches sides. A platform with more than 45 million monthly users in the Union, the threshold set by the Digital Services Act⁸, must prove it is safe before letting minors in, by submitting a compliance plan to an independent auditor it pays for itself. The Commission gives itself 30 days for preliminary findings and 90 to decide, with a fine that can reach 6% of worldwide revenue⁵. "Our KIDS Act is reversing the burden of proof," von der Leyen summed up. "It is for platforms to show they are safe by design."²

Paris reached the same spot by another road. The version filed on September 14 no longer shuts platforms down. It targets about ten features deemed addictive, autoplay, nighttime notifications, messages from strangers, endless scrolling, with an exemption parents can grant their 13-to-15-year-olds¹. After 18 months spent trying to ban logos, Paris finds itself, like Brussels, regulating mechanisms, which was the only road the law had left open. Getting struck down turns out to be a fast way to learn constitutional law.

Loot boxes are out of the game

The text also covers video games, defined as "any game playable on a computer, mobile device or console," whether the software runs at home or on a server, free or paid². The same design rules apply, with two additions. A game can no longer nudge a minor toward another service, and it can no longer expose them to loot boxes, those chests you buy without knowing what's inside, "or similar products with random or unpredictable outcomes." The recitals note that the link between these variable rewards and "gambling-related and compulsive behaviours" is "well documented."

I didn't see that line coming, and I'd sign it twice. A loot box is a game of chance, no different from a scratch card or a slot machine, except that it's sold inside a game rated for children and it pays out in cosmetics instead of cash. We've barred minors from gambling for a long time because a child doesn't know what a negative expected value is, and the chest is built so they never find out. PEGI, the body that age-rates games in Europe, had drawn its own conclusion in March by rating any new game selling "paid random items" 16 and up, a rule in force since June⁹. The regulation shuts the door PEGI had left ajar.

The industry answered the same day. Video Games Europe, which speaks for the publishers, recalls "children's right to play, access to culture and leisure" and "caution[s] against sweeping age assurance measures applicable to every game and player in Europe," proposing that PEGI become the reference standard instead¹⁰. Tim Sweeney, the head of Epic Games, wrote on X that "the apps and games of today are the paintbrushes and tree forts of yesterday," because a kid who can't open an account before 15 won't build anything in Fortnite¹¹. The tree fort line is a nice one. Nobody sold paid chests at the foot of the tree, though.

AI companions too

The text finally covers chatbots and AI companions, which the Miller law never considered. Where minors can reach them, they may not "simulate human relationships in ways likely to create emotional dependency," they won't carry earlier conversations into later ones by default, they must have been tested for child-specific risks before launch, and under 13 they're reachable only through parental controls, never switching themselves on⁵.

I've read that list before. It's roughly the one OpenAI applied on its own on August 18 with ChatGPT for Teens, four days after the French censure, an assistant that refuses the romantic and won't let anyone believe it feels anything¹². I wrote at the time that a protection decided by a company could vanish on a Tuesday morning with no debate. The regulation turns it into an obligation a parliament will have voted on, which is exactly what was missing. On the industry side, Euronews is already relaying the fear that a separate European product and costly assessments will delay launches on the continent and widen the gap with the United States¹³. The argument deserves a hearing, as long as you remember that Europe is regulating an AI it doesn't build, and that no teenager ever lost sleep over a delayed launch.

Everyone will have to prove their age

Then there's what the text opens up. A ban before 13, a mini-account until 15, design rules until 18, on social networks, video platforms, games, app stores, and chatbots, all of that assumes each of these services knows the age of each of its users, adults included. What used to be a question put to social networks becomes a question put to your entire digital life, down to the console in the living room, and that's where my discomfort from July should have come back, bigger.

The text answers it better than the French law, which didn't answer it at all. Verification will go through certified solutions independent of the platforms, the European age verification app or the European digital identity wallet, with every member state required to offer at least one free method⁵. The principle is zero-knowledge proof¹⁴, so the platform gets a yes or a no to the question "are they over 13?" and nothing else, no name, no date of birth, no document. The app exists, in a form the Commission has called technically ready since May 11, France is one of seven countries piloting it inside their national wallets, and Brussels has asked for it to be available everywhere by December 31, 2026¹⁵. Parents, for their part, will have to be able to prove for free that they are the parents, without handing over anything more.

