What the EU KIDS Act Requires From Platforms and Users

On September 17, 2026, the European Commission published a proposal for what it's calling the "EU KIDS Act." The draft legislation would set minimum-age requirements for accessing social media and video-sharing platforms across the European Union, and it would require those platforms to verify users' ages before granting access. Covered entities, including major social media and video-sharing providers, would face new compliance obligations tied to how they confirm a user's age and how they handle accounts belonging to minors.

This builds on earlier drafts of the legislation that focused on age checks for users under 15, which we covered in our earlier piece on the EU Kids Act's proposed age checks for under-15s. The latest proposal expands the scope, formalizing age verification as a legal requirement rather than a voluntary safety measure, and placing enforcement responsibility squarely on the platforms themselves.

How Age Verification Typically Works

Mandatory age verification sounds simple in theory: confirm a user is old enough before letting them create an account. In practice, platforms have relied on a mix of methods, none of which are equally protective of user privacy.

The most direct approach involves submitting a government-issued ID, such as a passport or national identity card, which a platform or a third-party verification service checks against the user's claimed age. Biometric verification, often facial age estimation, is another common method: a user takes a selfie or short video, and an algorithm estimates whether they meet the age threshold. A third approach relies on behavioral or account-based signals, such as how long an account has existed, payment history, or activity patterns, to infer a likely age range without a document check.

European regulators have signaled interest in a fourth option: a centralized, privacy-preserving verification system designed to confirm only whether a user clears an age threshold, without sharing the user's identity, birthdate, or other personal details with the platform itself. This kind of system, if implemented well, could reduce the amount of sensitive data individual platforms collect and store. But the EU KIDS Act as proposed leaves significant details about implementation, enforcement, and technical standards still to be worked out, and it will ultimately be up to individual platforms to decide which verification method they adopt in the near term.

The Privacy Trade-offs: Data Collection vs. Child Safety

The policy goal behind the EU KIDS Act is straightforward: keep children off platforms and content that aren't appropriate for their age, and reduce exposure to harms like addictive design features or inappropriate material. Few people would argue against that objective.

The complication is that most current age verification methods require users, both children and adults, to hand over sensitive personal data to prove they qualify for access. ID-based checks mean uploading a scan of a passport or driver's license to a platform or a third-party vendor. Biometric checks mean submitting a facial scan, which creates a permanent biometric record tied to an account. Even behavioral tracking methods require platforms to collect and retain more data about user activity than they otherwise would.

Every one of these data flows becomes a potential target. A database of uploaded IDs or facial scans, sitting on a platform's servers or with a third-party verification vendor, is exactly the kind of asset that attracts data breaches and unauthorized access. Unlike a password, a government ID or biometric scan can't simply be reset if it's exposed. For a law aimed at protecting minors, there's a real risk that the verification process itself becomes the weak link, especially if smaller platforms with limited security budgets are expected to build or license these systems on short notice.

What This Means for You

If the EU KIDS Act moves forward as proposed, users across the EU, both adults and minors, should expect to encounter age verification prompts on major social media and video-sharing platforms in the coming months. That could mean uploading an ID, taking a selfie for biometric analysis, or authenticating through a centralized age-check system, depending on which method each platform chooses to implement.

Parents should pay attention to which verification method a platform uses before letting a child go through it, and should ask whether the platform stores the submitted ID or biometric data, and for how long. Adults should be equally cautious: verification systems built for minors will often apply to everyone, meaning adult users may also be asked to prove their age to keep using a service they've had for years.

Key Takeaways

The EU KIDS Act reflects a genuine and widely shared concern about children's safety online, and the underlying goal deserves serious support. But the mechanism chosen to achieve that goal, mandatory age verification, carries its own privacy and security trade-offs that deserve equal scrutiny.

As this legislation moves through the EU's approval process, users should watch for updates on which verification methods platforms adopt, read privacy policies before submitting any ID or biometric data, and favor platforms that commit to minimal data retention and privacy-preserving verification design. For more background on how the EU KIDS Act's age-check requirements first took shape, our earlier coverage of the proposed age checks for under-15s walks through the legislation's origins and scope. As the EU KIDS Act age verification privacy debate continues, staying informed will be the best tool users have for protecting both their children and their own data.