The European Union wants to better protect children and young people from the dangers of social media, online games, and digital platforms. The EU KIDS Act proposes new age limits and stricter rules for service providers. However, what does this mean for our privacy? Will adults also need to prove their age going forward? And why should only children be protected from commercial profiling?
Protecting Children – But At What Cost?
I have my own children. Of course, I want them to move as safely as possible on the internet.
I do this myself too.
In our household, we use AdGuard Home on a Raspberry Pi as a network-wide advertising and tracking filter solution. I am involved in data protection, pay attention to the software used, and try to explain to my children what dangers they may encounter online.
Because one thing must be clear: No filter, no age control, and no law can fully replace parental education.
That is why I consider it fundamentally right that the European Union focuses on protecting minors online.
However, when I looked closely at the proposed EU KIDS Act, several questions arose for me.
How far should age controls extend? What data must users now disclose? And what happens to our ability to move anonymously or under a pseudonym online?
One question in particular concerns me:
How can we protect children without simultaneously restricting the privacy of all internet users?
What is the EU KIDS Act?
On 17 September 2026, the European Commission proposed a new EU regulation.
The official title is EU Keeping Internet Digital Spaces Accountable and Trustworthy, commonly referred to as the EU KIDS Act.
The law aims to better protect children and young people from harmful content, cyberbullying, sexual harassment, and manipulative platform functions.
In addition, the Commission intends to prevent service providers from designing their services in a way that encourages minors to spend as much time as possible on them.
This includes endless scrolling, automatically starting videos, or notifications designed to repeatedly draw users back to a platform.
The proposal applies not only to social media but also to video platforms, online games, app stores, and certain artificial intelligence systems.
Important: The EU KIDS Act is not yet a passed law.
The European Parliament and the Council of the European Union must consider the proposal. Individual provisions may be amended during this process.
What Age Limits Are Planned?
For certain social media platforms and video services, the proposal outlines an age-based model.
Under 13 years old: Children should not have their own accounts on the affected social networks. For some age-appropriate video offerings, limited exceptions via parental accounts are provided.
Ages 13 to 14: Parents or guardians can set up restricted and supervised accounts. Examples include daily time limits of no more than one hour and consent for contacts.
From 15 years old: Young people should be able to create their own accounts. Platforms must still adhere to special protection requirements for minors.
These age regulations do not apply uniformly to all websites but specifically to certain services with high-risk functions.
This is an important distinction.
Someone claiming that no child under 15 can ever use the internet again would be repeating the proposal incorrectly.
Nevertheless, the question arises: How will these new age limits be technically enforced?
And this brings us to the first problem.
How Will My Age Be Verified?
So far, many platforms suffice by asking for a date of birth during registration.
This can easily be entered incorrectly.
Exactly this simple self-confirmation should no longer be sufficient for affected services going forward.
The European Commission therefore relies on certified age proofs.
A service would learn only whether someone has reached a certain age threshold.
Name, date of birth, or full identification documents need not be disclosed to them.
Technically, so-called Zero-Knowledge Proofs can be used for this purpose. In simple terms, one proves a specific property without revealing all the information from which that property is derived.
At first glance, this sounds like a reasonable data protection approach.
However, a question must not be overlooked:
Why do I need to prove my age at all if I have been using the same service without such proof before?
The Commission explains that not every adult needs to be rechecked by default. Providers could also use existing, sufficiently reliable information to estimate age.
But this immediately raises another question.
Where do these sources of information come from? And what data is used for evaluation?
A system that transfers as little personally identifiable information as possible is not automatically privacy-friendly if extensive data must be collected beforehand to reliably determine age.
The European Digital Identity: Voluntary or Eventually Unavoidable?
Currently, the European Union is working on a European digital identity wallet.
This allows citizens to manage various digital proofs in the future.
An age proof could also be conducted through this system.
The use shall be voluntary. Furthermore, the EU should provide at least one free method for verifying age that does not require a digital identity wallet.
This is clearly to be welcomed.
Nonetheless, I fear an evolution similar to those already observed in other digital services.
A feature will initially be offered voluntarily. In the future, it may become increasingly mandatory as more providers rely on it.
