KIDS Act

Online social networking services, video-sharing platform services, artificial intelligence (‘AI’) companions, general conversational chatbots, online games, and software application stores that have become an important part of the daily lives of minors. Such information society services and AI systems provide opportunities for minors in the areas of identity development, learning, education, civic participation, relationship development, communication, connection and creativity. At the same time, some of those services and systems, including because of their design, may create risks to minors’ privacy, safety and security. These risks include, for example, exposure to illegal or content and risks resulting from cyberbullying or contact from individuals seeking to harm minors. Minors may also face risks as vulnerable consumers through commercial practices that may be manipulative and cause unwanted spending, compulsive and addictive behaviour. These risks can originate from the direct experience of the minor with the online social networking services, video-sharing platform services, AI companions, general conversational chatbots, online games, and software application stores or from the actions of other users on the platform or the systems.

A Special panel of experts on child safety online (‘Special Panel’) was established to provide advice to the Commission on a European approach on child safety online. The report of the Co-Chairs of the Special Panel was presented in July 2026 and is based on six guiding principles: a developmental approach, equality and diversity, protection of minors, accountability of digital services and consumer rights, empowerment and media education and children’s rights and participation. In particular, the report recommends EU-wide access restrictions to social media, harmonised safety-by-design rules for social media, other digital services, online games and certain AI systems accessible to minors as well as proportionate, privacy-preserving age assurance systems. The intention is to cover the entirety of the digital environment to ensure an effective and comprehensive protection of minors online (social media+).

Member States are increasingly introducing, or are considering introducing, national laws to establish a minimum age for minors to access certain online services. Those diverging national laws negatively affect the internal market, which, pursuant to Article 26 TFEU, comprises an area without internal frontiers in which the free movement of goods and services and freedom of establishment are ensured, taking into account the inherently cross-border nature of the internet and online services and systems. The conditions for providers to restrict minors’ access to certain services and systems, as well as obligations regarding the design of their services and systems, require harmonisation so as to create legal certainty for providers offering services and systems accessible to minors across the Union, and ensuring a harmonised level of protection for minors irrespective of their location in the Union.

Regulation (EU) 2022/2065 of the European Parliament and of the Council establishes a horizontal framework of due diligence obligations for providers of intermediary services, including specific obligations concerning the protection of minors online. In particular, Article 28 of that Regulation provides for obligations on providers of online platforms accessible to minors to put in place appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors, on their service. The Commission Guidelines on measures to ensure a high level of privacy, safety and security for minors online set out a non-exhaustive list of measures that providers of online platforms accessible to minors should put in place to comply with their obligation under Article 28(1) of Regulation (EU) 2022/2065.

This Regulation specifies and complements the relevant provisions of Regulation (EU) 2022/2065 as regards the protection of minors, in particular in order to ensure a high level of privacy, safety, and security of minors, taking into account the Guidelines and the report drawn up by the co-chairs of the Special Panel. To that end, this Regulation sets out rules for a harmonised minimum age for creating an account with online social networking services, video-sharing platform services, and rules for harmonised design requirements for such services, and for age assurance.

For that purpose, the provisions laying down a harmonised minimum age for creating an account with online social networking services and video-sharing platform services, harmonised safety requirements for online social networking services, video sharing platform services, video gaming platform services and software application stores, and harmonised rules regarding age assurance online and parental responsibility, insofar as they operationalise the obligation to put in place a high level of privacy, safety and security of minors, specify Article 28 of Regulation (EU) 2022/2065.

Nothing in this Regulation should be construed as an imposition of a general monitoring obligation or a general active fact-finding obligation, or as a general obligation for providers of intermediary services to take proactive measures in relation to illegal content.

This Regulation also complements Regulation (EU) 2024/1689 of the European Parliament and of the Council, which sets out a comprehensive, risk-based framework for the regulation of AI in the Union. Regulation (EU) 2024/1689 prohibits certain AI practices, including harmful exploitation of minors’ vulnerabilities and manipulation. Furthermore, it lays down requirements for high-risk AI systems, transparency requirements for interactive and generative AI systems and obligations for providers of the most capable general-purpose AI models to assess and mitigate systemic risks, including risks to the safety and well-being of minors. Without prejudice to the requirements and obligations set out in Regulation (EU) 2024/1689, this Regulation aims to address the particular risks posed to minors by AI companions and general conversational chatbots and to specify harmonised measures that providers of those AI systems should adopt to ensure a high level of protection of minors’ health and safety and to support their physical, mental and emotional well-being and development.

