Reading time: four minutes

A new legal approach to children online 

For years, the debate about children and the internet has largely revolved around one uncomfortable question: how much responsibility should be placed on parents, and how much should be placed on the platforms themselves? 

The European Union appears increasingly willing to answer that question through legislation. 

The European Commission announced the proposed EU KIDS Act (the act), a wide-ranging legislative proposal aimed at changing the way digital services approach children. The proposal reaches far beyond conventional social media, potentially covering social networking services, video-sharing platforms, online games, app stores, operating systems and, perhaps most significantly, AI companions and chatbots. 

The proposal’s significance is difficult to ignore. This isn’t simply another attempt to tell parents to monitor screen time. It represents a move towards making the design and operation of digital services themselves part of the legal conversation about child protection. 

Age restrictions take centre stage 

One of the most striking features is the proposed age-based approach. 

Under the proposal, certain social networking and video-sharing services that present specified risks wouldn’t be permitted to allow children under 15 to create accounts. For those aged between 13 and 15, a limited form of parental account could be available, with controls over screen time and new contacts. For younger children, access would be subject to even tighter conditions. 

That approach matters because it moves away from the idea that every child should simply receive the same digital experience. Instead, the proposed framework attempts to recognise that the risks associated with online services can change considerably depending on a child's age and the functionality of the platform. 

It also represents an attempt to create greater consistency across the EU, rather than leaving individual Member States to establish completely different minimum standards. 

From content moderation to safety by design 

The proposal becomes particularly interesting when it turns to the design of digital services 

The act would require providers to consider safety from the outset, rather than treating child protection as something that can be added after a service has already been designed. Features such as infinite scrolling, engagement-driven notifications and profiling-based recommendation systems are specifically relevant when determining whether certain services create risks for younger users. 

For the technology industry, this could be one of the more consequential aspects of the legislation. 

The legal question may no longer simply be whether a platform removes harmful content after it’s been reported. Regulators could increasingly ask whether the architecture of the service itself contributes to foreseeable risks for children. 

In other words, the focus is shifting from simply policing what appears online to examining how online services are built. 

Build your commercial awareness with our Commercial awareness hub, sponsored by Mayer Brown International LLP.

AI companions bring a new regulatory challenge 

And then there’s AI. 

The proposal gives particular attention to AI companions and chatbots capable of creating sustained and personalised interactions with users. Providers would face obligations concerning emotional dependency, the use of information from previous interactions and pre-market testing for risks to children’s health, safety, fundamental rights and wellbeing. 

This is an important development because AI creates a different regulatory problem from traditional social media. 

A chatbot doesn’t merely show content to a child. It can respond, remember, personalise and simulate forms of interpersonal interaction. Therefore, the legal challenge isn’t simply about what information a child sees, but about the nature of the interaction that technology may encourage. 

The proposed rules would also require providers to monitor systems once they’re on the market, meaning that responsibility wouldn’t necessarily end once an AI product has successfully passed its initial assessment. 

The difficult question of age assurance 

Age assurance is likely to become another major battleground. 

The proposal would require certain social networking and video-sharing services to use certified or equivalent age-verification systems when accounts are created. Self-declaration wouldn’t be sufficient. At the same time, the legislation recognises an obvious tension: proving someone's age can itself require the collection and processing of personal information. 

This creates an awkward legal balancing act. 

The law wants platforms to know whether a user is a child, while privacy law demands that personal data isn’t collected unnecessarily or excessively. The proposed framework therefore envisages age assurance that’s accurate and secure without becoming another mechanism for identification, tracking or profiling. 

The EU Digital Identity Wallet is identified as a potential longer-term solution, although the technology remains under development. The practical implementation of age assurance could therefore become one of the most closely watched aspects of the new framework. 

Where does the UK stand? 

According to the source article, the UK Government intends to proceed with its own proposed restrictions concerning under-16s, alongside additional protections relating to stranger communication, livestreaming, gaming, push notifications, autoplay, personalised feeds and AI chatbots. 

This means that businesses operating in both the EU and UK may have to navigate two regulatory frameworks that share a similar concern but may impose different requirements. 

For technology companies, that could create another compliance challenge: designing products that satisfy different regulatory expectations without creating unnecessary fragmentation across markets. 

The bigger legal picture 

The act is still a legislative proposal, so its final form and practical impact will depend on the legislative process that follows. 

Nevertheless, the direction of travel is significant. 

Children's online safety is moving away from being treated solely as a matter of parental supervision and instead becoming a question of platform responsibility, product design, data governance and regulatory accountability. 

For technology businesses, that means compliance may begin much earlier than the launch of a product. For lawyers, it means advising on children’s online safety is becoming increasingly connected with privacy, artificial intelligence, consumer protection, platform regulation and product design. 

And perhaps the biggest question is still the simplest one. 

In an internet increasingly designed to capture attention, should the law simply protect children from the worst outcomes, or should it start regulating the digital environments that create the risks in the first place?