Are these Kids still alright?

Child safety online is one of the defining regulatory topics of 2026 – and it reaches far beyond social media. From mobile games and video-sharing platforms to AI chatbots, virtually every digital service that is popular with young audiences is now in the crosshairs of legislators worldwide. In December 2025, Australia became the first country to ban social media for children under 16. Brazil adopted its own statute. In the United States, a wave of state-level legislation and landmark litigation against Meta has shifted the debate from self-regulation to legal liability. In Europe, already more than twenty Member States have contemplated, drafted or notified national laws regulating minors’ access to digital services. The result is a regulatory patchwork that creates legal uncertainty for in-scope service providers.

Child safety regulation is closely linked to broader EU consumer protection policy. From the Unfair Commercial Practices Directive (UCPD) to the forthcoming Digital Fairness Act, the EU is taking an increasingly paternalistic approach to digital services, with prescriptive rules that leave consumers less room to make their own choices. (for insights into this regulatory trajectory, visit Time to Riot! How to respond to overbearing consumer protection).

Enter the EU KIDS Act

On 17 September 2026, the Commission published its proposal for the EU KIDS Act (“EU Keeping Internet Digital Spaces Accountable and Trustworthy”), accompanied by a Communication setting out the broader policy approach and a detailed Staff Working Document. As a Commission proposal, the KIDS Act must still pass through the ordinary legislative procedure, with the European Parliament and the Council each adopting their own positions before a final text is agreed in trilogue negotiations; the scope and specific requirements described below may therefore still change before adoption.

The KIDS Act applies to a broad range of online services and systems: social networking services, video-sharing platforms, AI companions, general conversational chatbots, software application stores – and, most notably for the gaming industry, online games. A “video game” is defined as any information society service that allows users to engage, via an application accessed locally or remotely, with a user interface or input device to generate visual feedback in a simulated environment for play or entertainment purposes. A “video gaming platform” is an online platform, as defined in the Digital Service Act (DSA), that involves such interaction in a simulated environment. In practice, this captures everything from AAA console titles with online features to free-to-play mobile games and browser-based gaming platforms.

The proposal rests on two central design choices: an EU-wide minimum age framework and mandatory safety-by-design obligations.

Design choice 1: Age categories and access restrictions

The KIDS Act introduces a graduated access model based on three age brackets:

• Under 13: No access to social media and video-sharing platforms. Guardians may allow access to specifically child-friendly video-sharing platforms through supervised, guardian-controlled accounts with a daily limit of one hour;

• 13 to 15: Guardians may create accounts with strictly limited features, including restricted contacts and limited screen time of one hour per day, with the account remaining under the guardian’s name;

• 15 to 18: Teenagers can create their own autonomous accounts, but only in a safe-by-design environment with protective default settings.

Design choice 2: Safety by design

The KIDS Act goes beyond access restrictions by requiring all in-scope services to be designed with the privacy, safety and security of minors in mind by default. Key safety-by-design requirements include:

• Safeguards against addictive design features;

• Regulated recommender systems (i.e. explicit user preferences over implicit engagement signals);

• Privacy-sensitive default settings (i.e. location, camera, microphone, contacts);

• Restricted contact and interaction (e.g. unknown users cannot initiate direct contact);

• Child-friendly reporting and support mechanisms.

The proposal applies a common set of safety-by-design requirements across the different categories of providers, but tailors specific obligations to the particular risks and functionalities of various services; hence, the devil is in the details.

Three challenges for the gaming industry

While the objectives of the KIDS Act enjoy broad political support, three issues stand out as particularly challenging for game developers and publishers.

1. Age verification: still the hard problem

In practice, effective age verification still remains one of the hardest problems in online regulation. Discord offers a cautionary example: in 2024, the platform introduced age verification for access to certain NSFW (not safe for work) channels, but the mechanism was widely criticised for being easily circumvented and creating a false sense of security. The Commission’s own enforcement action against Meta highlighted that roughly 10–12% of children under 13 across the EU still access Instagram and Facebook despite minimum-age requirements – because existing checks are so easy to bypass.