Eventually, the question of whether I should use a digital age verification document will no longer arise.
But rather: which one must I use to access a particular service at all?
This development is not inevitable. The EU KIDS Act also does not mandate a general obligation for age verification across the entire Internet.
However, we must prevent individual age checks from gradually evolving into a general prerequisite for access.
For me, this means continuing to research on the Internet, visiting websites, playing games, and communicating with others without having to constantly prove my digital identity.
Does a Messenger need to know that my child is my child?
This point concerns me particularly.
If I send a message to my child via a messenger, why should the service provider need to know our familial relationship?
It could just as easily be an older sibling, a cousin, or another trusted person.
For delivery of messages, this knowledge is not fundamentally required.
However, for certain supervised children accounts, the KIDS Act does provide that parental responsibility can be verified and may even be required.
The EU aims to create privacy-friendly procedures for this purpose.
This does not mean that every messenger must examine all family relationships of its users.
Nevertheless, I believe it is important to draw clear boundaries here.
Proof of parental authority may be necessary if parents wish to grant certain functions on a children’s account.
But this should not lead to private providers permanently collecting information about who is related to whom.
Such information should never be used for advertising, profile building, or other commercial purposes.
My family is not data for any platform operator.
What does this have to do with so-called chat control?
Parallel to the EU KIDS Act, the European Union has been working on regulations to combat sexual child abuse on the Internet for years.
In public discourse, this initiative has come to be known as “chat control.”
It concerns in particular how providers can recognize, report, and remove depictions of sexual child abuse.
In July 2026, temporary rules were reintroduced that allow certain voluntary identification measures from providers. A permanent legal framework is still being negotiated.
Important: The KIDS Act and so-called chat control are two separate legislative initiatives.
They are not the same, and the KIDS Act does not create a general obligation to search private messages.
Nevertheless, we should consider their possible interactions.
As platforms increasingly require age verifications and link family accounts together, additional technical structures emerge.
At the same time, if discussions arise about automatically examining private communication for specific content, we must ask what impact both developments combined could have on our fundamental rights.
I hold confidentiality of private communication as a fundamental right.
And to that extent, I also require effective end-to-end encryption.
Technical backdoors or a blanket review of private messages on the end devices of users are unacceptable answers to the dangers in the Internet.
Combating sexual child abuse is an important state task.
It must be targeted, legally controlled, and while safeguarding fundamental rights.
Why only children?
Here I come to a point that I believe has been overlooked in the entire discussion.
The EU KIDS Act aims to protect minors better from manipulative recommendation mechanisms.
Personalization based on tracking should be disabled by default for them. Recommendation systems should also be more aligned with safe and appropriate content.
I consider this fundamentally sensible.
But why limit such measures to children?
Adults are constantly analyzed on platforms too.
What do we watch? What do we discuss? What interests us? How long do we spend watching a video?
From these pieces of information, extensive interest profiles can be created.
The more precisely a provider knows its users, the more targeted it can select ads and present content.
Of course, not every algorithm is bad.
A search engine needs procedures to sort results. A video platform should also display content that I have explicitly subscribed to.
But this does not necessarily require tracking my behavior across numerous websites and different apps.
I would therefore go further than the KIDS Act.
Commercial profiling for advertising purposes should be prohibited in principle – regardless of the age of the user.
Advertising can also be displayed without personal monitoring profiles.
For example, relevant to the content of a webpage.
If someone reads an article about wood transport, they might see ads for workwear or heavy machinery.
This is not necessary for a marketing network to know which other websites readers visited yesterday.
The Human as Trade Goods
Commercial trade in personal data is one of the greatest problems of our digital society.
Data collection does not begin on a website alone.
Device manufacturers and operating system providers can already obtain extensive information about the use of their products.
In addition come apps, advertising networks, analytics providers, and data brokers.
Some apps finance themselves through advertising or the commercial use of user data.
This does not mean that every free app secretly sells data. But the business model of behavior-based advertising creates economic incentives to collect ever more information.
What becomes particularly problematic is when data from different sources are combined together.
From initially insignificant individual pieces of information, very personal profiles can emerge.
