The KIDS Act proposal is the most prescriptive yet on how providers of digital services should achieve ‘age assurance’ in respect of their users. lakshmiprasad S/iStock.
23 Oct 2026, 1:41 pm
The idea that children should only be able to access online services that are age-appropriate is, at least conceptually, uncontroversial.
In many countries, access to gambling and pornographic websites is already restricted to adults only, for example. With the KIDS Act proposal, EU policymakers seek to take this principle further, with age-related constraints on access to a wider range of online services.
Broadly, in addition to requiring in-scope online services to be designed with child safety in mind, the EU KIDS Act proposal envisages the operation of a graduated user-age-based system of access restrictions in respect of those services, which include social media and video-sharing platforms. These proposals revolve around the expectation that providers understand what age each prospective user is, as compliance with obligations hinges on accurately establishing particularly narrow age bracket thresholds, such as under 13, 13-14, or 15+ years of age. Until now, we have not seen any legislation be as prescriptive on ‘age assurance’ as is set out in the EU KIDS Act proposal.
The European Commission’s overarching aim is to ensure the age assurance solutions providers adopt are proportionate, effective, reliable and privacy-preserving.
Age assurance is an umbrella term used to describe the variety of methods that can be used to determine, estimate or verify someone’s age. It includes age verification as well as age estimation. Age verification measures are a subset of age assurance which establish the user’s age with a high degree of certainty. Checking someone’s date of birth on their passport is age verification. Estimating that someone is an adult based on their appearance is age assurance, but not age verification.
There are overarching principles and further prescriptive standards that age assurance solutions would need to meet under the KIDS Act proposal – see more detail in the section on age assurance solutions below.
Providers of social networks, video-sharing platforms, app stores, online games, AI companions and chatbots would all be obliged to make use of age assurance systems to meet their obligations around safety-by-design under the proposed new KIDS Act. It is open to providers to choose the specific age assurance methods they rely on. The obligations would apply regardless of whether the in-scope services or systems are accessible with an account, therefore the age assurance measures chosen by the provider would need to be applied to both signed-in and signed-out users.
On the other hand, the obligations of social network and video-sharing platform providers to prevent users under the age of 15 from creating full accounts and only allow 13- to 15-year-olds to have limited accounts, require more stringent age verification. Providers have to use a specific prescribed EU age verification solution.
The exception for allowing under-13s to access video-sharing platforms under a guardian’s control requires the provider to establish that the guardian has parental authority, but the provider can rely on the guardian’s declaration as to the age of the minor.
The KIDS Act proposal expressly excludes self-declaration by recipients of the service as a valid age assurance method and makes it clear that it is not a sufficient age assurance solution for the purpose of compliance. This raises questions around whether self-declaration can still form part of a multi-pronged approach to age assurance, where providers use self-declaration in combination with other measures. It would be reasonable to assume that it can, since in such a case it would be the entire combination of measures that comprises the age assurance system, not the self-declaration on its own.
In the case of providers of operating systems, their role under the KIDS Act is primarily anticipated as being intermediary between users and the providers of the other in-scope services and systems. In this regard, they would need to enable the sharing of ‘age signals’ obtained by the operating system with service or system providers, with the user’s consent.
An age signal is defined as “any data, attribute, token, credential, or other information provided, transmitted, or generated for the purpose of establishing, verifying, or demonstrating a specific age, age threshold, or age range of an individual”.
This obligation only applies “where a provider of an operating system has obtained an age signal of a user”. The operating system provider is not required to obtain an age signal, unless it is also a provider of another in-scope service.
The drafting seems to suggest that the operating system should know that the recipient of the age signal is in-scope of the Act’s requirements and needs the signal to comply with those requirements. It is unclear how this would be achieved.
The proposal sets a high expectation in respect of age assurance solutions. A lot of the detail, however, still needs to be worked out.
For example, it is proposed that providers that need to limit access for under-15s should exclusively use EU age verification solutions that rely on an EU proof of age attestation that is certified as conforming with the requirements of the EU age verification scheme. That scheme is still being developed, so there are a lot of unknowns at this stage.
Otherwise, age assurance solutions would be deemed non-compliant with the KIDS Act if they do not “provide a high level of accuracy, reliability, security, robustness, non-intrusiveness, privacy and data protection, and non-discrimination”.
Beyond that principle, the proposed new KIDS Act outlines specific data protection standards that age assurance solutions would need to adhere to.
The duties set out within Articles 27 and 28 of the proposal are parallel to obligations applicable under General Data Protection Regulation (GDPR). For instance, solutions that enable the identification of the recipient or that locate, track, target, advertise to or profile recipients for any purpose are prohibited.
The idea that age assurance solutions would not be able to support identification of the recipient is difficult to square with the position under the GDPR, where an account holder would generally be considered to be identified even if the provider does not have their name or other personal details.
Requiring providers to ensure that age assurance solutions they use do not locate the individual for any purpose could grate with providers’ obligations under member state-specific laws around access to certain types of content, where knowing where the user is is a pre-requisite for compliance.
The principle of data minimisation, applicable under the GDPR, is also emphasised and elaborated on under the proposed new KIDS Act: it would be prohibited to maintain, acquire or process more personal data than is “strictly necessary to assess if the recipient of the service or the user of the system has met the age thresholds” specified in the regulation. This arguably replicates the GDPR’s data minimisation requirement without adding much to it, other than using the phrase “strictly necessary” instead of the GDPR’s “necessary”.
