EU rejects blanket social media ban, demands platforms prove safety before under-13s can access

The burden just flipped

On 13 July 2026, European Commission President Ursula von der Leyen announced that children under 13 should only be allowed to use social media under adult supervision and for limited periods, calling for "age-appropriate restrictions" across the bloc. But this is not Australia's approach. The EU Special Panel on Child Safety Online made clear that "until they demonstrate that their services are safe by design, social media and other digital services providers should have restricted access to children under the age of 13 in the EU".

That single sentence reverses decades of regulatory logic. The panel's report states that "the burden of proof needs to be on providers, not regulators, parents and children". Instead of regulators having to prove harm after the fact, platforms must now demonstrate safety upfront. Von der Leyen drew the comparison explicit: "In Europe, whoever develops a product is responsible for its safety. Car manufacturers must make their vehicles safe. We do not expect children to design their own seatbelts".

Legislative proposals are expected after the summer, with enforcement across 27 member states to follow. For social media marketers, this is not a peripheral policy shift. It will reshape how platforms operate, what features they can deploy, and who can see your content.

What counts as 'safe by design'?

The panel did not leave platforms to interpret that phrase themselves. It calls for binding rules requiring platforms to remove or disable specific harmful design features by default, including infinite scrolling, autoplay, push notifications and personalized recommendation systems tuned for maximum engagement.

The report identified services that contain "age-inappropriate features such as infinite scrolling, autoplay and persistent notifications", describing them as "social media+". This category extends beyond conventional platforms to gaming services, AI companions, and any digital service that combines social interaction with engagement-maximising architecture.

Last week, the Commission used the Digital Services Act to warn Meta that it needs to disable addictive design features such as infinite scrolling or risk a hefty fine. The timing was deliberate. The child safety proposals build on existing DSA enforcement, converting what are currently non-binding guidelines into mandatory, enforceable design requirements.

For marketers, the implication is immediate: assume infinite scroll, autoplay and algorithmic amplification will become opt-in, not default, for under-18s. If your organic reach or campaign performance relies on those mechanisms, you are building on sand.

Phased access, not a blanket ban

Experts recommended no screens at all for babies and toddlers, and supervised use of "age-appropriate social media" and devices for children aged between three and 12 by parents or teachers. For those aged 13 to 18, they advised "evolving autonomous use" of social media and other digital platforms that have "key safety features".

A dilemma for the EU is how to avoid different age limits across 27 countries. Spain wants to ban under-16s from accessing social networks, while France proposes prohibiting children aged 15 and under. The Commission's proposal for a harmonised floor at age 13 allows member states to set higher thresholds, but platforms will need to enforce varying rules by market.

This phased model deliberately contrasts with blanket bans. Australia, the UK, Turkey, Indonesia and others have passed bans on kids under 16 or 15 from using platforms like TikTok, YouTube and Instagram. Australia's eSafety Commission found in March 2026 that around 70% of parents said their children still had social media accounts despite the ban taking effect in December 2025. Some platforms enabled under-16s to repeatedly attempt the same age assurance method to ultimately pass age checks, according to the compliance report.

The EU explicitly studied that failure. Rather than handing enforcement to age gates alone, Europe is targeting the design choices that make platforms harmful in the first place. The reasoning is sharp: if infinite scroll and algorithmic feeds are the problem, removing them solves it for all users, not just those who successfully verify their age.

The age verification paradox

The panel recommends "a harmonised EU-wide access restriction to social media and other digital services for children under 13" and calls for "effective age assurance systems" that uphold "minimum requirements, notably concerning the fundamental rights of users". Crucially, it states that "any method employed to check age should uphold the highest privacy and data protection standards, and should not lead to the processing of identity documents and biometric data for the purpose of age estimation". The panel references zero-knowledge proofs as a privacy-preserving alternative.

The European Commission is working on its own age verification app that will let users prove their age while keeping their identity anonymous. The intent is to integrate age assurance into the EU Digital Identity Wallet, avoiding the centralised biometric databases that civil liberties groups have warned against.

There are no available technologies that verify age in a private and secure manner at the scale required by large social media platforms, according to research from New America. That technical constraint is why the EU is pairing age restrictions with enforceable design changes. You cannot rely on verification alone when the verification does not reliably work.

What this means for social media marketers

Three things change, and they change fast.

Audience composition shifts. If platforms lose supervised access to under-13s and restrict features for 13- to 18-year-olds, youth audiences shrink or migrate to non-compliant services. Campaign reach into Gen Z and Gen Alpha contracts, particularly in markets with stricter national thresholds. Budget allocation models built on broad youth penetration will need revision.

Engagement mechanics weaken. Removing infinite scroll, autoplay and hyper-personalised recommendations for minors reduces the passive consumption that drives a large portion of organic reach. Content that relied on algorithmic amplification to younger users will see performance drop. Brands targeting families or mixed-age audiences will need to distinguish which mechanics still work and for whom.

Compliance becomes segmented. Harmonisation at 13 does not mean uniformity. Spain's under-16 threshold, France's under-15 proposal, and Estonia's opposition to any ban create a compliance patchwork. Platforms will enforce different rules by member state, and marketers running EU-wide campaigns will face fragmented access and inconsistent performance data.

The deeper shift is philosophical. Leanda Barrington-Leach, executive director of the 5Rights Foundation, said "the conversation has clearly moved from asking children and parents to manage risk to requiring that platforms are safe and age-appropriate before they can access children". That principle, once legislated, does not stay confined to under-18s. Proving a feature is harmful to children makes it harder to justify deploying it to adults.

The enforcement gap

Australia's eSafety Commission is currently investigating potential non-compliance by Instagram, Facebook, Snapchat, TikTok and YouTube, with enforcement decisions expected mid-year. A recent study found 61% of under-16s in Australia reported "no or little change" in their social media use, with three-fifths of respondents continuing to have access to one or more social media accounts.

The lesson for Europe is clear: age restrictions without design enforcement fail. Some platforms appear not to have done enough to prevent under-16s having accounts, Australia's regulator concluded. That is precisely why the EU is legislating both access and architecture together.

Australia's penalties include court-imposed fines of up to 150,000 penalty units for corporations, currently equivalent to $49.5 million AUD. The EU's own DSA fines can reach 6% of global annual revenue. The financial risk is material, but the regulatory precedent is larger. Once platforms are required to prove safety by design for children, that burden extends to every demographic, every feature, and every market.

What happens next

Von der Leyen indicated that she was likely to follow the experts' suggestions and that the Commission would present a concrete proposal after the summer. Any EU proposal will become law only after talks between the parliament and member states. The European Parliament in October called for a ban on social media for children under the age of 16, so negotiations will likely push the age threshold higher than the panel's recommendation of 13.

A dilemma for the EU is how to avoid different age limits across 27 countries, but the harmonisation challenge may prove secondary to the design enforcement question. If infinite scroll, autoplay and engagement-maximising recommendations become restricted by default for minors, platforms face a choice: maintain two parallel architectures, or redesign the core product for everyone.

The latter is more likely. Building, testing and maintaining dual interfaces at scale is expensive and operationally complex. Simplifying the product for all users, then layering additional features for verified adults, is the path of least resistance. That path leads to a fundamentally different social media environment, one where the features that drove growth for the last decade become opt-in, not assumed.

For marketers, the implication is not just tactical. It is strategic. The platforms you built campaigns around are being redesigned under regulatory pressure, and the redesign is happening now. Waiting for final legislation to adapt is waiting too long. The smart move is to model performance without infinite scroll, without autoplay, without hyper-personalisation to under-18s, and to stress-test your media mix against that future. Because it is not a future. It is early autumn.