The KIDS Act now distinguishes between age assurance and the more specific concept of age verification depending on the respective service. It remains to be seen whether the required mechanisms – EU proof-of-age attestations for social networking and video-sharing services and alternative age assurance solutions for other providers, including online games – can be deployed at scale. Self-declaration is excluded in all cases.

2. Addictive design: from soft law to hard bans

Addictive design is not a new concern; it has been the subject of a dark pattern discussion that has been running at EU level for years. The DSA already prohibits providers of online platforms from designing, organising or operating their online interfaces in a way that deceives or manipulates recipients or otherwise materially distorts or impairs their ability to make free and informed decisions, and European data protection authorities have separately catalogued such “deceptive design patterns” in social media interfaces and assessed them against data protection principles of fairness and transparency. The non-binding DSA Guidelines on the protection of minors already recommended that platforms disable features like autoplay, infinite scroll, push notifications and reward-based engagement loops. But compliance was uneven at best. The Commission has opened enforcement proceedings against TikTok over its addictive design and against Meta for similar features on Instagram and Facebook. However, the European Parliament has pointed out that the existing dark-pattern rules are limited to choice architecture, do not address behavioural design that is addictive per se, and only apply to online platforms, thereby excluding services such as online games, while general EU consumer protection law only prohibits certain dark patterns through a fixed blacklist and does not refer specifically to digital interfaces, leaving legal uncertainty for consumers and businesses alike. Parliament has therefore called on the Commission to ensure equivalent minimum obligations for online games that do not otherwise qualify as online platforms, and the forthcoming Digital Fairness Act is expected to pick up this thread for services currently outside that scope.

Under the KIDS Act, the features named above are explicitly prohibited for minors. Providers must implement time-management tools that effectively reduce use and cannot be easily circumvented. Core sleep hours and school time are protected by default. For the gaming industry, these requirements may have significant implications. Features such as engagement loops, daily login rewards, battle pass timers or seasonal events are not uncommon to support player engagement and monetisation. Adapting these systems for the EU market – or disabling them for under-18s – may therefore require substantial product-design decisions rather than a straightforward compliance update

3. Where games meet chatbots: overlapping scopes

Many modern games integrate conversational AI in various forms. Under the KIDS Act, these features may trigger obligations under both the online games regime and the AI companion/chatbot regime.

For game developers, this raises practical questions. For instance, does an AI-powered NPC that responds to free-form player input constitute a “general conversational chatbot”? If so, it must comply with the chatbot-specific rules on emotional dependency, interaction memory and pre-market testing – on top of the game-specific safety-by-design requirements. The Act does not provide clear guidance on how to resolve these overlaps, and the risk of double regulation is real.

The KIDS Act in the overall child protection framework

The KIDS Act does not operate in isolation. The EU already has a range of instruments in place to address different aspects of children’s safety and protection online. The European Commission’s strategy for a Better Internet for Kids (BIK+) serves primarily as a policy framework, while binding obligations are based in the DSA. The DSA requires online platforms to ensure a “high level of privacy, safety and security” for minors. This is complemented by sector-specific instruments, such as the Audiovisual Media Services Directive (AVMSD); the AI Act, the GDPR or the Unfair Commercial Practices Directive (UCPD).

Taken together, these instruments form a fragmented legal framework with varying objectives and a panoply of rules to observe.

Outlook and next steps

The KIDS Act is expected to move quickly forward given strong political backing across Member States, the Council and the European Parliament. In parallel, the Commission is pursuing the Digital Fairness Act (DFA) and a revision of the AVMSD. Stakeholders from the gaming industry are therefore advised to monitor these legislative processes closely, as the scope and requirements of the KIDS Act are likely to evolve during the negotiations, and to make active use of any stakeholder consultations and other opportunities to contribute their practical expertise to the legislative process.

BLOMSTEIN will closely monitor further developments in the EU legislative process and keep you informed. If you have any questions on the EU KIDS Act or EU Digital Law more broadly, Dr. Leonard von Rummel, Dr. Nils Grohmann, Mattis Leson and the entire team are ready to assist you.