At a glance
The EU Kids Act is a proposed regulation that would ban social media accounts for children under 13, limit 13- and 14-year-olds to supervised accounts, and require platforms to prove their services are safe by design. Age checks are meant to use zero-knowledge proofs so platforms learn only yes or no. The proposal provides for alternative verification routes, including for people without digital ID, rather than requiring everyone to use the EU Digital Identity Wallet. These safeguards matter, but privacy also depends on how age-verification providers handle enrolment data and whether the available options are genuinely accessible and privacy-preserving.
What the EU Kids Act actually does
The European Commission proposed the EU Kids Act on 17 September 2026. Its full name is Keeping Internet Digital Spaces Accountable and Trustworthy. It would apply directly across all 27 Member States as a regulation and rests on four pillars.
| Pillar | What it does |
|---|---|
| Social media delay | No accounts under 13. Supervised mini accounts for ages 13–14 with a one-hour daily cap. Independent accounts from 15. |
| Safety by design | Restricts addictive design, including endless autoplay and infinite scrolling without meaningful breaks, manipulative re-engagement notifications, and punitive streak mechanics. Tracking-based personalisation is off by default, with a non-profiling feed option required. |
| Age assurance | Certified verification using zero-knowledge proofs. Platforms receive only a yes/no answer. |
| Strong enforcement | Reverses the burden of proof. Very large platforms must prove their services are safe by design. |
The scope covers social media, video-sharing platforms, online games, app stores, AI companions, and general conversational chatbots. Existing rules under the Digital Services Act and the AI Act continue to apply. The new regulation sits on top of them.
Why the proposal exists
A Eurobarometer survey found that nearly one in three European adolescents report feeling stressed, sad, or socially excluded because of social media, and 92 per cent of Europeans consider protecting children online a top policy priority. Teens who started using social media before age 10 report higher weekend screen time than those who started later. Twenty-three of the 27 Member States were at least contemplating or developing national rules on minors’ access to social media or related services, creating a clear risk of fragmentation. Australia’s late-2025 under-16 ban showed the opposite problem: a hard age cut-off with no verification infrastructure. A shadow trial found platforms checked age on zero of 50 test accounts.
How age verification is supposed to work
Self-declared age is not enough. The process runs like this:
- You prove your age once to a nationally designated issuer (a digital ID agency, bank, or post office).
- The issuer verifies your documents and issues an age credential.
- When a platform asks, your app sends only a yes or no.
- The platform never sees your name, birth date, or documents.
Every Member State must offer at least one free route, including for people without a digital ID. The Commission has published an open-source blueprint that national versions and private providers can follow. For many existing adult accounts, platforms can rely on signals they already hold (account age, payment details) and skip a fresh check.
Is EU Kids Act age verification a privacy risk?
What zero-knowledge proof gets right
The platform learns nothing about you beyond yes or no. The Act explicitly bars identification, tracking, and profiling through age assurance. That’s a stronger design than most national age verification schemes.
But someone still holds your identity document
Here’s the catch. Before you get that zero-knowledge credential, you first prove your age to an issuer. That issuer does see your identity documents. The zero-knowledge magic happens between you and the platform, not between you and the issuer.
Critics point out that the data honeypot doesn’t disappear. It just moves upstream: from platforms to the issuers and subcontractors who handle enrolment. The Commission has published a threat model for its age-verification blueprint; residual risks at the issuer and wallet layer remain a central privacy concern.
The Persona case shows it’s not theoretical. In February 2026, researchers found that Persona, the identity verification vendor used by Discord, had frontend components exposed online. The tool could perform 269 distinct verification checks, including facial recognition against political watchlists. Discord dropped Persona.
Who actually runs the age verification app?
There’s no single, centrally operated EU app. The structure is decentralised:
- European Commission: defines common technical and privacy standards and publishes the open-source blueprint
- Member States: customise, deploy, and operate their own national versions
- National issuers: verify your identity and issue age credentials (digital-ID agencies, banks, post offices)
- Platforms: verify only the resulting proof
The Commission’s code is open source. Private providers can also build on the blueprint if they follow the required standards.
