KIDS Act

This Regulation contributes to the proper functioning of the internal market and ensures a high level of protection for minors online in the Union by setting out harmonised rules for a safe and empowering online environment for minors, including the principle of consumer protection. It specifies and complements Regulation (EU) 2022/2065, and complements Regulation (EU) 2024/1689. In particular, this Regulation establishes:

1. a harmonised minimum age for creating an account with online social networking services and video-sharing platform services;
2. harmonised safety requirements for online social networking services, video-sharing platform services, video gaming platforms, and software application stores and harmonised safety requirements to protect minors online for video games, AI companions and general conversational chatbots;
3. harmonised rules regarding age assurance online.

1. This Regulation applies to providers of the following services or systems accessible to minors:
   1. online social networking services;
   2. video-sharing platform services;
   3. software application stores
   4. online games;
   5. operating systems;
   6. AI companions;
   7. general conversational chatbots.
2. For the services referred to in paragraph 1 points (a) to (e), this Regulation applies to providers of services irrespective of where they have their place of establishment where they offer those services to recipients of the service that have their place of establishment or are located in the Union.
3. For the AI systems referred to in paragraph 1 points (f) and (g), this Regulation applies to providers placing on the market or putting into service such AI systems in the Union, irrespective of where those providers are established or located.
4. This Regulation does not apply to the providers of any of the following:
   1. not-for-profit online encyclopaedias;
   2. not-for-profit educational and scientific repositories;
   3. services and systems that are designed for primarily educational purposes, and operated by educational establishments or organisations, or on their behalf;
   4. open-source software-developing and-sharing platforms, unless the platform itself constitutes an AI system in scope of this Regulation or Regulation (EU) 2024/1689;
   5. services and systems specifically developed and operated for the sole purpose of scientific research and development;
   6. services and systems designed, developed and operated by public authorities and for exclusive use of those public authorities or on their behalf.
5. Where justified in view of the potential risks to the privacy, safety and security of minors posed by a service or a system or where a service or a system poses such a risk that is equivalent to, or lesser than, the risks posed by the services or systems already referred to in paragraph 4, the Commission is empowered to adopt delegated acts in accordance with Article 40 to amend paragraph 4 of this Article by adding other types of services or systems to the list of exempted services or systems or removing services or systems from that list.
6. Providers of online social networking services, video-sharing platform services, and video gaming platforms subject to Article 28(1) of Regulation (EU) 2022/2065 that comply with the obligations laid down in this Regulation shall be deemed to comply with that Article for matters covered by this Regulation, including as regards AI systems that are deployed as a functionality of online platforms in scope of Article 28(1) of Regulation (EU) 2022/2065 in the provision of that service.
7. This Regulation is without prejudice to the rules laid down by other Union legal acts regulating other aspects of the provision of intermediary services and Union legislation applicable to AI systems in the internal market, including the following:
   1. Directive 2010/13/EU;
   2. Union law on consumer protection and product safety, including, Directives 2005/29/EC, 2011/83/EU, (EU) 2019/770, Council Directive 93/13/EEC, and Regulations (EU) 2019/1020, (EU) 2023/988 and (EU) 2024/1689;
   3. Union law on the protection of personal data, in particular Regulation (EU) 2016/679 and Directive 2002/58/EC;
   4. Directive (EU) 2024/1385.

