{"id":21213,"date":"2026-10-30T12:52:16","date_gmt":"2026-10-30T10:52:16","guid":{"rendered":"https:\/\/www.kyprianou.com\/?p=21213"},"modified":"2026-10-30T13:05:32","modified_gmt":"2026-10-30T11:05:32","slug":"the-eu-kids-act-age-verification-is-only-beginning","status":"publish","type":"post","link":"https:\/\/www.kyprianou.com\/el\/the-eu-kids-act-age-verification-is-only-beginning\/","title":{"rendered":"The EU KIDS Act: Age Verification is Only the Beginning"},"content":{"rendered":"

The EU Shifts Towards Mandatory Age Assurance \u00a0<\/strong><\/p>\n

The European Commission\u2019s proposal for the EU Keeping Internet Digital Spaces Accountable and Trustworthy Act (the \u201cEU KIDS Act<\/strong>\u201d), marks a significant step towards a harmonised European framework for protecting minors online. The proposal combines EU-wide restrictions on access to certain services with requirements for age assurance and safety by design. Its scope extents beyond conventional social media to include online games, software application stored, AI companions and general conversational chatbots. The EU Kids Act is designed to specify and complement the existing obligations on providers of online platforms under Article 28 of the Digital Services Act (Regulation (EU) 2022\/2065)<\/a> (the \u201cDSA<\/strong>\u201d) and the AI Act (Regulation (EU) 2024\/1689)<\/a>.<\/p>\n

The proposed framework reflects the Commission\u2019s position that protecting children requires more than establishing minimum ages for accessing digital services. It also requires providers to consider how their services are designed and operated, including the safeguards available to younger users. Age assurance and safety by design are therefore complementary elements of the proposed regime. The difficult question for providers, however, may not simply be how age is verified, but what happens after that service establishes that the user is a minor.<\/p>\n

Age Verification in Practice: Privacy and Proportionality <\/strong><\/p>\n

The EU KIDS Act proposal seeks to establish reliable age assurance rather than allow providers to rely solely on users declaring their own age. Under Article 27, age assurance solutions must meet high standards of accuracy, reliability, security, robustness, non-intrusiveness, privacy, data protection and not discrimination. Self-declaration is not sufficient to satisfy the proposal\u2019s requirements. The proposal distinguishes between age verification and the broader concept of age assurance. Age verification establishes whether an individual has reached a particular age threshold, while age assurance encompasses the wider range of methods used to assess age. The appropriate method depends on the obligation being fulfilled.<\/p>\n

For services covered by the proposed access restrictions in Article 6, providers would be required to use an EU age verification solution based on an EU proof of age attestation supplied by a third party and conforming to the EU Age Verification Scheme. For safety by design obligations under Chapter III, providers may use age verification or other age assurance methods, subject to the proposal\u2019s conditions.<\/p>\n

Privacy is central to this framework. Article 28 provides that age assurance solutions must not enable the identification, tracking, targeting, advertising to or profiling of recipients. Providers must also avoid processing more personal data than is strictly necessary to assess whether the relevant age threshold has been met.\u00a0 The proposal requires age assurance measures to use state of the art technology and to be based on zero knowledge proof.<\/p>\n

These requirements reflect an important practical distinction, as knowing whether somebody satisfies and age threshold does not necessarily require knowing who that person is. The challenge for providers is to establish age reliably without collecting or retaining unnecessary identity information. Effective verification and data minimisation must therefore be addressed together rather than treating privacy as a secondary consideration.<\/p>\n

Verification is Only the Gateway: Safety by Design<\/strong><\/p>\n

Once a platform establishes that the user is a minor, a second compliance question arises. Does the service itself need to operate differently by user? Under Article 8, providers of the services and systems covered by Chapter III must ensure a high level of privacy, safety and security for minors and implement the chapter\u2019s requirements by default. These requirements apply to:<\/p>\n