The Draft EU KIDS Act and European Data Protection Law

by Paul C. Johannes//

1. Objectives and context

On 17 September 2026, the European Commission published its proposal for the ‘EU KIDS Act’, COM(2026) 681 final (‘the Proposal’). The proposed Regulation aims to protect minors from risky digital services and AI systems and to harmonise divergent national rules. It would establish harmonised safety rules for, among others, social networks, video-sharing platforms, online games, AI companions and general conversational chatbots. The aim is a high level of protection for minors across the digital environment, combined with swift, effective and robust enforcement (COM(2026) 681 final, p. 1; on the problem definition, SWD(2026) 681 final, pp. 14 et seq.).

Key elements include:

  • harmonised minimum ages for accounts on social networks and video-sharing platforms (Arts 6–7),

  • age assurance obligations, including an EU age verification solution (Arts 27 et seq.),

  • safety-by-design requirements, for example against addictive design (Arts 8 et seq.),

  • safeguards for contact and interaction (Art. 12), and

  • enforcement through the supervisory structures of the DSA and the AI Act, with independently audited compliance plans for very large online platforms (Art. 5).

The Proposal also lays down specific design requirements for AI companions and general conversational chatbots that interact with minors (Art. 14).

The Proposal is available in all official languages (see https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52026PC0681). It is accompanied by a Commission Staff Working Document, Analysis of impacts, SWD(2026) 681 final (‘SWD’) (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=SWD%3A2026%3A0681%3AFIN). The EU Law Tracker monitors the progress the Proposal (https://law-tracker.europa.eu/procedure/2026_286?lang=en).

The Proposal is part of a wider effort to make the digital world safer for minors. Social media, and more recently AI and chatbots, have been the main targets of criticism (see, in German, ‘EU-Parlament will Social Media stärker reglementieren’, becklink 3501638; Sümmermann, ZRP 2026, 230; on the political context – the Commission’s expert panel, the European Parliament resolution of 26 November 2025, the Jutland Declaration and notified national age limits – SWD, pp. 3 et seq., 15 et seq.).

The Proposal must be read against the background of an ever-expanding body of European data and platform law (see Geminn/Johannes (eds), European Data Law, 2026 (forthcoming)- https://www.nomos-shop.de/de/p/eu-data-law-978-3-7560-0083-8), in which numerous digital acts compete for scope and significance. The KIDS Act would join them with rules specifically designed to protect minors. In the Commission’s view, no existing instrument yet takes the protection of minors as its starting point (SWD, p. 8). The closest links are to the DSA (Regulation (EU) 2022/2065) and the AI Act (Regulation (EU) 2024/1689), but the Proposal also connects with many other acts, notably the GDPR. The following overview focuses on the latter.

2. The KIDS Act and data protection law: an overview

Formally, the Proposal is a child protection and internal market instrument that specifies Article 28 DSA and complements the AI Act. In substance, however, much of it is applied and specified data protection law. The SWD itself points to the data protection risks of current age-check practices, such as uploading identity documents directly to the service (SWD, p. 33). The links range from references to GDPR concepts to stand-alone data protection obligations backed by GDPR-level fines.

2.1 Conflict rule and basic architecture

Under Article 2(7)(c) of the Proposal, Union data protection law, in particular the GDPR and the ePrivacy Directive (2002/58/EC), remains unaffected. Recital 51 of the Proposal repeats this for age assurance and refers to purpose limitation, data minimisation (Art. 5(1)(b), (c) GDPR) and privacy by design and by default. At the same time, the Proposal lays down its own, partly stricter data protection rules (Arts 26(4) and 28), whose infringement is sanctioned by the GDPR supervisory authorities (Art. 34(6)). The ‘without prejudice’ clause therefore conceals a genuine lex specialis relationship.

2.2 Direct references to GDPR concepts

The Proposal has direct references to GDPR definitions and concepts. For example:

  • A recommender system based on profiling makes a service a risky service under Article 6(1)(f) and thus triggers the access ban for under-15s. Article 10(3)(b) also requires at least one option not based on profiling within the meaning of Art. 4(4) GDPR.

  • Where a provider relies on consent, the KIDS Act age limits ‘should apply in parallel’ to those of Article 8 GDPR (Art. 6(5)).

  • The independent auditors of the compliance plans must have expertise in ‘data protection and security’ (Art. 5(2)(f)). In effect, data protection review is drawn into a DSA-style audit regime.

2.3 Stand-alone data protection rules in Chapter V (age assurance)

Article 27 of the Proposal requires age assurance solutions to provide a high level of accuracy, reliability, security, robustness, non-intrusiveness, privacy and data protection, and non-discrimination. Recital 50 gives non-intrusiveness a data protection meaning: identity or exact age should not be disclosed where proof of an age threshold suffices. The SWD adds that self-declaration alone is not effective age assurance (SWD, pp. 30 et seq.; Recital 50).

