7 min read
Explained
Published:
22 Sept 2026
Last updated:
22 Sept 2026
The European Commission’s new “EU KIDS Act” presents sweeping restrictions to protect minors
TL;DR:
The European Commission (EC) has published the draft EU KIDS Act, which introduces gradual age restrictions and safety-by-design obligations, alongside safety requirements directly targeting video game companies.
“Proposal for EU KIDS Act - 'EU Keeping Internet Digital Spaces Accountable and Trustworthy'”
The overly-creatively titled Act could (if adopted) place significant obligations on video games companies operating in the EU. This article briefly summarises the main obligations targeting video game companies; if you want deeper analysis or tailored advice and support, get in touch, and we’d be happy to discuss how our expertise can meet your needs. Even if you’re just curious about it all, we'd love to chat.
What’s just happened and why?
The European Commission has published their proposal for new EU-wide laws to address how to keep kids safe in online spaces. It’s the start of the formal legislative process, so still needs to be considered by Member States and the Parliament, but it lays down a clear marker about where things might be headed.
It follows the increasing pressure to adopt stronger protections for minors online, including recent developments across Member States such as France, Italy, Norway and Greece, which are developing their own draft legislation.
In July, the EU Special Panel on Child Safety Online recommended a “safety-by-design approach” requiring ‘social media plus’ platforms to prove they are safe before being accessed by children (Check our article on the report here). The approach and the recommendations have set the tone for the Act.
What does the EU KIDS Act propose?
Scope and definitions
The KIDS Act creates a harmonised EU approach covering: social-networking services, video-sharing platforms, online games, software application stores and certain AI systems
“Online games” is a broad term, covering both “video game” and “video-gaming platforms”. A video game is “an information society service that allows users to interact through an application, locally or remotely, and generate visual feedback in a simulated environment for play or entertainment,” which may be unwieldy but it consistent with other bits of legislation.
It’s not tied to a particular device or business model and is intended to cover games played across PCs, mobile devices and consoles. Video gaming platforms have been defined in terms of the Digital Services Act (DSA).
Age restrictions
Social media and video-sharing platforms have a set of obligations that allow them to offer different levels of access to under-13s, 13-15s, and 15-18s, if they put in the right safeguards and restrictions under a dedicated safety-by-design framework.
Games don’t have a default minimum age, but must provide a high level of privacy, safety and security for minors, even where the game can be accessed without an account.
The Act mandates the use of video game age-ratings (PEGI seems likely to satisfy the requirements), both for them to be displayed and for online stores to enforce them by prohibiting users from accessing games rated for a higher age.
Safety by design
The safety-by-design provision applies to all in-scope services, including games: services must be designed safely for minors by default, and providers may only eliminate these safety requirements after establishing that the user is an adult.
Video games must assume that all users are minors and apply these safety-by-design protections, until they have identified that a user is an adult through age assurance (or prove with a “high degree of confidence” that the user is not a minor – possibly the “if your account is 18, you probably are” approach).
The framework requires online games providers to:
Prevent compulsive or excessive use by restricting certain engagement mechanics, reward structures, penalty systems, and features that make it hard for kids to stop playing
Apply high default privacy and security settings (such as turning off geo-location by default)
Prevent unknown users contacting minors by prohibiting kids from being included in contact recommendations and being included in groups unless through explicit consent
Provide tools for parents to enable and control access for under-13s
For platforms, implement the necessary technical and organisational requirements to enable content creators to comply with child safety measures.
The contact-related element is one of the most important and will mean that video game companies will have to implement safeguards to limit kids’ exposure. This is particularly relevant to games incorporating communication, social features, or links to external services.
Restrictions on compulsive/excessive use could restrict loot boxes and virtual currencies, although this is less clear. Social media sites and AI chatbots are required to use fiat currency statements and prohibit access to loot boxes, but this isn’t applied to video games. This could indicate that the Digital Fairness Act will cover it, or reflect that the requirement to have age ratings enforced will have the same effect.
Enforcement and legal representatives
Where a video game platform falls within the scope of the DSA, they will remain subject to the DSA’s supervisory architecture, while Member States have responsibility for supervising video games and enforcing game-specific requirements. Companies will need to designate a legal representative in one of the Member States (unless they have one already under the DSA or AI Act).
Age assurance and privacy
Age assurance is the mechanism through which the safety-by-design obligations and the under-13 guardian-controlled access requirements can be implemented. While social media platforms must rely on specific EU age-verification solutions, providers of online games may use other age-assurance solutions as long as they comply with data protection, anti-circumvention, and tracking requirements stablish in the Act.
What does it mean for the games industry?
The Act proposes a wide set of obligations which will have a significant impact on game design, monetisation, and operations, where games are accessible to minors.
The biggest impact is from age verification requirements, which will apply to a broad range of circumstances. To effectively comply with the Act, companies will need to either assume that all their players are minors and apply safety-by-design obligations across their entire player base, or implement age assurance to allow adult players access to all features. While age assurance requirements may be more flexible for video game companies compared to those applicable to social media, this does not eliminate the practical and economic challenges of implementing these systems according to the requirements of the Act.
The prospect of applying mandatory age assurance to every game and player across Europe has raised serious concerns within the video game industry. Video Games Europe has stated that new regulations should instead align with the risk-based approach outlined in the DSA guidelines on the protection of minors.
Under the safety-by-design requirements, companies will have to adopt child safety protections directly into their games from the early design stages, rather than fully relying on parental controls or age ratings. Although the most obvious impact is on games with communication features, other elements will also be affected. Restrictions on engagement mechanics, rewards, and notifications, can directly affect monetisation and retention techniques. For example, daily streaks, engagement rewards, and re-engagement notifications are likely to be considered elements that encourage compulsive use among minors – developers wanting to continue using these for adult players will need to age verify their players, adding cost and complexity.
Finally, the Act’s obligations suggest that compliance will require additional effort from the industry to coordinate with authorities and interested parties to draft codes of conduct supporting compliance with the rules. Companies will also need to ensure their games provide all the necessary information and content disclosures to be properly age-classified across app stores.
What’s next?
The proposed text will now be reviewed and negotiated by the European Parliament and the Council of the EU. While the Commission anticipates a swift legislative process, negotiations are expected to take anywhere from 8 to 24 months (we love a bit of temporal uncertainty). During the legislative process, the final obligations may change, including the provisions that are particularly relevant to video games. Once the Act is adopted, the Commission is also expected to develop the implementation framework and industry stakeholders will have the opportunity to participate in the development of the codes of conduct.
For this reason, video game companies are recommended to follow the development of this framework closely. In particular, companies should monitor potential changes regarding age assurance, safety-by-design, monetisation, and parental controls, as these areas are likely to have a direct impact on the industry.
Additionally, the EC has announced the publication of additional frameworks such as the DFA, the revision of the CPC Regulation on cross-border enforcement, and an Action plan on protecting children from crime, which can expand on the context of the obligations applicable to video game companies.
How can Flux help me?
Child safety has become a top priority for governments and regulators, and we specialise in helping companies to navigate these complex topics. Whether you need us to monitor upcoming developments regarding this new piece of legislation, provide a tailored analysis of the implications of the new measures for your business, or a prepare a report comparing the proposals introduced across different jurisdictions, we’ve got you covered.
Even if you just want to talk this through and understand what it means for your pipeline, feel free to reach out. We’re always happy to chat.
Author: Veronica Perez, Policy Advisor