This is the double anonymity of Arcom's framework, which I was asking for in July, scaled up to the continent and entrusted to the state rather than to a vendor. Back then I feared age checks would turn into a lucrative business for companies like Persona, which already verifies Reddit and Roblox users, and that my ID card would end up in a leak like the one that hit 70,000 Discord users. The European text cuts those middlemen out of the loop, since the proof comes from a public app that keeps neither document nor face. I didn't expect that, and I'm all the happier to say that on this point Brussels did better than I was asking for. What I have left is a doubt about execution, not principle. The app lives on a phone, the same phone a 12-year-old borrows to "just look something up," and the most secure proof in the world is worth whatever hand is holding it. As for accounts already open, platforms will have six months after the rules take effect to check the age of everyone signed up and close the accounts of those too young⁵. Three months into its ban, Australia still counted 85% of its under-16s on the targeted platforms, because nobody had checked. The European regulation, for its part, writes down who checks, which neither Canberra nor Paris had done.

Spring 2027 has a new address

In August, I set a date for spring 2027, when Emmanuel Macron wanted a "legally sound" law. The date holds, except it will be kept in two places. The French law heads back to Parliament with its addictive features and its parental exemption, and the European regulation starts its run between the Strasbourg Parliament and the 27 governments, carrying the 15-year threshold France pushed for. "This protection must also become the norm for all children," the president said on September 14, and for once the calendar proved him right within three days¹.

My two discomforts from July have changed size. The one about teenagers has shrunk, because the text goes after the mechanisms that hold them rather than the logos they love, and because it takes the gambling out of the games. The one about our papers has nearly gone, which I wouldn't have bet on this summer, since the age check ends up with a public app that knows nothing about us rather than with an industry that would have made a business of it. I wanted someone to write down the how. It's written, it fits in an app, and what happens next will be decided less in Strasbourg than in my daughter's schoolyard.

Notes

1. Le Journal de l'économie, "Réseaux sociaux, comment Macron contourne la censure pour interdire les plateformes aux jeunes" (in French), and Les Gens d'Internet, "EU KIDS Act, les propositions de la Commission européenne pour protéger les enfants sur les réseaux sociaux" (in French), September 18, 2026. Macron's words are my translation. ↩ ↩² ↩³

2. European Commission, "EU KIDS Act, la Commission propose de restreindre l'accès des plateformes de médias sociaux aux enfants dans l'UE" (in French), September 17, 2026, and "EU KIDS Act to restrict social media platforms' access to children in the EU". The proposal's provisions on games are detailed by Gaming.net, "European Commission Adopts EU KIDS Act Proposal Covering Online Games". ↩ ↩² ↩³

3. European Commission, "EU KIDS Act, helping children navigate a safer online world", quoting the passage from the State of the Union address of September 16, 2026. ↩

4. For Keeping Internet Digital Spaces Accountable and Trustworthy. The document is referenced as COM(2026) 681 and rests on Article 114 of the Treaty, the internal market article, which is why it takes the form of a regulation, directly applicable, rather than a directive to be transposed. ↩

5. European Commission, "The KIDS Act explained", the Q&A published with the proposal, which is the source for the age brackets, the list of banned mechanisms, the chatbot rules, age verification, the thresholds, the deadlines, and the fines. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

6. Constitutional Council, decision no. 2026-911 DC of August 14, 2026 (in French). ↩

7. European Parliament, "Il faut avoir 16 ans pour accéder aux réseaux sociaux, selon les députés" (in French), press release of November 26, 2025. ↩

8. The Digital Services Act, in force since 2024, labels "very large online platforms" those above 45 million monthly users in the Union and puts them under the Commission's direct supervision. The KIDS Act reuses that threshold and that setup, with other services falling to national authorities, Arcom in France. ↩

9. Reed Smith, "PEGI launches 'interactive risk categories'; overhauls age ratings for loot boxes, in-game spending, and communication features", on PEGI's announcement of March 12, 2026, applicable to new titles since June. ↩

10. Mobilegamer.biz, "Video Games Europe warns against sweeping restrictions proposed in the EU KIDS Act", September 17, 2026. ↩

11. Game World Observer, "'This would be terrible for the next generation of humanity': Epic Games CEO on the risk of restricting children's access to online games in the EU", September 17, 2026. ↩

12. OpenAI, "Introducing ChatGPT for Teens", August 18, 2026. ↩

13. Euronews, "Could the EU Kids Act unwittingly widen the transatlantic AI divide?", September 18, 2026. ↩

14. A zero-knowledge proof shows that a statement is true, here "this person is over 13," without revealing what makes it true, here the date of birth or the document that carries it. The Commission specifies that the chosen solution "cannot identify, locate, track or profile anyone." ↩

15. European Commission, "Commission urges fast rollout of age verification app", April 29, 2026, and "Commission releases enhanced second version of the age-verification blueprint", May 11, 2026. The seven pilot countries are France, Denmark, Greece, Italy, Spain, Cyprus, and Ireland. ↩