Four age bands instead of one minimum age
According to the European Commission’s proposal, the draft does not draw a single line and call it childhood. It splits under-18s into four age bands, each with different rights and different obligations on the platforms that serve them. The proposal defines the category it calls "Social Media+" as covering social networks, video-sharing services, online games and AI chatbots or companions.
| Age band | What the Commission proposal says |
|---|---|
| Under 3 | No access to social media or video-sharing platforms. |
| 3 to under 13 | No social media at all. Child-friendly video sharing only through a guardian-controlled account, capped at one hour per day under the draft as published. |
| 13 to under 15 | Social media and video sharing allowed only through supervised accounts with a limited set of peer contacts, capped at one hour per day. |
| 15 to under 18 | Independent accounts permitted, provided the platform meets "safe by design" requirements. |
Read that table as a parent and one detail stands out: the age most European families treat as the moment a child gets a phone and a social account — around eleven or twelve — is exactly where the draft puts a wall. Thirteen becomes the entry point, but only for a supervised, time-limited version of the product, not the full thing. The proposal sets an EU-wide minimum age of 15 for an independent account; the supervised 13-to-under-15 arrangement is conditional on the final text and negotiations. The one-hour daily cap is not a blanket limit for every minor: in the draft as published, the proposal attaches it to the guardian-controlled video-sharing access for under-13s and to the supervised accounts for 13- to 15-year-olds; both details could still change in negotiations.
Why bands, and not an outright ban for under-16s
The Commission is not the first European body to move here. In June 2026, the UK government announced an intention to introduce a social media ban for under-16s, with a reported target of early 2027, according to UK government statements and contemporaneous reporting. The European Commission’s draft as published states that at least 17 EU member states are already preparing national legislation on young people’s online access; the proposal gives the number without listing the countries.
That is the argument for acting at EU level, and it is a practical one rather than an ideological one. Without a common framework, a family driving from Germany to France could cross a border where their fifteen-year-old’s accounts are legal on one side and restricted on the other, and platforms would have to build and maintain a patchwork of national rules. The draft’s four bands are a compromise between doing nothing and copying the UK’s harder under-16 line.
AI chatbots sit in the same box as social media
For anyone following AI regulation, this is the genuinely new part. The Commission proposal names companionship chatbots and AI chat services inside the "Social Media+" category, which means they would carry the same age-assurance and safety-by-design duties as a social network. What the proposal does not yet spell out is identical access rules for those chatbots: the four age bands above set specific access rules for social media and video sharing, while the detailed requirements for AI chatbots would still have to be written during negotiations.
Until now, an AI companion app was regulated mainly as an AI system. Since 2 August 2026, transparency obligations under Article 50 of the EU AI Act have applied: a chatbot has to make clear that it is not a person, and synthetic media has to be marked in a machine-readable way. That is a labelling rule. The KIDS Act would go further and touch the product itself — who is allowed in, what the system is designed to encourage, how long a session is meant to last.
The same August 2026 date matters in another way: the AI Act’s transparency rules are now in force alongside the Commission’s AI Office enforcement powers over general-purpose AI providers. Under Article 99(2) of the EU AI Act, the most serious category — prohibited-practice violations under Article 5 — can lead to fines of up to €35 million or 7% of global annual turnover, whichever is higher. Other breaches, including the Article 50 transparency obligations, are subject to the lower maximum in Article 99(3) of up to €15 million or 3% of global annual turnover. Voluntary codes of practice are no longer the whole story in Brussels.
Age verification is the awkward part
Requiring age verification means asking people for their age, and every method available carries a cost. Self-declaration is free and useless. Uploading an ID document works and collects sensitive data. Device-level attestation or a third-party age token is more privacy-friendly but depends on hardware and operating systems the EU does not control.
Whichever route the negotiators settle on, it collides with a question European regulators have been circling for years: how do you prove someone is twelve without learning exactly who they are? The GDPR’s data-minimisation principle does not disappear because the goal is a good one, and any verification system that quietly builds a database of children’s identities would create a bigger problem than the one it set out to solve. That tension, not the age numbers, is where this proposal will be fought over.
2028 at the earliest — and probably later
A Commission proposal is the start of a process, not the end of one. The text now goes to the European Parliament and to member states in the Council, where both can amend it substantially. After that come negotiations between the two, a final vote, and a transition period for platforms to comply. The European Commission’s proposal itself puts the earliest possible application in 2028.
In the meantime, national laws will do the actual work. According to the proposal’s own count, seventeen member states are already drafting, which means that for the next two years or so, what a teenager can open on their phone will depend far more on their postcode than on anything decided in Brussels. We follow this shifting landscape of EU tech policy closely in our magazine, because the gap between a proposal and a household rule is where most of the real life happens.
Nothing changes this week
The honest answer to "what should I do about this?" is: nothing, yet, because of it. The tools available today are the ones that were available last month — supervised accounts on the major platforms, device-level screen time controls, and the family settings that most parents set once and never revisit.
The value of the draft, for now, is not that it restricts anything. It is that it tells you what the European Commission believes a reasonable default looks like: no social media before thirteen, a supervised half-version between thirteen and fifteen, and full independence only when the platform has done the work to earn it. Whether that becomes law in 2028 or dies in negotiation, it is a useful benchmark to argue with.
Is the EU KIDS Act already law?
No. It is a draft proposal published by the European Commission on 17 September 2026. It still has to pass through the European Parliament and the Council of member states, both of which can change it, and the European Commission’s proposal projects 2028 as the earliest possible application date.
Would children be banned from using AI chatbots?
Not in the way the headline suggests. The draft places AI chatbots and companions inside the covered "Social Media+" category, which means they would be subject to age verification and safety-by-design duties. The four age bands spell out specific access rules for social media and video sharing; for chatbots, the practical effect depends on how the detailed obligations are written during negotiations.
My child is 14 and uses Instagram. Does anything change for us now?
Not because of this draft. Existing rules come from national law and from the platforms’ own terms; in several EU countries platform rules still allow accounts from age 13 with a self-declared birth date, but national age-of-consent rules and platform policies differ. If the KIDS Act is adopted in roughly its current form, a 14-year-old’s account in the EU would move to a supervised model with a daily time cap and a limited contact list — but not before 2028.