This Regulation should be seen as part of the EU overall efforts to protect users, including children and other vulnerable groups, from being exposed to illegal content online. This includes Directive (EU) 2024/1385 on combating violence against women and domestic violence, which criminalises the non-consensual sharing of intimate images or manipulated material, gender-based hate speech, cyber harassment, and cyber stalking, including where directed at minors.

This Regulation is without prejudice to the rules laid down in Directive 2010/13/EU regulating other aspects of the provision of these services covered by this Regulation, in particular, rules on the protection of minors as viewers of the audiovisual content. Where other instruments of Union law regulate similar, but not more specific, aspects of the provision of services in scope of this Regulation, the latter should prevail.

Building upon definitions covering the digital environment, this Regulation should apply to certain information society services as defined in Directive (EU) 2015/1535 of the European Parliament and of the Council, that is, any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient. Specifically, this Regulation should apply to providers of online social networking services and of video-sharing platform services. This Regulation should also apply to certain AI systems within the meaning of Article 3(1) of Regulation (EU) 2024/1689 that are accessible to minors and that qualify as AI companions or general conversational chatbots. In addition, this Regulation should apply to providers of operating systems as defined in Regulation (EU) 2022/1925, as well as to providers of software application stores as defined in Regulation 2022/1925, which is a type of online intermediation service focused on software applications as the intermediated product or service. For the avoidance of doubt, this Regulation applies also to those online social networking services, video-sharing platforms, and software application stores that are designated as very large online platforms pursuant to Article 33 of Regulation (EU) 2022/2065.

Video games have become an important part of the digital environment in which minors participate and interact with others, in a playful, goal-oriented or entertaining manner. Certain video gaming platforms allow the dissemination and exchange of user-generated content to an indeterminate number of recipients of the service and the facilitation of contact between these recipients. Such online games fall within the definition of online platforms referred to in Regulation (EU) 2022/2065 and should be covered by the scope of this Regulation. At the same time, some online games that do not allow the dissemination of information to an indeterminate number of recipients should also fall within the scope of this Regulation. This is the case of any game that that can be played on a computer, a mobile device, or a games console, irrespective of whether the game underlying software is subsequently executed locally, remotely, such as by means of durable medium, and irrespective of whether the service is provided free of charge, against payment, or against hybrid remuneration involving in-service (or in-application) purchases. Online games that are accessible or purchasable exclusively through physical media, without any online component enabling their access, distribution, or purchase, are not considered online games for the purposes of this Regulation. For the avoidance of doubt, where an online game also has certain features corresponding to a video sharing platform, it shall be considered an online game for the purpose of this Regulation.

To ensure proportionality of the Regulation, this Regulation should not apply to services or systems that, by virtue of their non-commercial, educational, scientific or public-interest nature, present a materially very low risk to minors. This exclusion should cover not-for-profit online encyclopaedias, not-for-profit educational and scientific repositories, services and systems that are designed for primarily educational purposes and operated by educational establishments or organisation, or for them; open-source software-developing and-sharing platforms, services and systems specifically developed and operated for the sole purpose of scientific research and development, and services and systems designed, developed and operated by public authorities and for exclusive use of said public authorities or on their behalf.

Where providers of services falling within the scope of this Regulation are also subject to the obligation to ensure a high level of privacy, safety and security pursuant to Article 28(1) of Regulation (EU) 2022/2065, these obligations are specified for the subject matters covered in this Regulation. Compliance with the obligations set out in this Regulation should however not be construed sufficient in itself to constitute proof of compliance of such providers with Article 28(1) of Regulation 2022/2065 and should therefore be without prejudice to further mitigation measures which such providers may be required to put in place for matters not covered by this Regulation for example those related to ensuring security. Equally, Article 28(1) of Regulation (EU) 2022/2065 should remain applicable to online platforms outside of the scope of this Regulation.

For the purposes of this Regulation, it is appropriate to establish a common definition of a minor or child. A ‘minor’ or ‘child’ should be understood as any natural person under the age of 18, irrespective of any provisions of national law providing for an earlier or later attainment of legal majority. Furthermore, while providers of online social networking services, of video-sharing platform services, online games, software application stores and AI systems remain primarily responsible for the safety of their services and systems when used by minors, parents and legal guardians can play a role in guiding the minors’ experience online. The notion of guardian for the purpose of this Regulation should be based on the definition of parental responsibility in Council Regulation (EU) 2019/1111.