1. For the purposes of this Regulation, the definitions of ‘online platform’, ‘recipient of the service’, ‘online interface’, ‘recommender system’ set out in Article 3 of Regulation (EU) 2022/2065 shall apply.
2. For the purposes of this Regulation, the definitions of ‘online social networking service’, ‘video-sharing platform service’, and ‘software application store’ set out in Article 2 of Regulation (EU) 2022/1925 shall apply. Those services shall be considered an ‘online platform’ within the meaning of Article 3, point (i), of Regulation (EU) 2022/2065 for the purpose of this Regulation.
3. For the purposes of this Regulation, the definitions of ‘AI system’ and ‘general-purpose AI system’ offset out in Regulation (EU) 2024/1689 shall apply; the definition of ‘provider’ as defined in Article 3 point (3) of that Regulation shall apply with regard to AI systems regulated by this Regulation.
4. For the purposes of this Regulation, the definition of ‘operating system’ set out in Article 2, point (1), of Regulation (EU) 2022/1925 shall apply.
5. For the purposes of this Regulation, the following additional definitions shall apply:
   1. ‘minor’ or ‘child’ means any natural person under the age of 18;
   2. ‘guardian’ means any person holding parental responsibility over a minor pursuant to applicable national law;
   3. ‘AI companion’ means an AI system, including a general-purpose AI system, that provides sustained, personalised interaction or companionship which simulates or facilitates a social, emotional or interpersonal relationship with a user;
   4. ‘general conversational chatbot’ means a general-purpose AI system with general conversational functionalities for direct interaction with users that is capable of providing assistance across multiple domains and tasks; this definition excludes AI systems whose conversational functionality is limited to a specialised service, task or pre-defined set of functions, including specialised customer-service, business operation, technical-support, transactional, educational, information-retrieval, industrial or manufacturing AI applications;
   5. ‘online games’ means a video game or video gaming platform;
   6. ‘video game’ means an information society service as defined in Article 1(1), point (b), of Directive (EU) 2015/1535, that allows the recipients of the service to engage, by means of application accessed locally or remotely, including through the use of a durable medium and that involves interaction with a user interface or input device to generate visual feedback from a display device in a simulated environment for play or entertainment purposes;
   7. ‘video gaming platform’ means an “online platform” as defined in Article 3, point (i) of Regulation (EU) 2022/2065, that involves interaction with a user interface or input device to generate visual feedback from a display device in a simulated environment [for play or entertainment purposes];
   8. ‘age verification’ means a process or system for establishing, with a high degree of certainty, whether the recipient or user of a system of the service has attained a specific age or age threshold, on the basis of information derived from identification documents or other reliable, verified sources of identification;
   9. ‘age assurance’ means the set of methods, that can be used to determine, estimate or verify the age of a natural person, encompassing age estimation and age verification and excluding self-declaration by recipients of the service;
   10. ‘age signal’ means any data, attribute, token, credential, or other information provided, transmitted, or generated for the purpose of establishing, verifying, or demonstrating a specific age, age threshold, or age range of an individual;
   11. ‘EU age verification solution’ means an age verification solution that meets the requirements of the EU Age Verification Scheme and is certified by a public authority and included in the EU list of EU age verification solutions after notification by a Member State;
   12. ‘EU list of providers of EU proof of age attestations’ means the list established and published by the Commission of providers issuing EU proof of age attestations
   13. ‘EU list of EU age verification solutions’ means the list established and published by the Commission of EU age verification solutions certified as conforming with the EU Age Verification Scheme and notified by Member States;
   14. ‘EU Age Verification Scheme’ means a scheme for the attestation of attributes as defined in Article 2(4) of Commission implementing Regulation (EU) 2025/1569 with the rules applicable to providers of EU age verification solutions and of EU proof of age attestation, their approval and inclusion in the EU list of providers of EU proof of age attestations and the certification of EU age verification solutions for their inclusion in the EU list of EU age verification solutions;
   15. ‘proof of age attestation’ means an electronic attestation of attributes, as defined in Article 3(44) of Regulation (EU) No 910/2014, that allows the authentication of the fact that its holder meets a given age, age threshold, or age range;
   16. ‘tools for guardians’ means software, features, functionalities, or applications designed to help guardians accompany minors’ online activity to ensure their privacy, safety and well-being.

