EU KIDS Act forces platforms to prove safety before allowing under-15s access as Brussels overrules 13 member states racing ahead with conflicting bans

The European Commission unveiled the EU KIDS Act on 17 September, setting an EU-wide ban on social media accounts for children under 13 and requiring parental consent for 13 to 15-year-olds. The proposal arrives as 23 out of 27 EU member states were already contemplating national legislation to restrict or forbid access to social media under a certain age, each with different thresholds and enforcement mechanisms that threatened platform compliance chaos.

The shift is not just another age gate. The Act reverses the burden of proof, requiring platforms to show they are safe by design rather than waiting for regulators to prove harm after the fact. For social media marketers, that means the features that currently drive engagement, automated playback, infinite scroll, profiling-based recommendations, are now the compliance problem, not the solution.

What the age bands actually mean for platform access

Under-13s get no access to social media and video-sharing platforms. Full stop. Access to games and AI chatbots requires parental consent and oversight through default tools.

Between 13 and 15, access is through restricted "mini accounts" set up and controlled by parents or guardians with limited features, peer-only contacts and a one-hour daily screen-time limit. Guardians stay in control, with parental tools always on and parental approval of contacts. That one-hour cap is non-negotiable.

From 15 and above, the under-15 account restriction no longer applies, and teens can make an account without the consent or oversight of their parent or guardian. But safety-by-design rules remain in place for minors aged 15 to 18.

The age thresholds matter less than what platforms are forbidden to do within each band. For social networks and video-sharing platforms, the main restriction applies when a service has features that create specified risks, including livestreaming to an unlimited audience, contact with people outside existing connections, profiling-based recommendations, recommendations of new contacts or information, and designs that encourage uninterrupted or repeated use.

The features that must go

The draft bans design features such as infinite scrolling, artificial notifications and certain reward mechanisms. The proposal would prohibit infinite scroll without stopping points, reward tricks, push notifications during sleeping hours, and unsolicited contact from strangers.

Addictive features and profiling-based recommender feeds that draw minors into "rabbit holes" of harmful content are explicitly prohibited. For social networks and video-sharing platforms, this would include preventing automatic playback and uninterrupted consumption from encouraging excessive use.

AI companions and chatbots would need to be off by default and could not simulate interpersonal relationships in ways that create emotional dependency.

For a social media marketer running youth-adjacent campaigns or managing creator partnerships, this is the part that reshapes day-to-day work. The engagement mechanics that brands and creators have relied on for years, autoplay in Stories, algorithmically surfaced content, notifications timed to pull users back in, become compliance liabilities if the audience skews even slightly under 18. Platforms will need to strip those features out for minors, which means reach, watch time, and conversion metrics for youth-targeted work will compress sharply.

The Act's scope extends beyond classic social media. The EU KIDS Act would impose obligations on online services offering social media, video-sharing, online video games, AI companions and chatbots to users under 18. Gaming, video platforms, AI chatbots, even app stores, all fall under the same safety-by-design mandate.

Platforms must verify age at signup and audit existing accounts within six months

Companies like Meta and Google will have to verify users' age when they open a new account, using an EU-wide age-verification app or other national solutions that check only whether the user is above a certain age. Providers would be required to rely exclusively on third-party EU age verification solutions using EU proof-of-age attestations certified under the "EU Age Verification Scheme", with the Commission maintaining and publishing EU-wide lists of certified age verification solutions.

Within six months of the KIDS Act taking effect, providers would be required to establish whether holders of existing accounts are under the age of 15, and would need to disable accounts where the user is determined to be under 15, as well as accounts where the user's age cannot be established.

That six-month window is the operational crunch point. Platforms with hundreds of millions of EU accounts will need to retrospectively age-check users who signed up years ago, many under systems that never collected or retained birthdate data in a verifiable form. Accounts that cannot be verified get disabled. For brands running campaigns via influencers or community managers, that creates immediate audience volatility. A creator's follower count, engagement rate, and demographic breakdown could shift sharply once platforms begin purging unverifiable accounts.

Very large platforms must submit compliance plans and pass independent audits before features launch

The KIDS Act requires very large online platforms, as designated by the Digital Services Act, to demonstrate to the Commission their products and services are built with safety-by-design principles. The largest platforms, those with 45 million or more active monthly users in the EU, cannot simply declare themselves safe: before coming into contact with children under the new rules, they must put on the table a detailed plan showing how they intend to meet every obligation of the law, and have it checked by independent auditors, with the audit paid by platforms, not taxpayers.

Online social networking and video-sharing platform providers designated as Very Large Online Platforms under the DSA must notify a compliance plan to the Commission, with that notification due within four months of designation as a VLOP, or 30 days of application if already designated. VLOPs are required to commission an independent audit of their compliance plan, with audit reports due within two months, and on a finding of shortcomings, a corrective action plan is due within 30 days and to be implemented within 60 days.

The burden of compliance proof sits with the platforms; it is not for authorities, parents or children to prove harm.

