Build1 publisherNot yet confirmed elsewhere2 min readPublished
European Commission's KIDS Act proposal pushes age checks and safe defaults into product design
European Commission's KIDS Act proposal expects services minors can reach to build in age-banded access and safe defaults, with comments due 26 November 2026. Nothing is binding yet. The design it points to ties each default to an age check that keeps no ID documents.
The Engineer · Build desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- The Commission formally published the proposal on 17 September 2026, and it is now entering the EU legislative process with no binding obligation yet.
- Official materials list private profiles by default for minors, easier blocking and silencing, fewer addictive design elements and limits on night-time push notifications.
- The scope reaches social media and video-sharing services, online games and AI chat companions, plus the app stores and wider service ecosystems tied to them.
- Very large online services would carry most of the duty to show they designed for minors' safety, and smaller providers are not the stated focus.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- exposure A game studio or an AI companion maker would be judged on whether minors can reach the product, so teams that never saw themselves as social platforms have defaults to review.
- precedent A harmonised EU minimum would set the baseline that smaller providers' products get compared against, even though the accountability duties aim at the largest services.
- decision Teams that object to age bands or feature mappings have to raise it in the Commission consultation, because once it closes the text moves on to Parliament and Council.
In code, the proposal is a table of defaults keyed by age. A dev.to summary of the Commission's materials describes gradual access: account access and feature availability change as children get older, younger users get more parental or guardian involvement, and older minors get more autonomy [6]. Every measure on the Commission's list changes a default setting [7]. Each one becomes a flag lookup that takes an age band as an input.
The age band is the hard input. The Commission backs verification methods that protect privacy, including EU-wide tools that keep no identity documents or biometric data [8]. The dev.to summary frames the test as whether an approach can "establish an age-related outcome without retaining sensitive identity or biometric information" [2]. I think this is the right constraint, and it is good engineering. It pushes the schema toward storing a result, such as an age band or an over-threshold flag plus the method used, and throwing away the evidence. A table of outcomes is a smaller thing to lose in a breach than a folder of scanned passports.
The design breaks first where there is no account. The summary's list of access points to review includes sign-up flows, guest use, app-store distribution and features reachable without an account [1]. A guest session has nowhere to store an age band. So the lookup needs a value for "unknown", and in my view safety by design points to the protective one. Night-time notification limits [7] add a second dependency. Before it sends anything, the push scheduler needs the recipient's age band and their local time.
AI chat companions get specific attention. According to the summary, the questions for them are how younger users encounter the feature, what defaults apply, and how easily harmful or unwanted interactions can be limited [10]. Those map to entry points, session defaults and a stop control. A team can change all three without retraining a model.
The full name is EU Keeping Internet Digital Spaces Accountable and Trustworthy. It is meant to set a harmonised EU-wide minimum standard alongside the Digital Services Act [5]. As backronyms go, it is a long walk to KIDS. The summary does not give age thresholds, the mapping of features to bands, or enforcement terms. The consultation runs 70 days, from publication on 17 September to the 26 November close [12]. After that the text moves to Parliament and Council [4].
What to watch
- A revised text or Commission summary that sets the age thresholds and maps specific features to each band.
- Technical specifications for the EU-wide age-verification tools, including what result a service actually receives from a check.
- How Parliament and Council treat the split between very large online services and smaller providers once the text reaches them.