A blog post by Victor Hugo Delfante Borborema
On 17 September 2026, the European Commission proposed the EU KIDS Act, promising to make digital services safer for children through age restrictions, safer default settings and stronger obligations on platform design.[1] Its most visible measure would delay independent accounts on certain social-networking and video-sharing services until age 15. Yet the proposal is not simply an EU-wide social-media ban: the account restriction is linked to specified risk-generating functionalities, including contact with strangers, profiling-based recommendations and uninterrupted feeds.
The proposal, still subject to the ordinary legislative procedure, raises a more consequential question. If the Digital Services Act (DSA) already requires platforms to protect minors, whyvlegislate again? The answer may lie in a change of regulatory technique: from askingvplatforms to assess risks and select mitigations towards prescribing particular design choices.
Whether this improves protection without sacrificing children’s rights or entrenching established platforms deserves closer scrutiny.
Fundamental Rights, Not Protection Alone
Martin Husovec characterises the DSA as both a fairness regime and, for the largest services, a risk-management regime. His account highlights a central difficulty: when public authorities compel platforms to regulate online activity, decisions apparently taken by private intermediaries also engage constraints on public power.[2] For legally accessible content, he argues that risk-management powers cannot become an unrestricted licence for regulators to determine what speech is acceptable.
That insight matters for child protection. Article 24 of the EU Charter makes children’s best interests a primary consideration, but Articles 7, 8 and 11 also protect privacy, personal data and freedom of expression and information.[3] Minors are not merely recipients of safety measures; they exercise rights online. As the UN Committee on the Rights of the Child explains, regulation must take account of their evolving capacities and opportunities for participation.[4]
What the DSA Already Requires
Article 28(1) DSA obliges online platforms accessible to minors, subject to its statutory scope and exemptions, to take appropriate and proportionate measures ensuring a high level of privacy, safety and security. Article 28(2) separately prohibits profiling-based advertising where providers know with reasonable certainty that a recipient is a minor. For very large online platforms and search engines, Article 34 requires assessments of systemic risks—including effects on children’s rights—and Article 35 requires reasonable, proportionate and effective mitigation.[5]
This is already preventive regulation, not merely notice-and-takedown. Risk assessments must consider service design and algorithmic systems, and mitigation can include adaptations to interfaces and recommender systems. The Commission’s 2025 Article 28 Guidelines go further in recommending age assurance, privacy-preserving defaults and safeguards against manipulative design.[6] But guidance is not legislation: it sets an influential interpretative benchmark without converting every suggested measure into an individually binding rule.
The DSA’s advantage is adaptability. Its weakness is that broad standards leave providers considerable discretion over what counts as sufficient protection, while regulators and researchers often lack equivalent access to the evidence needed to challenge those choices.
What the Board’s 2026 Report Adds
The European Board for Digital Services’ July 2026 report supplies an unusually concrete picture of the risk landscape. Drawing on platform assessments and external submissions, it identifies risks from endless feeds, autoplay, engagement-optimised recommendations, unwanted contact, grooming and AI-enabled image manipulation. Crucially, several risks stem from how systems combine, rather than from any single illegal post.[7]
But the report does not establish that every cited feature causes harm or that reported mitigations work. It expressly distinguishes systemic risks from realised harms and declines to designate observed practices as proven best practices. The evidence supports closer scrutiny of engagement-driven design; it does not, by itself, settle the proportionality of a particular age limit. Research also suggests that associations between social-media use and well-being can vary with developmental stage, cautioning against treating all adolescents as a uniform group.[8]
Making Safety by Design a Legal Obligation
The proposed KIDS Act would make some regulatory expectations substantially more specific. Article 6 would restrict autonomous accounts for under-15s on social-networking and video-sharing services possessing listed risky features, with limited guardian-controlled access contemplated for younger teenagers. A separate Article 7 exception concerns qualifying child-oriented video-sharing services for under-13s. These distinctions matter: the proposal targets particular services and functionalities, rather than every online interaction by children.[1]
The design obligations are more revealing still. Article 9 would constrain features
encouraging compulsive use, including content consumption without effective stopping points. Article 10 would require recommender systems to give primary weight to expressly stated preferences and disable recommendations based on implicit engagement signals by default. Articles 11 and 12 address protective default settings and unsolicited contact. Article 14 would require AI companions and chatbots to avoid designs likely to create emotional dependency, alongside testing and other safeguards.[1]
Proposed Articles 27–29 set standards for privacy-preserving age assurance; Article 5 would require designated very large social-networking and video-sharing platforms to submit compliance plans for independent audit. The Commission presents this as shifting responsibility onto providers to demonstrate safety.[9] Legally, however, it is better understood as additional compliance and evidentiary duties, not a blanket reversal of every burden of proof in enforcement proceedings.
