The European Commission presented the EU Kids Act on 17 September 2026: a proposed regulation that would set EU-wide age rules for social media, require supervised accounts for younger teenagers, and impose safe-by-design duties on every service minors can reach — including AI companions.
The proposed age tiers
The headline of the file is a graduated model rather than a single cut-off. These figures come from the Commission's announcement and remain open to change in negotiation.
Under 13
No access to personal social media accounts. The Commission's announced position is a floor for the whole single market, replacing the patchwork of national ages.
13 to 15
No personal account. Access via a parent- or guardian-supervised 'mini account' with reduced features and a daily time limit, as set out in the Commission's announcement.
Up to 18
Safe-by-design duties continue to apply: risk-reducing defaults, protection from sexualised and extreme content, and limits on engagement-maximising features.
Who would be in scope
Scope follows the service, not the company's address. If minors in the EU can reach it, it is in the frame.
Social networking services
Personal accounts, feeds, direct messaging and follower graphs accessible to minors.
Video-sharing platforms
Recommendation-driven video services, in scope regardless of where the provider is established.
AI companions and chatbots
General conversational assistants and companion apps that minors can reach — an explicit addition compared with the DSA's Article 28 guidelines.
Online games, app stores, operating systems
Distribution and platform layers carry duties too, including age signals passed to the services running on them.
The duties that matter in engineering terms
Age assurance that actually works
Self-declared dates of birth are the exact failure the proposal is written against. Expect a standard closer to Ofcom's 'highly effective' bar, with the EU age-verification app able to prove a threshold without revealing anything else about the person.
Safe-by-design defaults
Private accounts by default for minors, recommender settings that do not push escalating content, and disabling features engineered for compulsive use.
Detection and response for harm to minors
Grooming, sextortion, bullying, self-harm encouragement and AI-generated sexualised imagery of minors are the named harms driving the file. Keyword filters do not evidence a system against behavioural harm.
Parental supervision mechanics
Linked guardian accounts, feature restrictions and time limits have to be implemented, auditable and resistant to trivial circumvention.
Supervision and evidence
Covered providers would pay a supervisory fee and be expected to produce records on demand — the same evidence discipline the DSA and the UK Online Safety Act already impose.
Where it sits next to the rules you already have
The EU Kids Act does not replace anything. It layers on top of the DSA, runs in parallel with the UK Online Safety Act, and shares the same underlying demand: evidence that your service reduces risk to children, produced on request.
EU DSA
Article 28 guidelines, statements of reasons, systemic risk duties.
UK Online Safety Act
Ofcom's children's codes and the highly effective age assurance standard.
Age assurance
Methods that prove a threshold without collecting an identity file.
What to do in the next quarter
- 1 Measure your real age distribution. If the only signal is a self-declared birthday, you cannot answer the first question a regulator will ask.
- 2 Write down the defaults a 13-year-old gets on your service today, and which of them exist to increase time spent.
- 3 Check whether grooming, sextortion, self-harm encouragement and synthetic sexualised imagery are detected as behaviour, not keywords — and whether each decision leaves a retained record.
- 4 Decide who owns this file internally before the negotiation ends, so the design work happens across the next year rather than the last quarter before application.
Last verified against the legislative record on 2026-09-17. Primary source: European Commission press material . The Commission's full proposal is published on digital-strategy.ec.europa.eu .
Common questions
What is the EU Kids Act?
The EU Kids Act is a proposed European Union regulation on the protection of minors online, announced by Commission President Ursula von der Leyen in her State of the Union address on 16 September 2026 and presented by the Commission on 17 September 2026. It would set a single EU-wide approach to minimum ages for social media, parental supervision for younger teenagers, and safe-by-design duties for services accessible to under-18s.
Is the EU Kids Act law yet?
The EU Kids Act is a proposal, not law. The European Commission announced it in the State of the Union address on 16 September 2026 and presented the proposal on 17 September 2026. It now goes to the European Parliament and the Council, where the age thresholds, the scope and the supervision model can all still change, and it creates no obligations for platforms until it is adopted and its application date arrives.
What is the proposed age limit for social media in the EU?
As announced, under-13s would not be able to hold social media accounts at all. Users aged 13 to 15 would not hold personal accounts either, but could use supervised 'mini accounts' set up by a parent or guardian, with limited features and a daily time limit. Safe-by-design obligations would continue up to 18. The final figures can still change during the legislative process.
Who does the EU Kids Act apply to?
Based on the Commission's announcement and the circulated draft, it would cover providers of social networking services, video-sharing platforms, online games, app stores and operating systems, plus AI companions and general conversational chatbots reachable by minors — irrespective of where the provider is established, if the service is available in the EU.
How is the EU Kids Act different from the DSA?
The Digital Services Act sets systemic risk and transparency duties, and the Commission has so far addressed minors through guidelines under Article 28. The EU Kids Act would convert much of that guidance into directly applicable hard law, add explicit age thresholds, and extend scope to services such as AI companions that sit outside the usual very-large-platform framing.
When would platforms have to comply?
There is no compliance date yet. The proposal must be negotiated by the European Parliament and the Council, which typically takes many months to years, and is usually followed by a transition period before obligations bite. Teams should treat this as a design and evidence programme to start now, not a deadline to wait for.
What should a platform do today?
Three things carry over regardless of the final text: know the age distribution of your users with something better than self-declaration, be able to show that your defaults for minors reduce risk rather than maximise engagement, and be able to evidence that harm to minors is detected, reviewed and acted on with a retained audit trail. Every one of those is already required under the UK Online Safety Act and the DSA.
Written by the Tuteliq team for engineering, trust and safety, and compliance functions. Not legal advice. The Commission's published proposal and any final adopted text take precedence over anything here.
Detection and age assurance that produces evidence
Tuteliq detects grooming, bullying, self-harm, exploitation and fraud as behaviour rather than keywords, and returns the rationale, confidence and audit trail your records have to point at. EU-only processing, no content retention.
Want the full breakdown first? Read our EU Kids Act compliance guide