Children and young people should be better protected on the internet. Few would likely have serious objections to this. Cyberbullying, sexual harassment, manipulative algorithms, and platforms that want to keep their users on the screen for as long as possible are real problems. The question is, however, how to address these issues.
The European Commission has found an answer: the so-called EU Kids Act. A draft regulation that significantly restricts minors’ access to social networks and obliges platform operators to implement extensive protective measures.
What initially sounds like a reasonable initiative raises some uncomfortable questions upon closer examination. Because to reliably verify the age of children and young people, platforms will inevitably also have to determine which users are already adults.
And thus, the EU Kids Act suddenly affects not only children and their parents, but practically everyone who uses social networks.
What the EU Commission plans specifically
On September 17, 2026, the European Commission published its proposal for the EU Kids Act. Behind the abbreviation lies the somewhat cumbersome name „EU Keeping Internet Digital Spaces Accountable and Trustworthy“.
The draft proposes a unified system of age limits across Europe.
Children under the age of 13 should generally not be allowed to have their own accounts on social networks that fall under the specified access restrictions. A limited exception is provided for certain child-friendly video platforms that can be accessed via parental authorization.
For 13- and 14-year-olds, so-called Mini-Accounts should be possible. These would have to be set up and managed by the guardians. Daily usage should be limited to at most one hour. Contact options should also be restricted.
Only from the age of 15 could young people open their own accounts independently.
However, that would not be the end of the matter. Additional protective measures should apply to all minors under the age of 18. These include restrictions on personalized recommendations, stricter privacy settings, and measures against features that promote excessive use.
The draft also applies to more than just traditional social networks. Video platforms, online games, app stores, operating systems, and certain AI chatbots are also included in its scope.
It is important to note: The EU Kids Act is still a legislative proposal and not yet binding law. The European Parliament and the Council of the European Union must first consider the draft. Changes are therefore explicitly possible.
Why must adults prove their age if children are to be protected?
Here begins one of the biggest problems of the entire initiative for me.
Let’s assume someone wants to open a new account on a social network in the future. The platform may only offer certain functions to people who have reached the prescribed minimum age.
How should it know whether the new user is twelve, sixteen, or forty years old?
A simple question about the birthdate is clearly not enough. After all, anyone can make up any information.
The EU Kids Act therefore provides for technical procedures to determine age. Certified European solutions should be used for certain access restrictions.
The Commission explicitly relies on privacy-friendly procedures, particularly so-called zero-knowledge proofs. In simple terms, a platform should be able to find out whether someone has reached a certain age limit without needing to receive the name, full birthdate, or a copy of an ID.
This is initially a sensible approach. It makes a significant difference whether I have to provide my ID to a social network or merely a cryptographic proof that I am at least 18 years old.
Nevertheless, a fundamental question remains.
Why should I have to prove that I am old enough to use a social network in the future?
Until now, many services allowed registration with an email address and a self-chosen username. The platform did not necessarily know who was behind the account.
With mandatory age verification, a new technical infrastructure is now created that must be passed through before using certain offerings.
Of course, an age verification does not automatically mean that the platform learns the identity of the user. That would be a wrong conclusion.
But even a data-efficient system must be operated. It needs trustworthy issuers, technical interfaces, and rules for how proofs are issued and verified.
How independent are these entities? What data is collected during issuance? How is it prevented that repeated checks create user profiles? And what happens if someone does not have access to an accepted proofing procedure?
These are not minor technical details. They determine whether such a system actually protects privacy or merely creates a new barrier to accessing the internet.
When the state decides when children may use the internet
Another point concerns the role of parents.
Of course, parents have the responsibility to protect their children and to accompany them in the use of digital media. This does not, however, mean that every child reaches the same developmental level at the same age.
A 13-year-old can certainly handle social networks more responsibly than another teenager who is 16 years old.
Nevertheless, the EU Kids Act sets rigid age limits.
This becomes particularly clear in the case of the proposed mini-accounts. Even if parents trust their 14-year-old child with more responsibility, they would likely not be able to simply waive the prescribed maximum daily usage duration of one hour.
Thus, the legislator sets a ceiling that is supposed to apply regardless of individual circumstances.
One can consider such provisions as sensible. But then one should also openly discuss how far the state should intervene in the upbringing and decisions of families.
There is also a practical problem: Who is actually supposed to verify whether someone is indeed legally responsible for a child?
With cohabiting parents, this may still seem relatively straightforward. But what happens in cases of separated parents, disputes over custody, or in foster families?