This is therefore an evolution, not a replacement, of the DSA. The proposal expressly
preserves existing DSA obligations while turning selected elements of earlier non-binding guidance into proposed hard law.
Fairness Has a Market Dimension
For digital markets, the underlying concern is an incentive mismatch. Personalisation and continuous engagement can generate commercial value even where their effects on vulnerable users are difficult to observe. Prescriptive safeguards could prevent platforms from treating those costs as external to product design. Yet uniform technical obligations are not costless: large incumbents may absorb verification, auditing and engineering expenses more easily than smaller rivals. The proposal’s absence of a general exemption for micro and small enterprises makes this especially relevant.[1]
Fundamental-rights safeguards are equally important. Age verification could minimise disclosure by proving only an age threshold, but ineffective implementation could produce surveillance, exclusion or mistaken denial of access. The European Data Protection Board accordingly stresses necessity, proportionality and data minimisation.[10] By analogy, the Court’s judgment in Poland v Parliament and Council demonstrates that EU-mandated technological restrictions require safeguards against disproportionate interference with lawful expression; it does not decide the legality of the KIDS Act.[11]
Conclusion
The KIDS Act’s most important innovation may not be its age threshold but its attempt to make platform architecture itself a direct object of legislation. Husovec’s rights-based theory explains why this demands restraint; the DSA supplies the existing duties; and the Board’s report shows why leaving design decisions largely to providers is contested.
More prescriptive rules may improve legal certainty and curb harmful incentives. They may also reduce flexibility, burden smaller providers and constrain legitimate participation unless supported by reliable evidence, privacy-preserving technology and effective appeals. The task for EU legislators is therefore not simply to demand safer platforms, but to determine which design rules are demonstrably necessary—and who bears the costs when those rules are mistaken.
References
[1] European Commission, Proposal for a Regulation of the European Parliament and of the Council: EU KIDS ACT — EU Keeping Internet Digital Spaces Accountable and Trustworthy COM(2026) 681 final (17 September 2026), explanatory memorandum and arts 5–14, 27–29. EUR-Lex.
[2] Martin Husovec, Principles of the Digital Services Act (Oxford University Press 2024) 33–35, 333–335, 391–393. Oxford University Press.
[3] Charter of Fundamental Rights of the European Union [2012] OJ C326/391, arts 7, 8, 11, 24 and 52(1). EUR-Lex.
[4] UN Committee on the Rights of the Child, General Comment No 25 (2021) on Children’s Rights in Relation to the Digital Environment UN Doc CRC/C/GC/25 (2 March 2021), paras 16–21, 50–55 and 84–86. United Nations.
[5] Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services (Digital Services Act) [2022] OJ L277/1, arts 28, 34 and 35. EUR-Lex.
[6] European Commission, Guidelines on Measures to Ensure a High Level of Privacy, Safety and Security for Minors Online, Pursuant to Article 28(4) of Regulation (EU) 2022/2065 C/2025/6826, [2025] OJ C/2025/5519, paras 12, 17 and sections 5–8. EUR-Lex.
[7] European Board for Digital Services and European Commission, Second Report on the Most Prominent and Recurrent Systemic Risks as well as Mitigation Measures (1 July 2026) 5–7, 43–46, 51–52. European Commission publication, 2 July 2026.
[8] Amy Orben, Andrew K Przybylski, Sarah-Jayne Blakemore and Rogier A Kievit,
‘Windows of Developmental Sensitivity to Social Media’ (2022) 13 Nature Communications 1649. DOI.
[9] European Commission, ‘EU KIDS Act to Restrict Social Media Platforms’ Access to Children in the EU’ (Press release, 17 September 2026). European Commission.
[10] European Data Protection Board, Statement 1/2025 on Age Assurance (adopted 11 February 2025). EDPB.
[11] Case C-401/19 Republic of Poland v European Parliament and Council of the European Union EU:C:2022:297, paras 83–86. EUR-Lex.