Protecting minors in digital environments: what applies today and what is coming

The Commission proposes three age bands and certified verification

The EU KIDS Act proposal bans an own account below the age of 13, allows a limited account opened by a parent or guardian between 13 and 15, and reserves the autonomous account for those aged 15 and over. Age verification must be certified and independent, with at least one free option in each Member State.

The planned method does not identify the user. It relies on zero-knowledge proofs, which show that someone is above an age without revealing who they are, and treats the European digital identity wallet as one of the valid routes. Platforms would have six months to verify existing accounts.

The text also names design practices and prohibits them. Endless autoplay, infinite scrolling, notifications designed to pull the minor back in, rewards for posting to mass audiences and streak mechanics. Recommender systems would have to be optimised for safety rather than engagement, and chatbots could not simulate human relationships that create emotional dependence. One caveat: it is a European Commission proposal and still has to be negotiated.

Who each text reaches

The European proposal reaches platforms and video services operating in the Union. The Spanish draft went further on a point that often goes unnoticed, because it also reached whoever manufactures the device.

Article 4 of the draft organic law (in Spanish) required manufacturers of terminal equipment to inform users of the risks and to build in parental controls switched on by default at initial set-up. Article 5 barred minors from random reward mechanisms. The draft lapsed with the dissolution of Parliament, and the Government formed after the general election of 29 November 2026 will have to table it again if it wants it passed. It may take up this content or change it, so today it serves as a reference, not as an obligation.

The only enforceable rule today is Article 28 of the DSA

The obligation in force is Article 28 of the Digital Services Act, which requires appropriate and proportionate measures to ensure a high level of privacy, safety and security of minors. In July 2025 the Commission published guidelines that develop that article.

They are not binding and following them does not prove compliance, but they serve as a benchmark for assessing it. They recommend minors’ accounts that are private by default, recommender systems that reduce exposure to harmful content, and safeguards around virtual currencies and loot boxes. Much of what the September proposal turns into obligations was already there.

There is a Spanish nuance worth keeping in mind, which we develop in our analysis of the Digital Services Act. The European rule applies, but the national enforcement arm is arriving late, a pattern repeated across the rest of the digital regulatory framework.

What to review before either text is adopted

The useful work today is the inventory. Which features minors can use, which data is collected from them, which spending or random reward mechanics exist, how the default settings behave and which age check is applied.

An example. A Galician company develops a video game with items that open at random and does not consider itself affected because it is not a social network. Article 5 of the Spanish draft would have reached it because of the random mechanic, and the European proposal singles out its streaks and its notifications. Neither text binds it today, and that is exactly why now is the time to look at it.