The European Commission has unveiled a sweeping child safety proposal known as the EU Kids Act, legislation that would ban social media use for children under 13 and force platforms to verify the age of every user, not just the youngest ones. The plan covers social media, online gaming, and AI chatbots, marking one of the most ambitious attempts yet to reshape how minors interact with the internet.
While the goal of protecting children online is widely supported, the mechanics of the EU Kids Act age verification requirements are already drawing scrutiny from privacy advocates who see troubling parallels to other EU digital policies that expanded surveillance in the name of safety.
What the EU Kids Act Would Require of Platforms
At its core, the EU Kids Act would accelerate age verification plans that have been in discussion across the bloc for some time. Under the proposal, social media platforms would be barred from allowing users under 13 to create accounts at all. For users above that threshold but still minors, platforms would need to apply additional protections, meaning services can no longer simply ask users to self-report their birthdate and move on.
The law's reach extends well beyond traditional social media. Online gaming platforms and AI chatbot services would also fall under its scope, reflecting how children's online lives now span far more than just apps like Instagram or TikTok. For companies operating across the EU, this means building or adopting age verification systems that can withstand regulatory scrutiny, not just checkbox-style confirmations.
How Age Verification Could Mean ID Scans and Facial Recognition
The practical challenge with any age verification mandate is that it requires platforms to actually know how old someone is, and self-reported ages have never been reliable. That leaves companies with a narrow set of options: government ID uploads, credit card checks, or biometric estimation tools like facial age scanning.
Each of these methods carries its own privacy tradeoff. ID uploads require users to hand over sensitive documents to third-party verification services. Facial recognition systems, meanwhile, analyze biometric data to estimate age, raising questions about how long that data is stored, who has access to it, and whether it could be repurposed for other tracking. Even when companies promise the data is deleted immediately after verification, users have limited ability to confirm that claim.
This is not a hypothetical concern specific to the EU Kids Act. It echoes debates already underway around the EU's broader push toward a mandatory social media start age, a policy championed by Commission President Ursula von der Leyen that would similarly require platforms to verify user ages before granting access.
Why Privacy Advocates See Overlap With Chat Control
The EU Kids Act arrives against the backdrop of another contentious child safety measure: Chat Control. That legislation, which the EU Parliament passed despite significant backlash, aims to combat child sexual abuse material by giving authorities new tools to scan private communications, a move critics argue undermines end-to-end encryption for everyone, not just bad actors.
Privacy researchers have warned that this pattern, expanding surveillance infrastructure under the banner of protecting children, tends to create tools that can be repurposed well beyond their original intent. As Vyara Savova has explained, the scanning of private messages by EU-based providers isn't a distant possibility but an active policy direction. The EU Kids Act's age verification requirements fit into this same trajectory: infrastructure built to check a user's age could, in principle, be extended to track browsing habits, link accounts, or profile users in ways unrelated to child safety.
What This Means for You
If you're a parent, the EU Kids Act signals that age verification is likely becoming a permanent fixture of using major online platforms in Europe, not a temporary inconvenience. If you're an adult user without children, you may still encounter these checks simply because platforms often apply age verification broadly rather than building separate systems for minors and adults.
For minors attempting to bypass restrictions, it's worth understanding that a VPN changes your apparent location, not your age. A VPN can shift which country's servers your traffic appears to come from, but it does nothing to alter age verification checks tied to ID uploads, facial scans, or account-level flags. Anyone hoping a VPN alone will unlock access to age-restricted platforms is likely to be disappointed, since verification increasingly happens at the account or document level rather than the network level.
Key Takeaways
The EU Kids Act is still a proposal, not finalized law, but its direction is clear: platforms will be expected to know their users' ages with far more certainty than before. As this legislation moves through the EU's approval process alongside Chat Control and the social media start age plan, users should watch for how verification data is stored, who processes it, and whether independent oversight exists. Staying informed about these overlapping policies is the best way to understand what's actually changing about your privacy online, rather than relying on assumptions about what tools like VPNs can or cannot fix.
