For companies operating in or selling into the European market, the Kids Act is potentially transformative. It would, if adopted, impose direct obligations on a wide range of online service providers—including social media platforms, gaming services, messaging apps, marketplaces, and any information society service “likely to be accessed by minors”—to take proactive steps to identify, assess, and mitigate risks to children. The regulation would also introduce mandatory age assurance mechanisms and establish the groundwork for a European Digital Identity-based verification infrastructure.

But the proposal has not been universally welcomed. Privacy advocates, civil liberties organizations, and a number of data protection authorities have raised pointed questions about whether the Kids Act’s approach to age assurance and content governance genuinely serves children’s interests—or whether it introduces the potential for mass surveillance, restricts legitimate speech, and undermines the very privacy rights it purports to uphold. Industry groups, meanwhile, have flagged concerns about operational feasibility, compliance costs, and the risk of fragmenting the internal market if Member States exercise the discretion the proposal affords them.

This article provides a critical overview of the Kids Act proposal. It examines the regulation’s key requirements, situates them in the context of existing instruments (including the GDPR, the Digital Services Act, the Audio-Visual Media Services Directive, and the UK’s Age Appropriate Design Code), and identifies the most significant areas of legal uncertainty and policy tension.

It is intended as a practical resource for in-house counsel, compliance officers, and policy professionals at international companies who need to assess what steps they would be required to take to meet the obligations under the proposal—and where they might want to push back.

For a related perspective on the age verification dimension specifically, see the King & Spalding client alert: When Regulators Build the Age Verification App, It Is Not Necessarily for the Greater Good

Key Takeaways for International Companies

• Broad scope, low threshold. The Kids Act applies to any information society service that is “likely to be accessed by minors,” regardless of whether the service is designed for or marketed to children. This captures mainstream platforms, enterprise tools with consumer-facing elements, and potentially B2B services with publicly accessible features. Companies should not assume they are out of scope simply because children are not their target audience.

UK comparison: The UK’s Age Appropriate Design Code (AADC) similarly applies to services “likely to be accessed by children,” so companies already subject to the AADC will already understand this threshold definition. However, the Kids Act’s obligations are more prescriptive and extend beyond data protection into content governance.

• Mandatory age assurance. Services in scope will be required to implement age assurance mechanisms that are “reliable, proportionate, and privacy-preserving.” The regulation envisions a tiered approach, with higher-risk services required to deploy more robust verification. Critically, the Commission’s proposal contemplates integration with the European Digital Identity (eID) framework, which could become the de facto standard for compliance.

UK comparison: The AADC does not mandate age verification per se—it requires services to establish the age of users “with a level of certainty appropriate to the risks.” The Kids Act goes further by prescribing specific assurance methods and linking them to the EU’s digital identity infrastructure.

• Risk assessments with teeth. Covered services must conduct “child impact assessments” that evaluate how their design, features, algorithms, and content moderation practices affect minors. These assessments must be documented, updated periodically, and made available to regulators on request. The framework borrows from but goes beyond the DSA’s systemic risk assessments by applying to a broader range of services and focusing specifically on children. It builds on existing evidence-based requirements.

UK comparison: The AADC requires Data Protection Impact Assessments (DPIAs) that consider children’s interests, but the Kids Act’s child impact assessments are more granular and require assessment of algorithmic systems, content recommendation engines, and design features specifically.

• Default settings. The regulation requires that default settings for minors reflect the highest level of privacy and safety. Profiling, behavioral advertising targeting and algorithmic recommendation of potentially harmful content must be disabled by default for users identified as children. Services may not use “nudge techniques” or “dark patterns” to encourage minors to lower their protections. This is already the case under numerous other instruments.

UK comparison: This closely mirrors AADC Standards 7 (Default Settings) and 13 (Nudge Techniques), though the Kids Act adds explicit prohibitions on algorithmic content recommendation for minors and ties default settings to the age assurance results.

• Significant penalties for non-compliance. The proposal introduces an enforcement framework with fines of up to 6% of global annual turnover or €15 million, whichever is higher. National regulators would have authority to order interim measures, including suspension of service in the relevant Member State. The penalty ceiling exceeds both the GDPR (4% of annual global revenue / €20 million) and the DSA (6% / no upper limit) in practical terms.

UK comparison: The UK ICO can impose fines under the UK GDPR framework (up to £17.5 million or 4% of annual global revenue). The Kids Act’s higher ceiling for fines and the addition of service suspension powers represent a significant escalation.