For the purposes of this Regulation, the definition of ‘AI system’ as defined in Article 3, point (1), of Regulation (EU) 2024/1689 should apply. It is furthermore appropriate to define certain types of AI systems that qualify as AI companions or general conversational chatbots and are subject to the complementary obligations under this Regulation. Where reference is made to a provider of an AI companion or of a general conversational chatbot in this Regulation, the notion of provider should be understood as defined in Article (3), point (3), of Regulation (EU) 2024/1689.

The definitions relating to age assurance, including ‘age verification’, ‘age assurance’, ‘EU list of providers of EU proof of age attestations’, EU list of providers of EU Age Verification Solutions’, ‘EU Age Verification Scheme’ and ‘proof of age attestation’, should be understood as building on, and being interpreted consistently with, the Union framework established by Regulation (EU) No 910/2014 of the European Parliament and of the Council as amended by Regulation (EU) 2024/1183, as well as with Commission Recommendation (EU) 2026/1035 of 29 April 2026 on establishing a common framework for EU wide Age Verification technologies for minors and the related Commission Guidelines on the protection of minors online.

To ensure that a high level of privacy, safety and security for minors is guaranteed, it is important that the obligations are applied effectively and are not circumvented. Accordingly, providers should not engage in behaviour that would undermine the effectiveness of the obligations laid down in this Regulation. Such behaviour includes the design of the service or the system, the presentation of choices to recipients of the service or user of the system in a non-neutral manner, or using the structure, function or manner of operation of a user interface or a part thereof to subvert or impair user autonomy, decision-making, or choice. For example, minors should not be requested to lower the level of sensitive settings during account creation, such as access to geolocation or camera. They should also not be enticed to circumvent the delayed access obligations. Providers should also limit the creation, by minors, of secondary accounts aimed at circumventing safety by design measures.

To ensure that services that minors are accessing provide for the highest level of privacy, safety and security, the providers of online social networking services and video-sharing platforms services that have been designated as very large online platforms designated pursuant to Article 33 of Regulation (EU) 2022/2065 should notify to the Commission of measures they intend to take to ensure effective compliance with the obligations, such as delayed access to service and safety-by-design. This should enable the Commission to verify, following an assessment by independent auditors with a specific expertise that the providers subject to the obligations laid down in Chapters II to V of this Regulation have taken the measures necessary to comply with them. The Commission should respond to that compliance plan, without prejudice to its supervisory and enforcement powers, in particular the power to initiate proceedings pursuant to Article 34 of this Regulation. This notification mechanism is necessary and proportionate in view of the objective it pursues and respects fundamental rights of freedom to conduct a business enshrined in Article 16 of the Charter and with the freedom to receive and impart information under Article 11 thereof.

The years from 0 to 15 are particularly important for minors’ cognitive, emotional and social developments, as well as for the development of their personality, identity and value systems. Scientific evidence shows that certain online social networking services and video-sharing platform services pose a particularly serious risk to the privacy, safety and security of minors below the age of 15 years due to their particular features and functionalities. Ranging from risks as passive online users under the age of 3, when care can be substituted by screentime affecting children’s attention span, language acquisition, and socio-emotional development, through risks of mismatch between continuous exposure to external stimulation and children’s evolving capacities and emerging self-perception, to risks of convergence of developmental sensitivities and platform-driven amplification of content and interactions, research shows mental health impacts and that children are especially vulnerable under the age of 13. Until 15, adolescents transition into autonomy, and whilst supervision by caregivers and educators becomes less effective, risks are increasingly shaped by social elements of digital services, rather than individual behaviours, and adolescents from 13 to 15 are at the peak of developmental vulnerability. It is therefore crucial to ensure that their right to development and self-determination can be enjoyed free from the substantial impacts that the risks and harms posed by certain online services can have on minors. In order to ensure an equal level of protection for minors located in the Union, introducing an EU-wide access restriction to social media+ for under 13-year-olds is necessary. In order to avoid fragmentation of the internal market by diverging national laws, a harmonised minimum age of 15 years should be established for creating autonomous accounts with online social networking services and video-sharing platform services that present features or functionalities that are particularly harmful for minors below that age. This should be without prejudice to Union laws or national laws in accordance with Union law, establishing a higher minimum age for specific categories of content such as pornographic or gambling content.