And the affected person often does not even know which companies process their data.
Recording or analyzing conversations secretly over microphones would be a particularly serious intrusion into privacy.
However, it is not proven that smartphones generally and permanently listen to conversations for personalized advertising. Such claims should therefore not be equated with the verifiable tracking practices.
Clear access rights for microphones, effective technical controls, and sanctions against actual misuse are all of great importance.
I certainly do not want people to exist primarily as data profiles for companies.
The human must not become a commodity just because they use digital technology.
Open Source Shows There Is Also Another Way
Those who deal with free and open-source software know many alternatives to data-intensive commercial services.
There are operating systems, messengers, browsers, and numerous applications that can work without extensive user profiles.
Open source alone is, of course, not a guarantee for privacy or security.
But open source code enables independent review in principle. Furthermore, alternative providers and developers can create solutions that do not rely on comprehensive data collection.
Especially for this reason, I hold the freedom to choose operating systems, app stores, and software installations as very important.
For example, Google is criticized because of its planned or introduced requirements for developer verification in the Android ecosystem. Independent developers fear additional hurdles for the distribution of their software.
Google justifies such measures among other things with security interests.
Whether individual regulations are unlawful under competition law must be assessed on a case-by-case basis.
For me, however: Users should be able to decide themselves which legally offered software they want to install on their own devices.
And alternative app stores should not be disadvantaged solely because they do not fit the business model of a large platform operator.
Especially the European Union should ensure that security is not used as an excuse for restricting digital self-determination.
What I Specifically Support in the EU KIDS Act
Despite all criticism, I also want to hold fast to the fact that the legislative proposal contains sensible approaches.
These include, for example, stricter protection requirements against unwanted contact attempts, better privacy settings, and restrictions on manipulative platform functions.
That providers should be more strongly obligated to ensure their services are secure from the outset is also a key approach.
For now, responsibility is often shifted onto parents and children.
It is the platform operators who decide on the design of their offers.
They determine which default settings apply, which information is collected, and how recommendation systems work.
That is why it is right to hold them more strictly accountable.
But child protection should not mean that we unnecessarily restrict the digital independence of adolescents or the privacy of adults.
Why I Directly Address the European Commission
The EU KIDS Act is still in the legislative procedure.
And for this reason, citizens can currently express their opinion on the proposal.
The European Commission will accept feedback until December 3, 2026.
I have decided to take advantage of this opportunity and direct my concerns directly to the EU.
In doing so, I am not specifically trying to prevent child protection.
Rather, I want to achieve that age verification remains limited to the necessary extent, private family communication is protected, and protective measures do not lead to new infrastructure for commercial or state surveillance.
Furthermore, I hold it necessary to consider the impact of the KIDS Act together with other legislative initiatives, in particular the planned regulations on the internet against sexual child abuse.
And I call for adults to also receive more effective protection against commercial tracking and profiling.
For privacy rights do not end at the 18th birthday.
My Conclusion
We need better protection of children and adolescents online.
But we do not necessarily need a digital world in which every person must constantly prove their identity.
We should also not accept that companies always create more extensive profiles about our behavior and use this information commercially.
Instead, we should place greater emphasis on awareness, privacy-friendly technology, and the responsibility of providers.
And we must accept that children, as they grow older, also have their own rights to privacy and independent communication.
The key question for me is therefore not whether children should be protected online.
Of course, they should be.
The question is whether we can design this protection in a way that preserves the freedom and privacy of all people at the same time.
I am convinced that this is indeed the benchmark for good European digital policy.
For the protection of our children must not become an excuse to restrict the rights of others.
And our personal data should not become trade goods just because we own a smartphone or use the Internet.
Sources and Further Information
- European Commission: EU KIDS Act – Legislative Proposal
- EUR-Lex: Legal Text COM(2026) 681
- European Commission: The KIDS Act Explained
- European Commission: Feedback on the EU KIDS Act
- Council of the European Union: Combating Child Sexual Abuse – Timeline
- European Commission: European Digital Identity
Date: 8 November 2026
Author: Christian Rumpf – ChristiansBlog.eu
