Cybersecurity Policy Report, Kids Act, With Age Limits for Social Media Use, Heads to EU Parliament, Council, (Sep 17, 2026)

By Jeff Williams

The European Commission (EC) yesterday adopted the European Union Kids Act, which calls for prohibiting social media platforms from allowing access to children under 13 years old, establishes a European Union–wide minimum age of 15 years old to open a social media account, and “reverses the burden of proof” by requiring social media platforms to show that their services are “age-appropriate and safe by design.”

The EC has submitted the legislative proposal to the European Parliament and Council, “with a view to launching the legislative process for their examination and adoption,” the commission said in a press release.

“Too many children are being exposed too early to an online world they are not ready to navigate,” EC President Ursula von der Leyen said in a statement, citing a “robust body of evidence on the harm that social media does to a developing brain and personality.”

The EU Kids Act “will set clear boundaries in the digital world—just as we do it on a daily basis in the real world,” she said, calling the proposal a “gradual and differentiated approach” that provides different age groups with “tailored” protection levels.

The act is “structured around four pillars,” including delaying children’s access to social media, requiring safety-by-design, “[p]rivacy-preserving age assurance,” and “[e]ffective enforcement,” the EC said.

Among other restrictions, the act calls for “parental control” of social media access by children between 13 and under 15, the EC said, noting that children between three years old and under 13 would not be allowed to access social media but could access “specially designed child-friendly video-sharing services through accounts managed by their guardian,” the EC said.

The safety-by-design requirements include various “obligations for all online services offering social media services, video sharing, online video games, AI [artificial intelligence] companions and chatbots” to children under 18. The restrictions include a ban on “addictive features and profiting-based recommender feeds dragging minors into ‘rabbit holes’ of harmful content,” as well as a prohibition on “infinite” scrolling, and push notifications during sleeping hours, the commission said.

Online services and app stores would also have to implement age assurance tools, such as the European Union age verification app, “which does not retain identifying documents or biometric data, thereby meeting the highest privacy-preserving standards,” the agency said.

In a press release, the Computer & Communications Industry AssociationEurope (CCIA Europe) said the act would create “serious new privacy and security risks for children and adults alike” and warned that the commission “cannot rely on privacy and security safeguards on paper alone without explaining how these age checks and parental controls will work in practice, particularly when many of the technologies mentioned remain unproven at the scale envisaged by the proposal.”

CCIA Europe also argued in the release that the EC proposal “puts Europe’s long-standing principle of data minimisation to the test.”

Any EU age-based restrictions, the group said, “should be grounded in a secure, privacy-preserving framework. Protecting children online should not require Europeans to surrender sensitive personal information to participate in digital life.”

News: InternationalLegislation DataPrivacy