The features and functionalities which are considered to pose a risk to the privacy, safety and security of minors below the age of 15 correspond to globally recognised classifications of online risks, including exposure of minors to age-inappropriate content or contacts as well as harmful conducts of other users or other commercial or cross-cutting risks such as excessive use. These therefore include features and functionalities that enable certain harmful content consumption and dissemination as well as harmful interactions or behaviour. In particular, services enabling recipients to disseminate content in real-time to an indeterminate number of people expose minors to risks for their privacy as well as to inappropriate content, such as pornographic content; enabling minors to interact with unknown users exposes them to risks of inappropriate contact by adults but also of abusive or other harmful conducts by other users; automatically suggesting content or contacts expose minors to the risk of being exposed to harmful content or so-called “rabbit-holes” of harmful content, as well as entering into potentially harmful contacts with malicious users; deploying functionalities, interface designs or characteristics that can lead to compulsive or excessive use, such as push notifications or endless content feeds, expose the minor to risks of developing behaviours that harm their mental health and wellbeing, including addictive behaviours. These functionalities are typically offered only to recipients of the service that access the service by means of an account. It is therefore proportionate, taking into account the minor’s right to freedom of expression, to delay access to the service at the point of creation and use of such accounts, as the use of the same service without an account poses a lower risk to minors.

Recognising the role of parents and legal guardians in supporting the evolving autonomous and safe development of minors online, it is appropriate to allow providers to exceptionally derogate from the minimum age for autonomous access laid down in this Regulation, down to a lower minimum age of 13 years, to allow the holder of parental responsibility to set up an account with limited functionalities for children between 13 and 15. Such an account should be an account of the holder of the parental responsibility and not of the respective minor. That derogation should be subject to verification of parental responsibility and should not undermine the objective pursued by this Regulation, taking into account the children’s right to protection, privacy and taking the child’s best interests as a primary consideration. Finally, that derogation should not be possible where the providers in their terms of service restrict access to and use of their service for users below a higher minimum age than 13 years.

Where a video-sharing platform service is specifically designed for minors below the age of 13 years, a guardian may exceptionally enable such a minor to access the service under the conditions laid down in Article 7, exclusively through the guardian’s own account and under the guardian’s control and supervision. Such guardian-controlled access does not entail the creation or use of an account by the minor and is therefore not access by means of an account created for, or attributed to, the minor within the meaning of Article 6(1). Guardian-controlled access may be organised through child-specific settings or profiles within the guardian’s account; such settings or profiles do not constitute accounts of the minor.

Nothing in this Regulation requires any provider to make its service available to minors below the age of 13, nor does it affect the terms and conditions of services that exclude such minors, which remain fully subject to the obligations of this Regulation to prevent their access. Requirements related to the age-appropriate experience on video-sharing platforms services concern solely those services whose providers have made the deliberate choice to offer an environment specifically designed for children, and subjects that choice to strict conditions.

Age-appropriate and safe online experiences are paramount to protect minors in an increasingly online environment. In order to ensure that minors can benefit from a safe digital environment, providers of online social networking services, video-sharing platform services, online games, AI companions, general conversational chatbots, and software application stores, should put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security of minors when using their service or system. To that end, providers should by-design shape their services and systems in a way that prioritises the wellbeing of minors by embedding privacy, safety and security protections into their design and operation from the start taking into account the evolving capacities of minors. Where the service or system is accessible without registration or authentication, providers should by default configure the design and settings for any unregistered or unauthenticated user in a way which guarantees a high level of privacy, safety and security of minors. Providers should only derogate from those requirements once they have established that the recipient or user is an adult by making use of age assurance in accordance with this Regulation.

For online social networking services and video-sharing platform services, the measures taken by providers of those services to comply with the obligations set out in this Regulation should ensure that, once minors have created their own account to use the service, they continue to benefit from a safe digital environment. While those measures mitigate the risks arising from the particular functionalities and features of such services for minors above the age of 15 years, online social network services and video sharing platforms nevertheless remain inappropriate for minors below that age. Compliance with those obligations should therefore not affect the general restriction on minors creating their own account below that age.