• Extraterritorial reach. Like the GDPR and DSA, the Kids Act applies to services that target or are accessible to users in the EU, regardless of where the provider is established. Non-EU companies offering services in the EU market will need to appoint an EU representative and comply with the full range of obligations under the Act.

UK comparison: The AADC has similar extraterritorial scope under the UK GDPR’s jurisdictional rules. Companies already managing dual UK/EU compliance will face a three-regime landscape if the Kids Act is adopted.

• Interplay with existing regimes is unresolved. The Kids Act’s relationship with the GDPR, the DSA, the AVMSD and national child protection laws remains unclear in several respects. The proposal states that it is “without prejudice” to these instruments, but overlapping obligations, differing definitions (e.g., of “minor” and “harmful content”) and parallel enforcement mechanisms create significant risk of inconsistent application. Most importantly, it is unclear whether the Kids Act is even necessary, as discussed below.

UK comparison: The AADC operates within the UK GDPR framework and is enforced by the ICO, providing a single point of accountability. The Kids Act’s multi-layered enforcement structure—involving national regulators, the Commission and potentially the European Board for Digital Services—adds complexity that the UK model avoids.

Do We Really Need This? Existing Instruments and a Questionable Case for Novelty

The EU already has a substantial body of law that addresses children’s safety and privacy online. The GDPR establishes baseline protections for all data subjects, with specific provisions for minors under Article 8 (conditions for consent in relation to information society services) and Recital 38 (emphasizing that children merit specific protection). The Digital Services Act (DSA), which became fully applicable in February 2024, imposes due diligence obligations on intermediary services, including specific duties for very large online platforms (VLOPs) to assess systemic risks to minors and to take mitigation measures. The Audio-Visual Media Services Directive (AVMSD) requires Member States to ensure that video-sharing platforms take appropriate measures to protect minors from harmful content.

Beyond EU law, the UK’s AADC—enforceable since September 2021—has arguably done more to shape industry practice in this space than any single EU instrument. Its 15 risk-based standards, ranging from best interests of the child to transparency and data minimization, have been widely adopted as a de facto global benchmark by major platforms. The ICO’s enforcement actions under the Code have demonstrated that the standards have teeth in practice.

Against this backdrop, the Commission’s case for a standalone regulation is open to question. The Explanatory Memorandum accompanying the Kids Act acknowledges the existing framework but argues that it is “fragmented” and “insufficient to address the specific risks that minors face online.” Critics counter that the fragmentation is largely a function of incomplete implementation and enforcement of existing rules—not a gap that a new regulation will fill. In its preliminary opinion The European Data Protection Board (EDPB) noted that many of the Kids Act’s objectives could be achieved through “more robust application of the GDPR and DSA” rather than a new legislative instrument.

From a business perspective, the proliferation of overlapping regimes is itself a compliance risk. Each new instrument brings its own definitions, obligations, exemptions and enforcement mechanisms. The Kids Act does not repeal or consolidate any of the existing rules; it adds to them. The practical challenge for a multinational technology company is not whether to protect children—that is a given—but how to design a compliance program that satisfies multiple, potentially inconsistent, regulatory expectations without creating operational paralysis.

What the Kids Act Requires

The Kids Act’s obligations can be grouped into seven principal categories:

• Age assurance: Services must implement mechanisms to determine whether a user is a minor. The level of assurance required is calibrated to the risk: lower-risk services may use self-declaration or estimation techniques, while higher-risk services (e.g., those providing access to pornographic material, gambling, or violent content) must use more robust verification. The regulation encourages integration with the EU Digital Identity Wallet.
• Child impact assessments: Covered services must assess the impact of their service on minors, considering the design of the service, its features, algorithms, content moderation practices and business model. Assessments must be documented, reviewed annually and made available to regulators.
• Safety by design and default: Services must adopt default settings that provide the highest level of privacy and safety for minors. Profiling and behavioral advertising directed at children must be disabled by default. Dark patterns and nudge techniques that encourage minors to weaken their protections are prohibited.
• Content governance: Services must take measures to prevent minors from accessing content that is harmful to their physical, mental, or moral development. This includes an obligation to deploy content moderation systems that are effective, transparent, and subject to human oversight.
• Transparency and accountability: Services must publish clear, accessible and age-appropriate information about their policies, terms and practices as they relate to minors. Annual transparency reports must include information about age assurance measures, content moderation actions and the results of child impact assessments.
• Parental controls and reporting mechanisms: Services must offer easily accessible parental control tools and provide effective mechanisms for minors and their parents or guardians to report concerns, request content removal and exercise their rights.
• Governance and compliance infrastructure: Services above a certain threshold must appoint a designated child safety officer, establish internal compliance procedures and cooperate with national regulators and the Commission’s coordination mechanism.