What about teenagers whose parents are unreachable? Or families whose documents cannot easily be processed by European verification systems?
The draft requires corresponding checks and contains general requirements for the procedures. However, whether these different family situations can be reliably and without disproportionate data collection mapped out remains a completely different question.
The real problem lies with the platform operators
Especially questionable is the fact that the political debate keeps returning to users and their age.
We already know that many problems of social networks do not arise by chance.
Platforms like TikTok, Instagram, or Facebook are designed to capture attention. The longer people use the services, the more opportunities there are to display advertisements and collect data on usage behavior.
Endless scrollable content, automatic video playback, and notifications are not accidental features. They are part of a deliberately designed user interface.
The recommendation algorithms also pursue economic goals. They are supposed to select content that keeps users engaged for as long as possible.
Once someone has watched several videos on a specific topic, they often get further similar content recommended. This can lead to a real pull.
This applies, by the way, not only to children.
Adults also spend hours scrolling through social networks, even though they originally only wanted to check something briefly.
So why does the political discussion focus so strongly on age limits, when the problematic mechanisms work regardless of age?
Fairly speaking, one must say that the EU Kids Act does indeed attempt to regulate these business models more strictly.
The draft contains concrete requirements for recommendation systems. For minors, for example, certain signals derived from usage behavior should no longer be used by default for personalization. Features like automatic playback, artificial reward systems, or intrusive notifications should also be restricted.
I consider this fundamentally a much more sensible approach.
Because here it is not primarily the user who is regulated, but the behavior of the providers.
However, the question then arises: Why not set out more consistently exactly there?
If a certain design is demonstrably causing problematic effects on people, one should regulate that design. And precisely where the risks actually arise.
A business model that relies on exploiting users’ attention for as long as possible does not automatically become unproblematic simply because someone has turned 18.
The Internet is more than TikTok and Instagram
In the discussion about social networks, it is often assumed as if children and teenagers only watch trivial videos there.
This is a rather short-sighted view.
Teenagers also use digital platforms to inform themselves about politics, follow societal developments, or exchange ideas with peers.
For some, social networks are even an important access to communities they cannot find in their immediate environment.
This can, for example, apply to teenagers living in rural areas whose interests are hardly shared in their local community.
Political participation also takes place online. Young people discuss climate policy, education, social inequality, or their own future there.
Of course, they can also get information through other means. But it makes a difference whether one merely consumes information or can actively participate in a discussion.
The EU Kids Act contains exceptions for certain educational and scientific offerings. However, this does not mean that all platforms offering meaningful educational content are automatically exempt.
A commercial platform can certainly provide entertainment, political discussions, and high-quality educational content at the same time.
That is why one must be careful that a well-intentioned protection regulation does not unintentionally hinder access to social participation.
Children have not only a right to protection. They also have a right to information, participation, and an age-appropriate development of their autonomy.
These rights must be reconciled with each other.
What happens with existing accounts?
It is also interesting that the planned age restrictions do not only apply to new accounts.
According to the draft, affected platforms would have to determine within six months after the implementation of the regulation whether the respective users meet the age requirements, even for existing accounts.
Accounts whose holders are under the proposed age limit or whose age cannot be sufficiently determined should be deactivated if necessary.
This raises further questions.
What happens to content that teenagers have published over the years? How are personal messages handled? Can affected individuals back up their data in advance?
And above all: What happens to people who are old enough but cannot prove their age due to technical or personal reasons?
Such a system must not lead to legitimate users being excluded solely because a technical age verification fails.
Especially when regulating something that affects millions of people, such cases must be considered from the beginning.
Well-intentioned child protection is still not a good law
In the Datenschutz-Podcast Auslegungssache from c’t, the EU Kids Act was also discussed in the episode published on October 16, 2026.
c’t editor Holger Bleich criticized the draft unusually strongly. In addition to the rigid age limits, he particularly criticized the legal formulation and the numerous practical difficulties.
The legal scholar Tahireh Panahi also expressed significant doubts about individual regulations. At the same time, she welcomed that the legislator explicitly addresses problematic platform mechanisms such as addictive design.
Exactly this distinction is important.
You don’t have to be against the protection of children to critically examine a concrete legislative proposal.
And you don’t have to consider all social networks harmless to find mandatory age checks problematic.
The decisive question is whether the proposed measures are suitable, necessary, and proportionate.
A law is not automatically good just because it pursues a comprehensible goal.
Why we must talk about digital self-determination
For me, the discussion has now gone far beyond child protection.
We have been experiencing for years that access to digital offerings is increasingly tied to additional requirements.