Article 28 is the core data protection provision. Age assurance must not enable identification, location, tracking, targeting, advertising or profiling ‘for any purpose’. Processing is limited to what is strictly necessary, and any further processing, disclosure or combination with other services of the provider or third parties is prohibited. This is stricter than Article 6(4) GDPR, as it rules out any compatibility test, and structurally resembles the data combination ban in Article 5(2) DMA. Every age assurance measure must also be ‘zero knowledge proof ‘. By way of exception, a minimal age signal may be stored at account level to avoid repeated checks. Providers must take technical and organisational measures, mirroring Articles 24, 25 and 32 GDPR.

Article 29 sets out the solutions. For the access ban under Article 6, providers must rely exclusively on a certified EU age verification solution provided by a third party. European Digital Identity Wallets certified under Article 5c eIDAS are deemed compliant, linking the Proposal to the unlinkability and data protection requirements of the revised eIDAS Regulation (Regulation (EU) 2024/1183). Providers must also offer an internal complaint mechanism against incorrect age assurance results, which touches on Article 16 (rectification) and, above all, Article 22 GDPR. Operating system providers are to share age signals ‘after obtaining consent of the user’.

2.4 Verification of parental responsibility

Under Article 26(1)(b) of the Proposal, providers may use signals of parental responsibility that they ‘may already be in possession of ’ from past engagements with the service. This is a change of purpose whose compatibility with Article 6(4) GDPR the Proposal simply assumes. Article 26(4) requires privacy-preserving verification and prohibits subsequent processing for location, tracking or profiling.

2.5 Safety by design as a specification of Article 25 GDPR

Much of Chapter III reads as a sector-specific form of privacy by default. Article 8(1), for example, requires services to apply the minors’ standards of Chapter III by default until age assurance establishes that the user is an adult, making age assurance a precondition for any ‘adult configuration’. Under Article 11, geolocation, tracking, microphone, camera, contact synchronisation and push notifications must be switched off by default. These settings may only be changed for minors above 15 who have ‘explicitly consented’, and geolocation is switched off again after each session. Article 10(2)(b) and (c) prohibit the default use of implicit engagement signals for recommendations and the use of personal data from outside the service – a statutory specification of data minimisation and purpose limitation, parallel to the ban on profiling-based advertising to minors in Article 28(2) DSA. For AI companions and chatbots, Article 14(1)(b) provides that, by default, information from a minor’s prior interactions must not be used in later interactions, except where necessary to protect the minor’s safety. Recital 32 justifies this by the risk of accumulating sensitive data. This amounts to storage limitation (Art. 5(1)(e) GDPR) in respect of special category data (Art. 9 GDPR), such as mental health and emotional states, that such systems routinely process.

2.6 Indirect links

The Proposal also has a number of indirect links to data protection law and raises questions of application with the GDPR. Two examples:

  • Tools for guardians (Art. 20) necessarily process the child’s usage and communication data and make them available to third parties. The Proposal requires these tools to respect the minor’s ‘agency and privacy’ (Art. 20(1)(f)) and to inform minors when they are in use (Art. 20(2)), which touches on the transparency obligations in Articles 12–14 GDPR. The obligation to make the tools interoperable with third-party tools (Art. 20(5), with reference to Art. 6 DMA) opens up additional data flows whose legal basis and allocation of responsibility need to be defined by the controllers.

  • Exemptions (Art. 2(4)) cover, among others, not-for-profit educational and scientific repositories (point (b)), services and systems developed solely for scientific research (point (e)) and services operated by public authorities for their own use (point (f)). For these, general data protection law, including Articles 8, 25 and 89 GDPR, continues to apply.

3. Summary

In its approach, the Proposal is a welcome and necessary specification of existing law. It turns soft-law guidance under Article 28 DSA into binding rules and closes gaps in the AI Act. It also takes data protection seriously, most visibly through the strict purpose limitation and the zero-knowledge requirement for age assurance.

Much still needs to be negotiated and refined, however. Several points remain unclear (e.g. the parallel age limits under Article 8 GDPR and national laws and the allocation of supervisory competences). The numerous drafting errors also need to be corrected. Whether the Proposal achieves its aim of a high and uniform level of protection for minors without disproportionate data processing will also depend on the outcome of the legislative procedure.

Paul C. Johannes is a lawyer specialising in IT and data protection law and managing partner of Datenrecht Beratungsgesellschaft bR, Baunatal, Germany. He is also deputy managing director of the research group on constitutionally compatible technology design (provet) at the Research Center for Information System Design (ITeG), University of Kassel.

Parts of this article were previously published in German as ‘Der Entwurf des EU-KIDS-Act im europäischen Datenrecht’, ZD-Aktuell 2026, 01434 (https://beck-online.beck.de/Bcid/Y-300-Z-ZDAKTUELL-B-2026-N-0143).

By Guest | November 9, 2026 | Article |