Age Assurance: Where the EU Diverges Most From the UK

Age assurance is the area where the Kids Act departs most significantly from the UK model—and where the most contentious policy debates are likely to arise. The AADC takes a deliberately technology-neutral approach: it requires services to establish the age of their users “with a level of certainty appropriate to the risks arising from the data processing,” but it does not prescribe specific technical methods. This flexibility has allowed companies to adopt a range of solutions, from age self-declaration to AI-based estimation to document verification, depending on the context and risk profile of their service.

The Kids Act, by contrast, is considerably more prescriptive. It establishes a tiered framework in which the required level of age assurance is calibrated to the nature and severity of the risks posed by the service. For services that provide access to content that is “manifestly harmful” to minors—defined to include pornographic material, content depicting gratuitous violence and content promoting self-harm or eating disorders—the regulation requires “robust age verification” that provides a “high level of confidence” in the user’s age.

Crucially, the proposal envisions a central role for the European Digital Identity (eID) framework. The Commission’s Explanatory Memorandum states that the EU Digital Identity Wallet—which Member States are required to make available to all citizens by 2027 under the revised eIDAS Regulation—will provide “the most reliable and privacy-preserving mechanism for age verification.” The Kids Act does not make eID wallet use mandatory, but the regulatory architecture strongly incentivizes it: services that rely on eID-based verification will benefit from a presumption of compliance, while those using alternative methods will need to demonstrate equivalence.

This approach has attracted criticism from several directions. Privacy advocates argue that linking age verification to a government-issued digital identity creates a surveillance infrastructure that could be used to track individuals’ online activities across services. The European Digital Rights organization (EDRi) has warned that the eID-based model “effectively conditions access to the internet on state-issued identification,” which is “fundamentally incompatible with the right to anonymous communication.” The EDPB has echoed these concerns, noting that any age verification mechanism must comply with the GDPR’s data minimization principle and must not result in “general monitoring of users.”

From a practical standpoint, the eID-centric model also raises questions about implementation timelines and interoperability. The EU Digital Identity Wallet is still in development, and its rollout across 27 Member States is unlikely to be uniform. Companies will need to design age assurance systems that work with eID wallets where available while maintaining alternative methods for users who have not adopted the wallet. This will result in a dual-track compliance burden during what could be an extended transition period.

The Privacy Paradox and the Digital Identity Baseline

The Kids Act’s most fundamental tension is between its stated objective of protecting children’s privacy and the surveillance architecture it would require to achieve that objective. To determine whether a user is a child, a service must first collect information about the user’s age—which necessarily involves processing personal data. The more robust the age assurance mechanism, the more data is typically required: facial age estimation requires biometric data; document verification requires identity documents; eID wallet integration requires authentication against a government-issued credential.

This is not a new observation. Scholars and regulators have long recognized the “age verification paradox”: the most privacy-protective approach to children’s data is to not collect it in the first place, but age verification requires collecting data to determine who is a child. The Kids Act’s response to this paradox is to mandate that age assurance mechanisms be “privacy-preserving” and to encourage the use of technologies such as zero-knowledge proofs (ZKPs) that allow verification of a user’s age without disclosing the user’s identity or exact date of birth.

In theory, a ZKP-based system could allow a user to prove that they are over a certain age threshold without revealing any other personal information. The EU Digital Identity Wallet is being designed to support such selective disclosure. However, the practical deployment of ZKP-based age verification at scale remains largely untested, and the Kids Act does not specify how services should implement these techniques or what level of technical assurance is required. The gap between the regulation’s privacy-preserving aspirations and the current state of the technology is significant.

Moreover, even a technically privacy-preserving age verification system creates structural risks. Any system that gates access to online content based on age necessarily creates a binary distinction between “verified adults” and “everyone else.” This has implications for anonymous speech, for users who cannot or choose not to verify their identity, and for the chilling effect that mandatory identification may have on legitimate online activity. The UN Special Rapporteur on the right to privacy has cautioned that age verification requirements must be “strictly necessary and proportionate” and must not become a “general prerequisite for access to the internet.”

