KIDS Act

1. Providers of online social networking services and of video-sharing platform services shall not allow a natural person below the age of 15 years to create an account with that service or to access that service by means of an account, created for, or attributed to, that person, where the service poses a risk to the privacy, safety or security of a minor below that age.

A service shall be considered to pose a risk to the privacy, safety or security of minors below 15 years of age where it meets any of the following conditions:

(d) enables recipients who access the service through an account to transmit content in real-time to an indeterminate number of other recipients of the service, including through live streaming of audio-visual content;

(e) enables recipients who access the service through an account to contact, communicate and otherwise interact with other recipients of the service not part of the recipient’s pre-existing connections or subscriptions;

(f) uses a recommender system which is based on profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679;

(g) uses a recommender system suggesting or prioritising to a recipient who accesses the service through an account contact suggestions or information that has not been provided by one of the recipient’s pre-existing connections or subscriptions;

(h) deploys or presents functionalities, interface designs or characteristics which are intended, or can reasonably be foreseen, to enable uninterrupted content consumption, that incentivise interactions with the service or with content or other recipients of the service, or that transmit automated notifications designed to prompt the user to initiate or resume use of the service.

2. By way of derogation from paragraph 1, providers of online social networking services and video-sharing platform services may allow guardians to set up accounts for minors above the age of 13 years and below the age of 15 years with limited features so as to allow them to access the service by means of such a limited account. Such accounts shall meet at least the following conditions

(a) the tools for guardians provided for in Article 20 shall always be activated;

(b) guardians are enabled to set a maximum limit on the amount of time in a day the service or system may be accessed through that account, which shall not exceed one hour per day;

(c) guardians are enabled to pre-approve potential new contacts and to set a maximum limit on the number of other recipients or users in the account’s contacts.

3. When creating an account for a minor pursuant to paragraph 2 of this Article, the provider of online social networking services and of video-sharing platform services shall take measures to establish whether the person creating the account is the holder of parental responsibility over that minor in accordance with Article 26 and verify that the recipient of the service has reached the age of 13 years in accordance with Article 28(1).

4. Providers of services falling within scope of paragraph 1 of this Article shall by 6 months after the entry into application of this Regulation establish whether the holders of existing accounts used to access their service are below the age of 15 years. Where holders of existing accounts are established to be below 15 years, providers of services concerned shall disable the accounts of the recipients or users of the service that have been established to be below that age or in relation to whom the age cannot be established.

5. Where providers of services falling within scope of paragraph 1 process personal data pursuant to Article 6(1), point (a) of Regulation (EU) 2016/679, the provisions set out in this Article should apply in parallel to the age limits provided in Article 8 of that Regulation.

6. The Commission may adopt delegated acts, in accordance with Article 40, in order to amend this Regulation by modifying and complementing the conditions in paragraph 1 of this Article, to include new features and functionalities or changes to existing features or functionalities that pose a risk to minor’s privacy, safety, and security online equivalent to the risks posed by the conditions set out in paragraph 1 of this Article.

1. Providers of video-sharing platform services whose service is specifically designed for minors below the age of 13 years may exceptionally enable a guardian to allow a minor below the age of 13 years limited access to the service through the guardian’s own account, where all of the following conditions are met:
   1. such guardian-controlled access shall take place exclusively through the guardian’s own account, and no account shall be created for, or attributed to, the minor;
   2. such access shall be enabled and controlled by means of the tools for guardians referred to in Article 20 or other parental control settings in the guardian’s account or on the guardian’s device;
   3. the provider expressly permits, in its terms and conditions, access by minors below the age of 13 years, clearly specifying therein the age range of minors for whom access is permitted subject to guardians’ approval;
   4. the provider has carried out and published, in at least one official language of a Member State and in a publicly available section of its online interface, an assessment of the impact of the service, or of the relevant parts thereof, on minors within the specified age range, assessing the risks and demonstrating, if applicable, how any such risks have been effectively mitigated taking into account the relevant age groups. Compliance with the requirements set out in Chapter III shall not automatically entail effective mitigation of such risks;
   5. the provider has set out, in a clear and transparent manner in a publicly available section of its online interface, which content or behaviour is considered as not age-appropriate or harmful to the privacy, safety and security of minors within the specified age range on the service;
   6. access to the content identified pursuant to point (e) shall not be granted to minors below the age of 13 years;
   7. the available features and functionalities are adapted, and gradually adjusted, to the age of the minor declared pursuant to paragraph 4, point (b);
   8. all personalisation features and recommender systems, and any functionality to search for content shared by other recipients of the service, are turned off and cannot be activated, unless the assessment referred to in point (d) demonstrates that their activation is in the best interests of the minor and does not in any way negatively affect the minor’s privacy, safety and security.
2. Nothing in this Article shall be construed as requiring a provider to permit access by minors below the age of 13 years, or as conferring on any minor or guardian a right of access to a service whose terms and conditions do not permit such access or where access to the service is subject to a higher minimum age under EU law or national law in compliance with EU law.
3. The account through which guardian-controlled access pursuant to paragraph 1 is provided shall be set up, registered and held exclusively by the guardian. The minor accessing the service through the guardian’s account shall not be a party to the contract with the provider. The provider shall take measures to establish that the guardian enabling access pursuant to paragraph 1 is the holder of parental responsibility in respect of the minor concerned, in accordance with Article 26.
4. The design and functioning of the guardian-controlled access provided pursuant to this Article shall not disproportionately restrict the minor’s privacy and shall support the minor’s autonomy and agency, in accordance with the minor’s evolving capacities. The guardian-controlled access provided pursuant to this Article shall meet at least the following conditions:
   1. the tools for guardians provided for in Article 20 shall be activated by default;
   2. the guardian shall declare the age of the minor for whom access is enabled and such access shall not be enabled for a minor below the age of 3 years;
   3. the guardian shall be able to set a maximum daily duration of access by the minor, which shall not exceed one hour;
   4. the guardian shall be able to supervise the content displayed or recommended to the minor, taking into account the minor’s right to privacy and taking the minor’s best interests as a primary consideration;
   5. the guardian shall be able to approve, limit and remove any other recipients of the service with whom the minor may interact through the guardian’s account;
   6. the guardian shall be able to suspend the minor’s access at any time.
5. Guardian-controlled access pursuant to this Article shall be discontinued when the minor reaches the age of 13 years, to be determined on the basis of the age declared pursuant to paragraph 4, point (b) of this Article. This shall be without prejudice to the creation of an account pursuant to Article 5(2) where the conditions of that Article are met.
6. The Commission may adopt delegated acts in accordance with Article 40 in order to amend this Regulation by adapting to technological and scientific developments the conditions set out in paragraphs 1 and 4, where such changes maintain a level of protection of the minor’s privacy, safety, and security online equivalent to that provided by the conditions set out in paragraphs 1 and 4 of this Article.