Sometimes it’s about combating disinformation, sometimes about copyright, sometimes about safety, and now about the protection of minors.
Each of these concerns can be justified on its own.
However, it becomes problematic when additional control mechanisms arise with every new regulation without sufficiently considering their combined impact on the freedom of internet users.
A mandatory age verification is not automatically an identity check. And the EU Kids Act explicitly includes data protection provisions that are meant to prevent identification and tracking.
Nevertheless, we should ask ourselves whether it is really the right long-term approach to make more digital offerings dependent on state-recognized verification procedures.
Because technical infrastructures that have once been built can generally also be interesting for other purposes. This does not mean that a future expansion has already been decided. But precisely for this reason, we need clear legal boundaries, technical protective measures, and an effective independent oversight.
The possibility of moving around the internet pseudonymously is not a meaningless detail.
It can protect people who speak out on sensitive topics, criticize malfunctions, or do not want to reveal their identity for personal reasons.
A modern child protection should not unnecessarily restrict these freedoms.
Chat monitoring: When the protection of children becomes a justification for surveillance
The EU Kids Act is, by the way, not the only European legislative initiative where the protection of children is used as a justification for far-reaching intrusions into digital privacy.
For years, there has been discussion at the European level about so-called chat monitoring. Officially, it is about detecting depictions of sexualized violence against children and combating the contact of adults with minors with abuse intentions, known as grooming.
That such crimes are pursued and children must be protected is something I do not question.
But does that actually justify systematically searching private communication for suspicious content?
And what does such surveillance mean for the security of our communication?
A general suspicion against millions of people
When it comes to chat monitoring, one must distinguish between the different legislative proposals. Not every proposal includes the same surveillance measures.
The extended transitional regulation from July 2026 still allows certain providers to voluntarily detect such content. End-to-end encrypted messages are excluded from this regulation. It is valid for now until April 3, 2028.
In addition, there is ongoing discussion about a permanent European regulation. The question of which recognition obligations should be permissible in the future and how private communication confidentiality should be protected is controversial.
I find the idea of unannounced searches of private messages particularly problematic.
Who automatically checks all messages treats communication as potentially suspicious from the beginning. And this is regardless of whether there is actually a concrete suspicion against the involved persons.
Of course, automated checking is not the same as a police officer who reads every single message personally.
But even a machine analysis is an intrusion into the confidentiality of communication. Especially when content is compared with databases, evaluated, or reported to other places in case of a match.
This is compounded by the problem of possible false alarms.
What happens if a harmless family photo is mistakenly classified as suspicious? Or if an automated system tears a message out of its context?
Such errors can have significant consequences for innocent people.
A backdoor is not reserved for the good
For me, the discussion about encrypted communication is even more serious.
End-to-end encryption ensures that messages can generally only be read by the involved communication partners.
Even the operator of a messaging service can usually not decrypt the content with correctly implemented end-to-end encryption.
This is not a luxury for people who have something to hide. It is a fundamental security feature.
We use encrypted communication to exchange private photos, have confidential conversations, or send personal information.
Journalists, lawyers, doctors, and companies also rely on confidential communication.
Whoever deliberately weakens this encryption or installs backdoors does not simply create an exclusive access for state investigative authorities.
A security flaw does not distinguish between an investigator, a criminal, and a foreign intelligence service.
Of course, one could try to secure such access technically. But every additional access path increases the attack surface. Keys can be stolen, systems can be compromised, and permissions can be abused.
An access that is exclusively used by the good cannot be simply guaranteed by law.
Surveillance before encryption is also not a convincing solution
A frequently discussed alternative is the so-called client-side scanning.
Here, messages or files are examined already on the end device before they are encrypted and sent.
The actual encryption does not need to be broken for this.
This initially sounds like an elegant technical solution. After all, the message remains encrypted during transmission.
However, something crucial is overlooked.
If my smartphone checks the content of a private message before sending and may report it, it helps me little that the message is then encrypted and transmitted.
Confidentiality was already limited before encryption.
In addition, a technical infrastructure is created that can analyze content on users’ devices.
Today, it may be used to recognize known abuse content. But who guarantees that such systems will not be used to search for other content in the future?
Politically undesirable statements? Copyright-protected files? Certain images or documents?
I am not claiming that such extensions are already planned.
But if the technical possibility exists, their use for other purposes becomes at least conceivable. That is why such systems must be critically examined.
And does that actually protect the children?
In all the discussions about technical surveillance, a question surprisingly quickly moves into the background.
How effective are these measures really?
