EU KIDS Act: Solo Social Accounts From 15, Chatbots Covered

On September 17, 2026, the European Commission adopted its EU KIDS Act proposal, which would set 15 as the minimum age for an autonomous account on covered social-media and video-sharing services. Children aged 13 or 14 could use limited accounts managed by a parent or guardian, while individual social-media accounts would be unavailable below 13.

The measure is a legislative proposal, not a law already in force. A Reuters report published on September 17 notes that the text must be negotiated with EU member states and the European Parliament before it can become law, so its ages, scope and timetable could still change.

The proposed age-by-service matrix

The published draft regulation establishes three account bands for social networks and video-sharing services with specified risky features:

Under 13: children could not create or use an individual account on a covered service. A narrow exception would permit access to a video service designed specifically for young children through a guardian’s account, without creating a child account.
Age 13 to under 15: a guardian could create a limited account and would retain control through tools that remain active. New contacts could require approval, and the guardian could set a daily limit of no more than one hour.
From age 15: a young person could create and manage an autonomous account. Safety-by-design protections would continue to apply until the user turns 18.

The one-hour ceiling is not a universal screen-time limit for every minor or every covered service. It applies to the supervised accounts available at ages 13 and 14 and to the narrow parent-account video exception for younger children.

The proposal reaches beyond conventional social media

The account staircase does not apply identically across the entire digital sector. An independent account from El País describes a package covering social networks, video-sharing platforms, online games, app stores, AI companions and general conversational chatbots, with different obligations reflecting the risks of each service.

Social networks and video-sharing platforms: the three age bands would govern services containing designated risky features. Providers would also need age checks, private-by-default profiles and protections against unsolicited contact.
Online games: games used by minors would face safety-by-design requirements rather than automatically inheriting the social-media account staircase. The rules address compulsive design and spending traps.
AI companions and chatbots: services accessible to minors would have to assess risks to children’s safety and wellbeing. Designs likely to foster emotional dependency would be restricted, while access by children under 13 would require parental-control tools.
App stores: stores would need to age-rate apps through a published methodology, restrict access to age-inappropriate products and support compliant age-assurance tools.

The official KIDS Act explainer adds that embedded AI companions and chatbots could not activate automatically or be promoted to minors and would need an accessible off switch. Providers would have to test covered AI systems for risks before launch and monitor emerging harms afterward.

Parental controls would complement provider duties

A guardian-managed account would require more than entering a parent’s name or a child’s birth date. Providers would need a privacy-preserving method of establishing parental responsibility, keep guardian tools active for 13- and 14-year-olds, and support controls for screen time, contacts, settings and reports of harmful material.

Those tools would not transfer responsibility for product safety to families. Services used by minors would have to limit features that encourage compulsive use, prevent unsolicited contact, make young users’ profiles private by default and provide accessible blocking, muting and feed-reset controls.

The proposed reversal of the burden of proof is especially significant for very large online platforms. Instead of waiting for regulators or families to establish harm, those providers would have to submit compliance plans and pay for independent audits demonstrating how their services meet the new safeguards. Providers of covered AI companions and chatbots would likewise have to demonstrate compliance before placing those systems on the EU market.

Age assurance remains the operational hinge

Self-declared birthdays would not satisfy the proposed account rules. Certified systems would instead provide proof that a user falls above or below a relevant threshold without disclosing the person’s identity, exact age or birth date to the service.

Each member state would have to offer at least one free route for proving age and a privacy-preserving method for confirming parental responsibility. Platforms would still need practical procedures for handling existing accounts, linking a guardian to a child and distinguishing adults from minors without turning every age check into broad identity tracking.

Existing accounts would not be exempt. Within six months after the rules began to apply, covered platforms would have to establish whether account holders were under 15 and disable accounts where the user was below the threshold or their age could not be established. A fresh check would not be necessary when a provider could already determine with high confidence that a user was an adult.

The age rules are not yet binding

No family or platform is currently subject to the proposed KIDS Act account bands. The European Parliament and the Council must develop their positions and negotiate a final text, during which they can amend the thresholds, covered services, enforcement system and implementation timetable.

The central structure is nevertheless clear at the proposal stage: no individual social-media account below 13, supervised limited access at 13 and 14, and autonomous accounts from 15, alongside separate safety duties for games, app stores and conversational AI. The next decisive development will be agreement by the EU’s co-legislators; only an adopted and published regulation would establish binding application dates.