Safety By Design: The EU Kids Act Vs The Bans
On September 17, the European Commission published its proposal for the EU Keeping Internet Digital Spaces Accountable and Trustworthy Act, better known as the EU Kids Act. It has been covered largely as another social media ban for children, part of the same wave that produced Australia’s under-16 ban, France’s under-15 rule, and the UK’s incoming restrictions. That framing undersells what is actually in this proposal.
The EU Kids Act is more ambitious and more honest about where the problem actually sits than most of what has come before it.
The headline measure is a tiered, age-based access system. Children under 13 cannot access social media at all. Children aged 13 to 15 can access a limited “mini” account managed by a parent or guardian, with a one-hour daily time restriction, no infinite scroll, no push notifications during sleeping hours, and no unsolicited contact from strangers. From 15 onwards, children can manage their own accounts. But the more significant move is what the Act requires of platforms themselves.
The EU Kids Act shifts the burden of proof. Providers of very large online platforms will have to demonstrate that their services are safe for children and designed with their wellbeing in mind. Safety becomes a design requirement.
The Act also addresses something I have been watching closely: AI companions and chatbots. Under the proposal, AI companions must be turned off by default for children. They cannot simulate interpersonal relationships in ways that create emotional dependency. They cannot use addictive design features. Heck, this would be useful even for adults!!! I wrote recently about China becoming the first country to regulate AI’s emotional interactions with users, and about documented cases of people taking their lives following interactions with AI companions. The EU is now putting governance frameworks around the same risk for the most vulnerable users.
The scope of the Act is broad: social media, video-sharing platforms, online games, AI companions and chatbots, app stores and operating systems. The contrast with Australia’s blunter approach appears to be deliberate: The EU is trying to avoid a patchwork of diverging national bans across its member states while building something more nuanced than a simple age cutoff.
This proposal is not yet law. It is subject to change and unlikely to apply before 2028. But the governance logic it establishes, I believe, is on the right track. Designing digital spaces with children’s safety and wellbeing as a core requirement from the start is fundamentally different from asking children to protect themselves from systems that were never built with them in mind.
That logic applies well beyond Europe. For every government and institution making decisions about AI and digital services for children, it is where the conversation should begin. Will the EU Kids Act be effective in making the online world safer for children? And what challenges could it face, particularly when it comes to AI? Will it become the new “gold standard-bearing” policy instrument like GDPR is?