1. Within 4 months following the notification of the decision designating them as a very large online platform pursuant to Article 33 of Regulation (EU) 2022/2065, the providers of online social networking services and video-sharing platform services that have been designated as a very large online platform pursuant to Article 33 of Regulation (EU) 2022/2065 shall notify to the Commission a compliance plan describing in a detailed manner compliance with the obligations laid down in Chapters II to V of this Regulation.
   For providers referred to in the first sub-paragraph already designated as a very large online platform pursuant to Article 33 of Regulation (EU) 2022/2065, such notification shall occur within 30 days from the date of the entry into application of this Regulation.
   Article 34(3) of Regulation (EU) 2022/2065 shall apply mutatis mutandis to the supporting documents of those notifications.
2. For the purpose of enabling the Commission to assess the compliance of providers referred to in paragraph 1 with the obligations laid down in Chapters II to V, those providers shall, at their own expense, commission an audit of the compliance plan notified pursuant to paragraph 1 by one or more independent auditors. The independent auditors shall have, or shall retain experts with proven expertise in the following areas relevant for the protection of minors:
   1. protection and rights of the child;
   2. paediatric medicine and child psychiatry;
   3. developmental science;
   4. age assurance;
   5. the design of online interfaces and recommender systems;
   6. data protection and security.
3. Article 37(2) and (3) of Regulation (EU) 2022/2065 shall apply mutatis mutandis to the audits carried out pursuant to this Article and to the independent auditors and any experts retained by them. The costs of the audit shall be borne by the provider concerned. These costs shall not exceed market rates for comparable assessments by the auditors.
   The providers referred to in paragraph 1 shall cooperate with the independent auditors and shall grant them access to all information, data, documents and personnel relevant for the performance of the audit.
   Providers shall ensure that any employee or contractor that has communicated with the independent auditor are protected against any adverse action by the provider.
4. The independent auditors commissioned by the provider pursuant to paragraph 2 shall:
   1. assess the compliance plans submitted by the providers pursuant to paragraph 1 in view of the obligations laid down in Chapters II to V;
   2. transmit a draft report to the provider, which may submit comments within 15 days of receipt;
   3. issue a final report, taking into account any comments received pursuant to point (b), simultaneously to the Commission and to the provider, within two months of receipt of the compliance plan, identifying any shortcomings in the compliance measures described therein.
5. The provider concerned shall publish, without undue delay after its receipt, a summary of the final report referred to in paragraph 4, point (c), which shall not contain confidential information.
6. Where the Commission concludes by means of a decision on the basis of the final report referred to in paragraph 4, point (c) that the compliance plan contains shortcomings, the provider concerned shall submit to the Commission and to the independent auditor within 30 days of the receipt of the Commission decision report a corrective action plan identifying one or more corrective measures for each identified shortcoming.
   The provider shall also identify a reasonable period, which shall not be longer than 60 days, for the implementation of each corrective measure in the corrective action plan.
   The independent auditor shall verify the implementation of the corrective measures and shall report thereon to the Commission and to the provider concerned.
7. In assessing the compliance of the providers referred to in paragraph 1 with the obligations laid down in Chapters II to V of this Regulation, the Commission shall be entitled to consider the compliance plan referred to in paragraph 1, the final report referred to in paragraph 4, point (c) and any corrective measures communicated pursuant to paragraph 6 or any other information that the Commission may consider relevant.
8. Neither the final report referred to in paragraph 4, point (c), nor any action or absence thereof by the Commission in relation to that final report or to the compliance plan shall constitute a finding of compliance with the obligations laid down in Chapters II to V of this Regulation, or shall limit the powers of the Commission under this Regulation or under Regulation (EU) 2022/2065.
9. Providers shall, after the first notification pursuant to paragraph 1, report annually on their compliance with the obligations laid down in Chapters II to V of this Regulation as part of their annual risk assessments carried out pursuant to Article 34 of Regulation (EU) 2022/2065.
   Compliance with the obligations laid down in Chapters II to V of this Regulation shall be included in the independent audits carried out pursuant to Article 37 of Regulation (EU) 2022/2065.
10. This Article is without prejudice to the powers of the Commission under this Regulation and under Regulation (EU) 2022/2065, including the power to adopt interim measures.
11. The Commission may adopt implementing acts laying down templates and methodologies for the audits carried out pursuant to this Article. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 39.