Security1 publisher3 min readPublished
The EU Kids Act would make every in-scope platform store a parent-to-child account link
The Commission's proposal bars under-13s, holds 13-to-15-year-olds to an hour a day through accounts created from a parent's, and threatens fines of up to 6% of global sales. Council and Parliament have not voted.
The Watch · Security desk
What happened
- The European Commission announced the EU Kids Act, a proposal to restrict social media access for under-15s across all member states.
- Under-13s would be barred from platforms, 13-to-15-year-olds limited to an hour a day through mini accounts set up from a parent or guardian's account, and only 15-year-olds could open their own.
- As a binding regulation it would supersede national schemes in France and Spain, with no opt-out for member states.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- cost The penalty ceiling is measured against global sales, so the size of a company's EU under-15 userbase does not bound what non-compliance costs it.
- exposure Compliance would put verified minor identities, the adult accounts they hang off and per-user time counters inside services that never held that data before. Each of those stores becomes something to defend.
- decision Platform engineering teams have to choose between building age assurance and parental linkage before the vote or carrying the schedule risk of a text the Council can still rewrite.
- constraint Work already done against French or Spanish national rules may have to be unpicked, since the BBC reports the Commission has warned member states to repeal laws passed before the act takes effect.
The daily cap in the draft is a metering requirement. Metering cannot be done on the client. One hour a day works out to seven hours a week per account [21], counted server-side, bound to one verified person, and reconciled across phone, tablet, browser and console [3]. Online games and AI chatbots sit in scope alongside TikTok, Instagram, Snapchat, YouTube and other video sharing platforms [7].
A mini account is created through the parent's or guardian's account [3]. So the service ends up storing an association between a child's login and an adult's, plus whatever age band it relied on and a running usage counter [22]. The privacy objection to the bans has landed on the age check itself, and on teenagers handing over personal information to prove their age [15]. The Commission says age would be verified through the EU's existing age verification app and that no personal data would be collected or shared [10]. That answer covers the age proof; the link between the two accounts is a platform-side record [22].
Beyond the age gates, platforms would have to prove they are safe by design and submit detailed child safety plans [5][6]. Ursula von der Leyen told the European Parliament on Thursday that "for every person under 18, the platforms must follow the principle of safety by design, no toxic or addictive features, no traps, etc" [8]. She also said "an age limit does not mean letting tech companies off the hook for the content on the platform" [9]. Recommender configuration and autoplay defaults become evidence in a filing, owned by whoever runs those systems.
No obligation lands until member states agree the text and the European Parliament approves it [11]. Von der Leyen said the Commission had "looked at Australia", which banned social media platforms for under-16s last year [20]. France shows the drafting risk. The Macron government's own under-15 ban was blocked last month by the country's top court, which ruled it infringed freedom of expression, and ministers have since amended the plans [14].
Enforcement against the same design features is already running under existing rules. In July the Commission's preliminary findings said infinite scroll, autoplaying videos and personalised recommendations could encourage "compulsive use", particularly among children and teens, and told Meta to change the design of Facebook and Instagram or face a heavy fine [16]. A Meta spokesperson told the BBC the company disagreed with the findings, "which don't accurately take into account the significant steps we've taken to protect teens" [17]. In August Meta agreed an $18bn settlement with US states and territories over claims that Facebook and Instagram harmed children, and denied wrongdoing as part of it [18].
An integration point for external age assurance survives most redrafts of a text like this, and so does per-identity session accounting that does not copy a parent's credentials into a child's session. The age bands and the hour limit are the numbers most exposed to change, since member states may try to strengthen or weaken the proposals and questions about enforcement are already open [19].
What to watch
- The Council and European Parliament votes, and whether the 13-to-15 hour cap survives them intact.
- Whether the Commission publishes technical detail on how the age verification app would attach to a parent-created mini account.
- The outcome of the Commission's July preliminary findings against Meta on Facebook and Instagram design.