Someone who commits serious crimes and wants to avoid detection can switch to other communication channels. Even operated servers, alternative software, or additional encryption methods cannot be simply eliminated by regulating large platform operators.
The general population would continue to use the regulated services and thus possibly fall under additional control of their communication.
This does not mean that technical detection is entirely useless. Finding already known abuse content can support investigations and help to curb the further spread of such content.
But this does not automatically mean that widespread control of private messages is necessary or proportionate.
Why don’t we invest more in specialized investigative agencies, international cooperation, the consistent removal of known abuse content, and concrete support offers for affected children?
Why is it always discussed again to limit the confidentiality of communication of millions of innocent people?
Children need security. And that includes encryption.
What is often forgotten in this debate: Children and teenagers also benefit from secure, encrypted communication.
They exchange personal information, talk about problems, and may turn to people they trust.
Children who are affected by violence or abuse can rely on confidential communication options.
Weakening encryption can therefore endanger exactly those people who we want to protect.
For me, the discussion about chat control thus shows a similar fundamental problem as the EU Kids Act.
A legitimate protection goal becomes the starting point for measures whose effects go far beyond the actual target group.
With the Kids Act, it’s age verification and access restrictions. With chat control, it’s the possible systematic investigation of private communication.
Both initiatives are legally and technically different. They should therefore not be confused with each other.
But both raise the same fundamental question:
How much freedom and privacy must people give up in order for the state to promise them more security?
For me, it is clear: The protection of children must not be used as a blanket justification for weakening fundamental security mechanisms of our digital communication.
Because an insecure communication does not protect anyone in the end. Not even children.
Further Articles on Christian’s Blog
I have already dealt with the risks of state surveillance and the European plans for controlling private communication on several occasions.
In my article Chatkontrolle 1.0 und 2.0 – What is actually planned and what is currently being debated from July 13, 2026, I explain the differences between the existing voluntary detection of abuse content and the discussed mandatory measures. I also address technical problems, the effectiveness of such controls, and possible alternatives.
Already on September 10, 2025, I dealt critically with the surveillance plans in the contribution Chatkontrolle 2.0 . The focus there is on the dangers to end-to-end encryption, the so-called client-side scanning, and the effects on our digital fundamental rights.
Both articles illustrate why the protection of children and the security of private communication must not be pitted against each other.
My Conclusion: The platforms must change, not just their users
I think it is correct that the European Union wants to take action against problematic mechanisms of social networks.
Children and teenagers must be protected from harassment, manipulation, and dangerous content. Platform operators must not hide behind their terms of service.
But I think it is the wrong focus to organize the protection of minors mainly through rigid age limits and technical access controls.
A much more sensible approach would be to consistently require platforms to design their offerings in a way that causes as few risks as possible.
Why must we accept that social networks work with mechanisms that keep people attached to their screens for as long as possible?
Why should children only be excluded from these offerings, instead of eliminating the problematic features?
And why must adults in the future possibly provide additional age proofs, just because platform operators have not sufficiently secured their offerings so far?
The EU Kids Act contains several approaches that are moving in the right direction. Especially the restriction of manipulative recommendation mechanisms and the stronger responsibility of providers are to be welcomed.
However, these sensible proposals do not automatically justify every additional access restriction.
Child protection must not lead to creating an increasingly controlled digital environment, while the economic interests of platform operators remain largely untouched.
Therefore, the European Union should thoroughly revise the draft before it becomes binding law.
Not less child protection is the goal, but a better one.
One that actually protects children, does not unnecessarily disempower parents, and respects the fundamental rights of adult internet users.
Because in the end, people should not have to adapt to the problematic business models of social networks.
The platforms should adapt to the needs of people.
Sources and Further Information
- European Commission: EU Kids Act, Regulation proposal COM(2026) 681 final from September 17, 2026: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM:2026:681:FIN
- European Commission: Information on the EU Kids Act: https://commission.europa.eu/news-and-media/news/eu-kids-act-helping-children-navigate-safer-online-world-2026-09-17_en
- European Commission: European approach to age verification: https://digital-strategy.ec.europa.eu/en/policies/eu-age-verification
- c’t Data Protection Podcast „Auslegungssache“, episode 170 from October 16, 2026: „Dangerous Forgeries – How Deepfakes Challenge the Law“: https://ct-auslegungssache.podigee.io/170-gefahrliche-falschungen-wie-deepfakes-das-recht-herausfordern
Note: The EU Kids Act is still in the legislative process. Until December 3, 2026, citizens can submit opinions to the European Commission on the proposal.
