KIDS Act

Where providers of services and of systems subject to Chapters II and III implement age assurance solutions in order to fulfil their obligations laid down in this Regulation, they shall ensure that those solutions provide a high level of accuracy, reliability, security, robustness, non-intrusiveness, privacy and data protection, and non-discrimination.

1. Age assurance solutions shall not enable the identification of the recipient nor locate, track, target, advertise to or profile recipients for any purpose.
2. Providers of services and of systems falling within the scope of this Regulation, and any entity acting on behalf or together with such providers in age assurance, shall not maintain, acquire or process more personal data than strictly necessary to assess if the recipient of the service or the user of the system has met the age thresholds laid down in this Regulation, and shall not further process, share or combine this information with any additional data, without prejudice to Article 29(6), and they shall not combine personal data stored or relating to the use of the system with personal data from any other services offered by the provider or from third-party services.
3. Providers of services and of systems falling within the scope of this Regulation, and any entity acting on behalf or together with such providers in age assurance, shall ensure that the measures used are based on state-of-the-art technology. Any age assurance measure shall be zero knowledge proof.
4. By way of derogation from paragraph2, providers referred to in Article 16(4) and Article 8(1) may store, at account level, the age signal that a user has successfully met a specific age threshold under this Regulation, for the sole purpose of avoiding repeated age assurance. Such age signal shall be limited to the minimum information necessary for that purpose.
5. Providers of services and of systems falling within the scope of this Regulation shall take the necessary technical and organisational measures to comply with paragraphs 1, 2, 3 and 4.

1. Providers of services referred to in Article 6 of this Regulation shall put in place age verification solutions to verify, under the conditions set out in this Chapter, whether the recipient of the service has reached the minimum age pursuant to those provisions, or, where applicable, whether the creation of a parental account is necessary.
2. For the purpose of compliance with Article 6 providers referred to in that paragraph shall rely exclusively on an EU age verification solution using an EU proof of age attestation, provided by a third party, certified as conforming with the EU Age Verification Scheme and included in or verifiable against the respective EU lists referred to in Article 30, paragraph 1, point (a) and (b).
3. EU age verification solutions and EU proof of age attestations, shall be certified as conforming with the requirements of the EU Age Verification Scheme, as laid down in accordance with Article 30(2), by a public authority. European Digital Identity Wallets certified pursuant to Article 5c of Regulation (EU) No 910/2014 that comply with the requirements of the EU Age Verification Scheme shall be deemed to be certified in accordance with this paragraph. Providers of EU proof of age attestations and providers of EU age verification solutions shall comply with the requirements of the EU Age Verification Scheme.
4. For the purpose of complying with the obligations of Article 8(1) and Article 16(2) and 16(3), the providers concerned may use age assurance solutions other than the EU age verification solutions referred to in paragraph 2, where they can demonstrate that those solutions meet the requirements laid down in Article 27 and Article 28.
5. Providers of services and of systems referred to in paragraphs 1 and 4 shall ensure that recipients have access to an effective internal complaint-handling mechanism enabling them to lodge, by electronic means and free of charge, complaints against the outcome of the age assurance referred to in those paragraphs, where the recipient considers the outcome of the age assurance to be incorrect. Providers of online platforms, as defined in Article 3 point (i) of Regulation 2022/2065 may for the purpose of compliance with this Article use the complaint-handling mechanism laid down in Article 20 of that Regulation 2022/2065.
6. Where a provider of an operating system has obtained an age signal of a user, and where the age assurance used to obtain this age signal is in compliance with the requirements defined pursuant to Article 27, after obtaining consent of the user, the provider of an operating system shall enable the sharing of the age signal with providers in scope when such age signal of a user is required to comply with this Regulation.

1. The Commission shall maintain:
   1. an EU list of providers of EU proof of age attestations certified in accordance with Article 29(2) and notified by any Member State;
   2. an EU list of EU age verification solutions certified in accordance with Article 29(2) and notified by any Member State.

   The Commission shall publish the EU list and keep it up to date in a secure and machine-readable form.