Excluding Children Is Not the Same as Protecting Them

A recurring critique of the Kids Act—and of age-gating approaches more generally—is that they tend to conflate “protecting children” with “excluding children.” If a service’s primary compliance strategy is to deny access to users who cannot verify that they are adults, the practical effect may be to push children toward less regulated, less transparent corners of the internet where they are more vulnerable, not less.

The academic literature on children’s digital rights has increasingly emphasized that children are rights-holders with affirmative entitlements to access information, to participate in online communities and to develop their digital literacy. The UN Committee on the Rights of the Child’s General Comment No. 25 (2021) on children’s rights in the digital environment makes clear that states have an obligation to “ensure that children have access to the digital environment” and that restrictions must be proportionate and must “not deprive children of the benefits of the digital world.”

The Kids Act acknowledges this tension in its recitals, stating that the regulation seeks to “strike a balance between the protection of minors and their right to access information and participate in the digital environment.” But the operative provisions are heavily weighted toward restriction rather than empowerment. The regulation devotes substantial attention to content blocking, access restrictions and age-gating, while offering comparatively little on how services should design child-friendly experiences that enable safe participation.

This imbalance matters for companies designing compliance programs. A purely exclusionary approach—shutting out anyone who cannot prove they are an adult—may satisfy the letter of the regulation but is unlikely to satisfy regulators, advocacy groups, or courts who take children’s participatory rights seriously. Companies would be well advised to invest in differentiated experiences that allow children to access age-appropriate content and features, rather than defaulting to blanket exclusion.

Challenges and Open Questions

The Kids Act raises a number of unresolved questions that will need to be addressed during the legislative process and, if the regulation is adopted, through delegated acts, implementing guidance and case law. Some of those questions include:

• Definition of “likely to be accessed by minors”: The regulation’s scope trigger is broad and fact-dependent. There is no bright-line test, and the Commission has indicated that guidance will be developed through delegated acts. Until that guidance is available, companies will face uncertainty about whether their services are in scope.
• Interplay with the GDPR: The Kids Act’s age assurance and data processing requirements must comply with the GDPR, but the regulation does not specify the legal basis for processing personal data in the context of age verification. Is it a legal obligation (Article 6(1)(c))? A legitimate interest (Article 6(1)(f))? The answer has significant implications for data minimization, purpose limitation and individuals’ rights.
• Technical feasibility of privacy-preserving age assurance: The regulation’s reliance on ZKPs and the eID wallet assumes a level of technical maturity and market adoption that does not yet exist. Companies may face a gap between regulatory expectations and available technology, particularly in the early years of the regulation’s application.
• Enforcement coordination: The Kids Act’s enforcement framework involves national regulators, the Commission and potentially the European Board for Digital Services. The allocation of competences among these bodies is not fully specified, creating a risk of overlapping or conflicting enforcement actions—particularly for cross-border services.
• Impact on smaller providers: While the regulation includes some proportionality provisions for SMEs, the cost of implementing age assurance mechanisms, conducting child impact assessments, and maintaining compliance infrastructure may be disproportionate for smaller companies—particularly those that do not specifically target children but fall within the regulation’s broad scope.

Conclusion: Not a Drill, but Not Beyond Debate

The Kids Act is a serious legislative proposal that demands attention from any company operating in the European digital market. It would impose significant new obligations, create substantial compliance costs and establish an enforcement framework with real teeth. Companies should not wait for the regulation to be finalized before beginning to assess its implications.

At the same time, the proposal is far from settled. The legislative process—which will involve negotiations in the European Parliament and Council—is likely to be protracted, and widespread amendments are expected. Companies and industry associations have a meaningful opportunity to shape the final text, particularly on the remaining open questions:

• The scope of the regulation and the definition of services “likely to be accessed by minors.”
• The technical standards for age assurance and the role of the eID wallet.
• The interplay with the GDPR, the DSA and national child protection laws.
• The enforcement architecture and the allocation of competences among national regulators and EU bodies.

The goal of protecting children online is not in dispute. What is in dispute is whether this particular instrument—with its emphasis on age-gating, digital identity infrastructure and its expansive regulatory scope—is the right way to achieve that goal without compromising the privacy, autonomy and participatory rights of the very population it seeks to protect. Companies should engage constructively in the debate, bring their operational expertise to the table, and advocate for a framework that is effective, proportionate and workable in practice.