The further processing, sharing, or combining of the data provider’s need for age assurance purposes – including with data gathered in the context of other services the provider, or a third-party, offers – is also prohibited. This could pose challenges for providers that conduct age assurance using data collected for other purposes as well. It also seems to suggest that in-scope services – other than operating systems providers – may not share age assurance information with each other, and if they provide more than one in-scope service, they may need to establish the age of the user separately for each service.
The proposal also mandates that the age assurance methods adopted by providers must be “based on state-of-the-art technology” and be “zero knowledge proof” – a technical concept that revolves around the idea that a user can prove they satisfy an age threshold without having to share their actual age or other personal data to do so.
Under the GDPR, controllers and processors are already expected to ‘take account’ of the state-of-the-art when assessing their organisational and technical security measures to protect personal data they are responsible for. It is unclear whether the KIDS Act envisages a more direct obligation: if it does, the age assurance measures and solutions will likely need to be rigorously maintained and updated in-line with technological developments in order to remain compliant. There is risk and cost that goes with that.
The requirement for ‘zero knowledge proof’ also appears to rule out many solutions currently used by platforms, including first-party age checks. In practice, this is likely to effectively require use of third-party, rather than first-party, age assurance solutions.
The storage of age signals is also subject to tight restrictions. However, providers would have scope to store age signals to avoid a user having to go through “repeated age assurance” processes to access their accounts.
There would be practical challenges for providers in establishing the age of users falling within the different age group thresholds under the KIDS Act proposal.
For instance, when trying to establish whether someone is 18 or not, there are various methods available to do so. Only people 18 years of age or over can be a credit card holder, for example, while facial age estimation nowadays is very capable of establishing that someone is over 18.
When looking at younger age groups, the task becomes much more difficult. A 16-year-old might in some countries have an identity card, but determining whether a user is 15 years old or a 14-year-old – as the proposal envisages providers would have to do – might be difficult, since, on the face of it, there are not obvious credentials, signals or indicators that providers would, on their own, have access to, that would clearly distinguish between the two. This means providers would have to avail themselves of the services of a third-party intermediary that is in the business of collecting attestations from public registries, education providers, health providers or banks, for example.
When verifying age to set up limited accounts for 13- to 15-year-olds and ensuring that only over-15s open full accounts, providers will need to use an EU age verification solution using an EU proof of age attestation, provided by a certified third party and included in a Commission-issued list.
The fundamentals of the scheme, including the criteria for the EU age verification solutions and for the providers of EU proof of age attestations, still need to be decided upon and established.
These mechanisms will need to be in place before the Regulation's obligations take effect. Given the six-month implementation window currently anticipated, this is a tight timeline for something that depends on third-party infrastructure not yet built.
There are commercial implications too. For the video games industry, for example, the KIDS Act proposal would essentially require providers of every game with an online multiplayer mode to check the age of its users, regardless of the size of the company or its user base. In practice, providers would likely need to engage a third-party age assurance provider. This is particularly important if the solution is to operate on a ‘zero knowledge’ basis, as the proposed regulation requires, so that the game provider does not receive the user's identity or other personal details. Even without that requirement, it is difficult to see how many smaller providers could afford to build and operate their own age assurance solution.
None of this is cheap. In a highly competitive market that increasingly relies on advertising and in-game purchases, providers cannot simply pass the cost on to consumers. The European Commission's impact assessment acknowledged that age assurance measures and parental controls will lead to additional costs. Somewhat strangely, it said those costs could not be estimated, particularly for the large number of small and micro video game providers that would be the worst affected.
Arguably, the Commission has downplayed the issue. It suggested that the development of an EU age verification solution would mitigate the cost. However, that solution is a long way from being fully realised and there is no indication that using it will necessarily save costs for providers.
Until the Commission issues more detailed rules on how parental responsibility should be checked, providers are both permitted and required to rely on self-declaration by the guardian – but the catch is that the provider must still make reasonable efforts to verify that the self-declaration is genuinely made by an adult exercising parental responsibility. This leaves a meaningful practical gap between the legal standard and the tools currently available to meet it. The reason self-declaration is permitted is that there is little else that a provider can do to verify parental authority.
While there is a harmonised EU definition of the concept of parental responsibility, the substantive rules determining who acquires or holds the rights and duties which fall within that concept can vary between member states. Providers may have to verify that relationship according to the applicable national law at least until an EU-wide delegated act specifies the signals indicating parental responsibility.
Providers would find it helpful that Article 31 of the proposal anticipates member states establishing an electronic means by which a guardian can obtain and present an attestation of parental responsibility which satisfies the requirements. Even then, the provider would be required to use reasonable efforts to verify that the information available is reliable and complete.
Recital 49 envisages verifying parental responsibility without also verifying the identity of the guardian or the child. How this can be achieved is a mystery.
There would be a requirement on providers to verify the age of existing users – to check that the users are at least 15 – within six months from entry into force, using an EU age verification solution.
There is an exception to this where providers can establish with a “high degree of confidence” that the user is not a minor.
It is not yet clear what level of evidence would be required to achieve a high degree of confidence. One potential approach could be to take into account the date on which an account was created. Recital 61 acknowledges that this is a possibility.
Many online platforms will have already established the age of their existing users. It is to be hoped that they would not need to do it all over again, unless the original method used was particularly unreliable.
Co-written by Prune Corel of Pinsent Masons.
Written by