2. The Commission shall adopt implementing acts laying down the specifications as a basis of the functioning of the EU Age Verification Scheme, including the requirements applicable to EU age verification solutions and to the issuance, presentation and verification of EU proof of age attestations. Such implementing acts shall be limited to what is necessary to ensure the effective, secure, privacy-preserving, interoperable and uniform implementation of Article 29(2) and (3) and shall be based on the principle of data minimisation, purpose limitation, security, technological neutrality and proportionality, and shall ensure interoperability with the European Digital Identity Wallets provided pursuant to Article 5a of Regulation (EU) No 910/2014. Those implementing acts shall specify the detailed technical, organisational, privacy and security requirements applicable to EU proof of age attestations and their providers and for EU age verification solutions and their providers, the evidence and procedures for demonstrating and assessing public authorities, and the specifications of the EU lists referred to in paragraph 1. The implementing acts may also include requirements for a trust mark for age verification solutions. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 40(2).
3. The Commission shall adopt delegated acts, in accordance with Article 39, in order to supplement this regulation by specifying:
   1. the requirements applicable to alternative age assurance solutions as referred to in Article 29(4), including the requirements necessary to demonstrate compliance with Article 27 and Article 28. Those delegated acts shall specify the detailed technical, organisational, privacy and security requirements applicable;
   2. the obligations applicable to operating systems as referred to in Article 29(6), including the requirements necessary to ensure the secure, privacy-preserving and interoperable sharing of age signals.

1. Member States shall establish at least one privacy-preserving electronic means by which a guardian can obtain and present an attestation of parental responsibility in respect of a minor, for the purposes of Article 26(1), point (a), and of the exercise of the tools for guardians referred to in Article 20. Such means shall be:
   1. be based on authentic sources established under national law;
   2. be free of charge for the guardian;
   3. not entail making any information on parental responsibility accessible to providers or to the public beyond the confirmation that parental responsibility exists.
2. Member States shall ensure that privacy-preserving electronic means referred to in paragraph 1 are effectively accessible to all citizens and guardians and minors residing in their territory, including persons with disabilities, persons with limited digital access or skills, and persons in vulnerable situations such as refugee and displaced families.
3. Member States shall provide for appropriate alternative procedures where parental responsibility cannot be demonstrated through standard civil status documentation.
4. Member States shall take the necessary measures to ensure the availability of means of obtaining a proof of age attestation to verify the minimum age set out in this Regulation.
5. Member States shall take the necessary measures to ensure the availability for citizens and residents, free of charge, of at least one EU age verification solution as certified in accordance with Article 29(3) to verify the age thresholds set out in this Regulation.
6. Member States shall ensure that public authorities can be accredited for the purposes of Article 29(3) and shall communicate to the Commission the names and addresses of the public authorities designated and accredited in their territory, as well as any subsequent changes thereto. The Commission shall make that information publicly available.
7. Member States shall notify to the Commission, without undue delay, the EU age verification solutions and EU proof of age attestations certified in accordance with Article 29(3), together with the corresponding certificate of conformity, as well as any subsequent suspension or withdrawal of a certificate. Once included in the lists referred to in Article 29(1) point (a) and (b), an EU age verification solution and EU proof of age attestations shall be recognised by all Member States for the purposes of this Regulation.

1. For the purposes of establishing, in accordance with Article 6(4), whether an existing account belongs to a recipient below the age of 15 years, providers referred to in Article 6(1) shall rely on an age verification solution referred to in Article 30(2).
2. By way of derogation from paragraph 1 of this Article, providers referred to in that paragraph shall not be required to carry out age verification where they can establish, with a high degree of confidence, that the recipient of the service has reached the minimum age set out in Article 6.
3. By way of derogation from Article 8(1), providers falling within the scope of that Article and providers of software application stores shall not be required to assess the age of the recipient where they can establish, with a high degree of confidence that the recipient of the services is not a minor.
4. Providers of very large online platforms designated in accordance with Article 33 of Regulation (EU) 2022/2065 that fall within the scope of this Article, shall submit a plan to the competent authority specifying how they intend to comply with paragraph 1 and Article 8(1) and, in case they intend to rely on the exceptions laid down in paragraphs 2 and 3, how they intend to establish that the recipient of the service or the user of the system has reached the minimum age, in accordance with those paragraphs.