That decentralised design avoids one massive EU database of age-verification activity. But it also means your privacy protection is only as good as your Member State’s implementation.
The broader privacy concerns
Parental surveillance of vulnerable teens. The always-on guardian tools and pre-approved contacts for 13-14-year-olds sound protective. But for LGBTQ+ teens in unsupportive homes, online communities are often a lifeline. Civil rights organisations have warned that parental surveillance can cut off vulnerable youth from the support networks they need most.
Mission creep. Privacy groups like EDRi and the EFF warn that age verification infrastructure built for child safety can expand to other purposes. The EU’s app is already designed to confirm users are over 18 for adult content under the DSA. Once the system exists, pressure to expand it grows.
Age verification beyond children. Enforcing age limits affects adults too, because covered services must establish whether users meet the relevant threshold. But the proposal does not make the EU Digital Identity Wallet compulsory: it provides for alternative certified solutions and a free route for people without digital ID. Most existing adult users would not need a fresh check where platforms already have sufficient evidence of adulthood. The concern is whether those alternatives will be genuinely accessible and privacy-preserving, rather than whether everyone must use a particular wallet.
Displaced teens. IT experts caution that teens locked out of mainstream platforms may migrate to unregulated spaces with no privacy protections or safety-by-design rules at all.
What this means for private communication
Secure email and similar privacy-first tools sit largely outside the Act’s direct scope. They are not social networks or AI companions. The broader trend still matters. Age-gating and design mandates expand verification infrastructure and platform obligations. Real protection for private communication continues to rest on end-to-end encryption, client-side key control, minimal data collection, and jurisdictions that resist extraterritorial demands, not on platforms proving they have disabled certain features for minors.
Mailfence offers OpenPGP end-to-end encryption with client-side key control, does not scan message content for advertising or mass surveillance, and operates under Belgian law. Those design choices remain relevant precisely because platform-level age and safety rules cannot replace user-controlled encryption. Regulations can raise the floor for high-risk services. They do not remove the need for tools that simply do not build surveillance into their core design.
Mailfence — Your secure Productivity Suite
Reclaim your Privacy with
- Messages
- Calendars
- Documents
- Groups
Final thoughts
The EU Kids Act addresses a real problem with real ambition. Banning addictive design features, reversing the burden of proof, and mandating zero-knowledge proofs for the platform step are meaningful moves. No other regulation has gone this far on privacy-preserving age checks.
Privacy is only as strong as the weakest link. With 27 Member States each running their own version of the infrastructure, and with the real age attribute still held by a government-linked issuer, the technical promise of zero-knowledge proofs does not erase the custody problem. The proposal is not yet law. Its consultation window (open until 3 December 2026) and the legislative process that follows will decide whether the mitigations stay narrow or whether the identity infrastructure expands.
FAQ about the EU Kids Act
What does the EU Kids Act stand for?
Keeping Internet Digital Spaces Accountable and Trustworthy. It is a proposed regulation that sets minimum age limits for social media, bans addictive design features for minors, and requires privacy-preserving age verification. The Commission proposed it on 17 September 2026. It must still pass the European Parliament and the Council.
Will adults need to verify their age?
Not necessarily. For most existing users, platforms can rely on signals they already hold. Formal verification is required only where that confidence cannot be established. Critics note that platforms may still check everyone to reduce risk.
How does the age verification protect privacy?
Zero-knowledge proofs mean the platform learns only whether you are above or below the threshold. It does not receive your name, date of birth, or documents. You do, however, verify your identity once with a national issuer. The privacy of that step depends on your country’s implementation and the retention rules that apply to the issuer and the digital wallet.
How does it compare with Australia’s ban?
Australia’s late-2025 under-16 ban prescribed no verification method and built no state infrastructure. A shadow trial found age checks on zero of 50 test accounts. The EU proposal mandates certified tools, zero-knowledge proofs, and a free route in every Member State, while also adding safety-by-design rules.
Does the Act ban social media for all children?
No. It sets graduated rules. Under-3s have no access. Under-13s cannot hold personal accounts but may view age-appropriate content through a parental account. Ages 13–14 use supervised accounts. From 15, independent accounts are allowed on services that meet the safety rules.