This flips the usual sequence. Historically, platforms shipped features, regulators investigated harms, and enforcement followed months or years later. Now the largest platforms must prove safety before a feature reaches minors. If you are planning a campaign that relies on a new platform capability, a discovery feed mechanic, an AI recommendation layer, a live shopping feature, assume it will take longer to reach younger EU audiences than it used to, and that it may arrive in a neutered form or not at all.

Enforcement structure and penalties

Enforcement builds on the existing enforcement structures under the Digital Services Act and, for AI companions and chatbots, the AI Act, which means that the Commission directly supervises the online platforms and AI chatbots most widely used in the EU, with the relevant national competent authorities remaining responsible for the other services and AI systems covered by the Act.

Fines can reach 6% of total worldwide annual turnover. An expedited procedure applies for services and systems supervised by the Commission: preliminary findings within 30 days and a final decision targeted within 90 days.

Six per cent of global turnover is a number large enough to move boardroom priorities. For comparison, Meta's $17bn settlement earlier this year forced two-hour limits and overnight lockouts for teen users. The EU KIDS Act's penalty ceiling is higher, and the compliance obligation is broader.

How this overrules the member state chaos

France, Greece, Austria, Denmark, Spain, Belgium, Italy, Germany, Poland and the Netherlands are all considering or advancing national legislation on social media bans, each with different age thresholds and enforcement mechanisms.

Denmark's government announced an agreement to ban access to social media for anyone under 15, with the ban potentially relying on Denmark's national electronic ID system for enforcement and the plan potentially becoming law as soon as mid-2026. Austria agreed on a social media ban for children under 14 in March 2026, with a draft proposal expected by the end of June 2026. France became the first EU country to ban social media for children under the age of 15 following a vote by French lawmakers in July, though the ban was later struck down by the country's Constitutional Court.

As of 11 May 2026, 23 out of the 27 EU member states were at least contemplating national legislation, each defining "social media", "child", and "verification" differently. The result was a compliance map where a platform compliant in France could be non-compliant in Austria, and where marketers targeting EU youth audiences faced 23 separate sets of rules.

The EU KIDS Act is designed to pre-empt that fragmentation by setting a single minimum standard. National rules, like France's push to restrict under-15s, would remain, though Paris wants Brussels to harmonise them. Member states can go stricter, but they cannot go looser.

For platforms and marketers, that creates a partial simplification. Instead of tracking two dozen national laws, you track one EU floor and a handful of national add-ons. But it also means the lowest common denominator becomes the baseline. Platforms will likely build to the strictest standard (15 as the autonomous account threshold, one-hour caps for 13 to 15-year-olds, banned features for all minors) rather than attempting differentiated compliance by member state.

What social media marketers must do now

The proposal is not law yet. It will now be examined by the European Parliament and the Council, who will negotiate and decide on the final text before it becomes law. The proposal now goes to the European Parliament and Council, a process that typically runs a year or more before anything becomes binding. But platforms that wait for the final vote will be starting late.

If your brand or agency runs campaigns targeting or adjacent to under-18 EU audiences, these are the planning assumptions to make now:

Audit your creative and media plans for addictive features. Campaigns that rely on infinite scroll, autoplay, or algorithmic discovery to reach minors will see diminished performance once platforms strip those mechanics out. Start testing static, skippable, user-initiated formats instead.

Map your influencer roster by verified age and EU follower share. Creators with large under-15 EU audiences will see those audiences disappear or compress into one-hour-per-day windows. If a partnership relies on daily touchpoints or algorithmic amplification, the ROI will erode.

Assume age verification becomes universal and friction increases. Signup and re-verification flows will add steps. Conversion rates for youth-targeted sign-ups will drop. Plan for longer funnels and higher drop-off.

Track the compliance timelines for VLOPs. The largest platforms, Meta, YouTube, TikTok, will need to file compliance plans within 30 days of the Act applying and pass audits before new features reach minors. That means new platform capabilities will roll out to adult audiences first, and to minors later, if at all. Campaign planning needs to account for segmented feature availability.

Watch for the knock-on effect in non-EU markets. Platforms rarely build region-specific product variants when they can avoid it. Features banned for EU minors may be deprioritised or redesigned globally. The EU KIDS Act's design restrictions could become the de facto standard everywhere, the way the EU AI Act forced platforms to label AI content globally from August.

The Act is framed as child protection, but the commercial consequence is a structural de-risking of youth audiences for platforms. Serving ads, enabling commerce, and monetising engagement all become harder when the user is a minor. The logical platform response is to push that audience to the edges of the product, reduce feature access, limit recommendations, and deprioritise minors in the engagement graph.

For social media marketers, that means youth audiences become less valuable, less reachable, and less measurable. The work does not disappear. It just moves to wherever the platforms decide 15-and-up experiences live, and it gets harder to execute well.

This is not a distant regulatory threat. The Commission has already set the enforcement clock. Platforms have six months from the Act's application to verify existing accounts. VLOPs have 30 days to file compliance plans. The features your campaigns rely on today may not exist for EU minors by this time next year.

The question is not whether the EU KIDS Act reshapes youth marketing. It is whether your team is prepared to work in the environment it creates.