EU KIDS ACT. PROTECTION OF CHILDREN ONLINE AND IN THE DIGITAL WORLD

According to Flash Eurobarometer 584, “EU Challenges and Priorities“, nearly two-thirds of European Union citizens (63%) believe it is necessary to introduce European rules that restrict minors’ access to social media, with the aim of protecting them from phenomena such as addiction, cyberbullying, and harmful content^[1]. The issue, however, is not limited to Europe. In recent years, in fact, several countries around the world have adopted, or are considering, measures aimed at restricting minors’ access to social media platforms.

Australia was among the first countries to take decisive action, introducing a ban on access to social media for those under 16 at the end of 2025. Similar measures have also been adopted in Malaysia and Indonesia. China, by contrast, has chosen a different approach: not a blanket ban, but the introduction of a “minors’ mode” — a system of restrictions applied at the device and individual app level that limits usage time according to age group. In Turkey and the United Arab Emirates, restrictions have been introduced for those under 15, while in Brazil a law requires users under 16 to link their account to that of a holder of parental responsibility or a legal guardian.

Significantly, in the United States, there is currently no federal regulation equivalent to a blanket ban on minors’ access to social media. The issue is, however, the subject of substantial litigation. In August 2026, a coalition of state attorneys general reached a settlement in proceedings brought against Meta, as part of an action that challenged, among other things, Facebook and Instagram’s use of mechanisms considered suitable for encouraging compulsive usage behavior among minors, as well as the collection of data from users under 13 without the necessary parental consent.

In Europe too, the debate has given rise to a series of national initiatives, albeit characterized by different approaches. In the United Kingdom, in June, former Prime Minister Starmer announced the intention to introduce a ban on social media access for those under 16. The related bill also provides for age verification systems using tools such as facial scanning or the presentation of an identity document. In Portugal, in February 2026, a ban on social media access for children under 13 was approved, while parental consent would be required for those between 13 and 16. In Denmark, a cross-party political agreement was reached to introduce a ban on social media access for those under 15, while allowing parents to authorize it from age 13; the implementing legislation is still awaited. In Spain, former Prime Minister Sánchez had announced the intention to ban social media access for those under 16. The proposal also featured a particularly significant element: the provision for criminal liability for the top executives of platforms that fail to remove illegal content. The measure is not expected to be approved before the end of 2026, but the current political crisis in Spain could delay or call the initiative into question. In Germany, a parliamentary committee is examining the feasibility of blocking social media access for children under 14. In Norway, meanwhile, a public consultation has concluded on a system that aims to set the minimum age for access at 15, requiring the use of BankID, the national digital identity system, for age verification.

France had also moved toward a similar system: Parliament had definitively approved a ban on social media access for those under 15, but the measure was subsequently struck down by the Conseil constitutionnel, which censured Article 1, concerning precisely that ban. According to the Conseil, the measure constituted a disproportionate interference with the freedom of expression and communication of minors under 15 and did not offer sufficient safeguards in terms of privacy protection in the age verification process.

In Italy, the political debate on the protection of minors online remains open. Several bills have been introduced in Parliament addressing, in different ways, the minimum age for independent registration on social media — proposing thresholds of 13 or 15 — as well as the introduction of parental control systems, the protection of minors exposed to risks in the digital environment, and platform liability.

The picture emerging at the international level is therefore characterized by numerous but fragmented initiatives, many of which are still in the drafting stage or have not yet resulted in definitive legislation. It is precisely in this context that the European Union has chosen a different path: rather than simply introducing an age threshold for access to social media, it is taking a broader approach to the architecture of digital services and the ways in which they are designed and offered to minors. It is in this perspective that the EU Kids Act fits, presented by the European Commission on September 17, 2026, with the aim of defining a harmonized European framework for the protection of minors in the digital environment^[2].

According to the Commission, one of the main elements of the proposal concerns access to social media. Minors will be able to independently create a social media account starting at age 15. Starting at age 13, however, parents or guardians will be able to set up “mini-accounts” for minors linked to their own account. Access will concern social media platforms and video-sharing services deemed appropriate for the age group and will be accompanied by specific safeguards, including the restriction of social contacts and a maximum usage time of one hour per day. For minors between 3 and 13 years old, access to social media will not be permitted. However, video-sharing services designed specifically for this age group will be available through accounts managed by parents or guardians. The latter will also be able to restrict device use to authorized services only and to a maximum of one hour per day.

It is important to distinguish the threshold of 15 years set by the EU Kids Act for independently opening an account from the threshold relating to consent to the processing of personal data. Article 8 of the GDPR sets at 16 the minimum age for a minor to independently give consent to the processing of personal data in connection with the direct offer of information society services to minors. Member States may, however, lower this threshold to a minimum of 13 years. Italy has exercised this option through Article 2-quinquies of Legislative Decree 196/2003, setting the national threshold at 14 years. These are, however, two different disciplines with distinct purposes. Article 8 of the GDPR concerns the minor’s ability to independently give consent where this constitutes the legal basis for the processing of personal data, whereas the EU Kids Act governs the conditions under which minors may access certain categories of digital services. There is therefore not necessarily a contradiction in the fact that a fourteen-year-old may, under Italian law, independently consent to the processing of their own personal data while, at the same time, not yet being permitted to independently open an account on a service governed by the Kids Act^[3].

The Commission’s proposal is not limited to the question of the minimum age for access to social media but introduces a series of obligations applicable to all online services aimed at users under 18, including social media, video-sharing platforms, online video games, AI companions^[4], and chatbots. Among the proposal’s objectives is a ban on features designed to encourage compulsive use and on recommendation systems based on profiling that could direct minors toward harmful content. Features subject to the ban would include infinite scrolling of content without break points, certain reward mechanisms, push notifications during nighttime hours, and unsolicited contact from strangers. Particular attention is given to artificial intelligence systems. AI companions and chatbots must be disabled by default and may not simulate interpersonal relationships in a way that fosters emotional dependency. Minors’ profiles must also be set to private by default, while features such as geolocation, the camera, and the microphone must be disabled.

A further key element concerns age verification. Online services and app stores must use appropriate tools to verify users’ age. These include the European age verification application^[5], designed not to store identity documents or biometric data, with the aim of ensuring high standards of privacy protection.

Finally, the proposal addresses the liability of large digital service providers by introducing a particularly significant principle of reversal of the burden of proof: it will be for platforms to demonstrate that their services are safe for minors as early as the design phase. Providers will also be required to submit a specific “compliance plan” to the European Commission, built on the tools already provided for under the Digital Services Act (Regulation  (EU) 2022/2065)^[6] and the AI Act (Regulation (EU) 2024/1689)^[7].

The period for submitting observations will close on November 26, 2026. The comments received will then be summarized by the Commission and forwarded to the European Parliament and the Council, with the aim of contributing to the subsequent legislative debate. Therefore, the European objective is not only to set a minimum age for users to gain access to social media, but also and above all, to design a digital ecosystem in which the safety of minors is considered an essential cross-cutting value.