Regulation / Privacy / AI Governance
EU Kids Act proposal would turn minor-protection guidance into audited design and age-check duties
A law-firm analysis of the Commission's 17 September proposal sets out age tiers, a six-month review of existing accounts and GDPR questions for age assurance, as the text enters the legislative procedure.

The European Commission adopted its proposal for the EU KIDS Act on 17 September 2026. According to an analysis by Squire Patton Boggs, it would turn minor protection under Article 28 of the Digital Services Act, so far shaped largely by non-binding guidelines, into specific design obligations. It would cover social networks, video-sharing platforms, app stores, games, operating systems and AI chatbots, with no size threshold.
The text sets no own account below 13, guardian-run accounts capped at one hour a day for 13–14, and own accounts from 15. Providers would have six months from application to identify existing under-15 accounts and disable those of minors or users whose age cannot be confirmed. Children must always have at least one feed option without profiling, and the largest platforms must have their compliance plans checked by independent auditors.
The proposal now awaits opinions from EU advisory committees before Parliament and Council set positions. No end date is set.
Editor’s note: The age rules and the review of existing accounts are checked against the Commission’s explanation of the proposal; the scope and GDPR points follow Squire Patton Boggs’ analysis.
Why it matters
Age verification for every user means processing adults' and minors' data at scale, so the firm says providers will need a GDPR legal basis, a DPIA and a data-minimising solution. The six-month account review is an automated, large-scale decision exercise that raises questions about automated decisions, retention of disabled accounts' data and complaints from wrongly flagged adults. The 13–14 tier does not align with national GDPR consent ages, so consent records and age attributes in customer master data may need rethinking.
Status: Proposal. Awaiting EESC and Committee of the Regions opinions before Parliament and Council positions
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Legislation tracker
- EU Kids ActProposal · 2 stories
Institutions
Who should care
- DPO
- Legal & compliance
- AI governance lead
- Product owners