Security1 publisher2 min readPublished
The EU KIDS Act proposal ties every 13- to 15-year-old account to a parent's login
The Commission adopted the proposal on September 18. Under-13s would be kept off social media, and 13- to 15-year-olds would only get parent-linked accounts carrying a 60-minute daily cap that platforms have to enforce.
The Watch · Security desk
What happened
- The European Commission adopted the EU KIDS Act proposal on September 18, barring children under 13 from social media and setting 15 as the minimum age at which a minor can open an account independently.
- Those mini accounts carry a limit of up to 60 minutes of screen time per day, and a parent would be able to set the allowance lower.
- The proposal moves the burden of proof onto providers, which would have to demonstrate their services are safe by design for younger users or lose access to children.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint A daily allowance a parent can lower has to be counted server-side against a linked child identity and exposed to the guardian, so per-device timers and local app settings will not satisfy it.
- decision Providers would have to keep safety-by-design evidence ready in advance instead of assembling it after a regulator's finding. Ownership of that documentation inside the company changes with it.
- exposure Any service where age is a self-declared field at signup is exposed, because the consequence of a failed demonstration is losing access to the under-15 population.
- precedent Von der Leyen's complaint about years-long DSA and DMA enforcement is the argument for prove-it-first, and if it works here the same structure becomes available for other categories of online harm.
The published description of the proposal does not say how a platform decides that a user is 12, 14 or 16. Every control underneath those thresholds depends on an age signal the service has to source itself. The thresholds are exact and the method is left open [16].
The mini account is the part that touches code. A 13- to 15-year-old would hold an account managed through a parent or guardian's account, with restrictions on social contacts and on screen time [4]. The cap is up to 60 minutes a day, and a parent can set it lower [5]. A timer kept on the handset fails the first time the child signs in on a second phone or a fresh browser profile, so the daily budget has to be metered server-side against the child's identity and readable from the guardian's side. For the 3 to under 13 band, parents would also get tools to restrict an adult device to child-friendly video-sharing services when they hand the device over [6].
The compliance change is the burden of proof. Providers would have to demonstrate that their services are safe by design and appropriate for younger users, and one that cannot demonstrate it would not get access to children at all [7]. Ursula von der Leyen's stated reason is timing: she said assessment of whether algorithms are harming children under the Digital Services Act and Digital Markets Act can take months, followed by discussions with platforms and further changes, and several years before penalties land [8].
Von der Leyen cited average screen time of four to six hours a day for young people in Europe, and seven to eight hours for those who started before the age of 10 [10]. Sixty minutes is a quarter of four hours and a sixth of six [14]. Against seven to eight hours it is between an eighth and a seventh [15]. She also cited the July Eurobarometer, in which 92% of Europeans surveyed said more should be done to protect children online [9].
The Commission adopted this on September 18 as a proposal, after a six-month expert panel that included civil society, parent organisations and youth groups [1][11]. Von der Leyen said the question is how and when digital services should be allowed to reach children [12].
What to watch
- Whether the legislative text names acceptable age assurance methods or leaves the choice to platforms.
- What evidence the Commission would accept as a demonstration that a service is safe by design for children.
- Whether the 60-minute mini account cap survives the legislative process intact.