On 14 September 2026, the European Commission unveiled its proposal for the EU Kids Act. The proposal introduces safety-by-design obligations and age-verification thresholds for online services targeting minors, potentially reshaping their data-collection practices. Digital platforms offering services to children will need to implement age-assurance mechanisms, signalling tighter EU scrutiny of privacy risks linked to age verification.

Full News Breakdown

The European Commission's proposal for the EU Kids Act emerged from escalating concerns over children’s safety on digital platforms, prompting a legislative initiative that seeks to balance child-protection goals against existing data-privacy frameworks. After extensive deliberation on these competing interests, the Commission released a draft legislative package.

• Date: September 14, 2026

• EU Instruments Cited: Proposed EU Kids Act, General Data Protection Regulation (GDPR), Digital Services Act (DSA)

• Key Provisions: The proposal mandates safety-by-design obligations and age-verification thresholds for online services. It requires digital platforms offering services to children to implement age-assurance mechanisms.

• Primary Legal Issue: The central challenge involves reconciling enhanced child protection online with the fundamental right to data privacy, particularly concerning the collection and processing of personal data for age verification.

• Practical Outcome: The initiative is expected to combine proactive safety measures, such as integrated safety features and age limits, while simultaneously raising complex questions regarding the privacy implications of robust age-assurance technologies.

How Does This Affect You?

Before this proposal, online service providers faced a degree of uncertainty regarding the specific technical and organizational measures required to adequately protect minors, often navigating a patchwork of general data protection principles and voluntary industry standards. The proposed EU Kids Act specifically resolves this by outlining mandatory safety-by-design obligations and age-verification thresholds, moving beyond general principles to concrete requirements. This shift means that platforms must now proactively integrate child protection into their core design and operational processes, rather than treating it as an ancillary compliance concern, leading to increased scrutiny of data collection practices. The following sections detail the implications for legal professionals, students, and businesses.

For Lawyers & Advocates

• Advise clients on conducting comprehensive data protection impact assessments (DPIAs) under GDPR Article 35 specifically for services accessible to minors, focusing on the proportionality and necessity of age-assurance mechanisms and their potential impact on children's data.

• Revise existing privacy policies, terms of service, and consent mechanisms to explicitly address the new safety-by-design obligations and age-verification requirements, ensuring clear communication regarding data processing for age assurance and parental consent, as mandated by the proposed EU Kids Act.

• Prepare for potential regulatory enforcement actions or challenges concerning the effectiveness and privacy implications of age-assurance technologies, leveraging precedents from national data protection authorities regarding data minimization and purpose limitation under the Regulation.

• Evaluate the strategic implications of the proposed legislation for UK-based clients, particularly how the EU Kids Act might influence future amendments to the UK Age Appropriate Design Code (Children's Code) or create new cross-border compliance complexities for services operating in both jurisdictions.

For Law Students

This case teaches about the European Union's evolving regulatory philosophy, which increasingly prioritizes the protection of vulnerable groups by mandating proactive design principles rather than relying solely on post-hoc enforcement. The core legal doctrine students should focus on is the tension between the fundamental right to data protection, enshrined in GDPR, and the imperative of child protection, as articulated in the proposed EU Kids Act.

The decision is particularly relevant for the study of:

• EU Digital Law

• Data Protection and Privacy Law

• Fundamental Rights in the Digital Age

• Regulatory Governance

• Consumer Protection Law

Comparing this judgment with Scherms II (CJEU, 2020), which underscored the strict interpretation of data transfer mechanisms, and Google Spain (CJEU, 2014), concerning the right to be forgotten, illuminates how the Court balances individual rights against broader public interests and the practical challenges of enforcing digital rights across borders.

For Businesses

• Board-level executives must initiate a strategic review of all digital products and services accessible to minors, assessing their current design against the anticipated safety-by-design obligations of the proposed EU Kids Act to avoid significant compliance costs and potential market access restrictions.

• Implement robust internal data governance frameworks and technological solutions for age assurance, ensuring that any data collected for verification purposes is strictly minimized, securely stored, and processed in full compliance with the General Data Protection Regulation.

• Re-evaluate business models reliant on targeted advertising or personalized content delivery to minors, as the new legislation is likely to impose stringent restrictions on such practices, necessitating a pivot towards alternative, privacy-preserving monetization strategies.

Key Takeaways

• The EU is formalizing a "child-first" approach in digital services, mandating proactive

Source: Tech companies await EU's ‘Kids Act’ plan to protect children online