Certain design features of online social networking services and of video-sharing platform services may exploit minors’ vulnerabilities and contribute to extensive or excessive use of the service, compulsive behavioural patterns or addiction-like behaviour, with adverse effects on minors’ mental, emotional and physical well-being. Such features may include uninterrupted content consumption without effective stopping points, autoplay, autoscroll, autoreplay, infinite scroll, notifications artificially timed to regain attention, reward mechanisms encouraging repeated engagement, or mechanisms penalising the recipient of the service for not returning at regular intervals. Providers of online social networking services and video-sharing platform services should therefore not expose minors to manipulative or persuasive design features predominantly aimed at maximising engagement where those features may impair minors’ privacy, safety or security or undermine their autonomy. Providers of online social networking services and of video-sharing platform services should not undermine the minor’s decision to discontinue use or the absence of decision to use the service, such as notifications not triggered by, or not directly related to, the minor’s interaction or activity on the service. This should cover situations where the platform changes behaviour towards users when users do not use the service. As such, this would cover features which attempt to recapture user attention once lost, such as sending notifications about rewards for continuing to use the service. The providers should also not incentivise engagement at regular times or with greater frequency, including through penalties or loss of benefits for failing to engage regularly or within specified time intervals. The providers should implement age-appropriate time-management and agency-enhancing tools, including visible prompts, reminders and other measures that support informed and deliberate use of the service enabling effective interruption of the use of the service. As time-management tools are often overridden by the minors themselves, providers should ensure these measures are effective in reducing minors use of the service and not easily circumvented. Such tools should also ensure that minors’ sleep needs are not impaired by their use of the service. That should include effectively preventing minors from using the service during their school time and core sleep hours, which should be age-appropriate, in accordance with scientific recommendations. Core sleep hours should be understood as the period of the night during which minors are ordinarily expected to sleep, comprising at least eight consecutive hours between 22:00 and 08:00 local time. School time should be understood as the period during which minors are ordinarily expected to attend school or otherwise participate in compulsory educational activities, in accordance with applicable national law or practice and subject to adjustment by guardians.

A core aspect of the design and operation of online social networking services and of video-sharing platform services is the manner in which information is prioritised and presented on the service’s online interface, which may significantly influence minors’ access to, engagement with and exposure to information. To ensure that minors are effectively protected online, providers of online social networking services and of video-sharing platform services that use recommender systems should design their recommender systems in such a way that they ensure a high level of privacy, safety and security of minors. To that end, providers should use evaluation metrics that capture quality, safety and mental-health outcomes for minors, such as metrics measuring whether the recommender system selects and prioritises content appropriate for a minor’s age and developmental stage, assessing the system’s effectiveness in preventing exposure to illegal, harmful or unsafe material, and capturing indicators of psychological well-being to assess the impact on minors’ mental health. Those metrics should inform the optimisation considerations underlying the design of recommendation objectives of online platforms. To ensure a high level of privacy, safety and security of minors, providers of online social networking services and of video-sharing platform services should give priority and primary weight to explicit user-provided preferences when recommending content, such as user feedback and interactions that indicate users’ explicit preferences, both positive and negative, including the stated and deliberate selection of topics of interest, surveys, reporting, and other quality-based signals. Furthermore, to ensure minors are provided with more agency over information being suggested to them, providers of online social networking services and of video-sharing platform services should disable by default the recommendation of information suggested by the recommender system based on implicit engagement-based signals from minors’ behaviour online. Implicit engagement-based signals should be understood as signals and data that infer user preferences from their activities (browsing behaviour on a platform), such as time spent viewing content and click-through rates. Providers of online social networking services and of video-sharing platform services should ensure that recommender systems do not rely on the collection of any personal data captured from outside the service. Providers of online social networking services and of video-sharing platform services should also ensure that minors are not exposed to content that is harmful when encountered repeatedly, which should be understood as covering the so called “rabbit holes” or “filter bubbles” of content that may pose a risk to their safety and security. The “rabbit hole” effect relate to the progressive amplification of similar recommendations of content, leading recipients of the service to endless content pathways which could potentially be extreme and harmful to minors. The “filter bubble” effect refers to the progressive amplification of content whereby a minor is predominantly exposed to content or information reducing the minors’ exposure to diverse content or information. Minors should also be given agency over their recommender systems and be able to control the content recommended through dedicated tools. Minors should be offered an easy way to reset their recommender systems by deleting all previous identified preferences and, be able to choose one option that is not based on profiling irrespective of whether they are registered or not, as provided for in Article 38 of Regulation (EU) 2022/2065, regardless of whether or not the provider concerned is a provider of a very large online platform in accordance with Article 33 of Regulation (EU) 2022/2065. To ensure the effectiveness of such measure, those providers should regularly remind minors of the option to reset their feeds and ensure that that option is not designed in a manner to entice minors into choosing the option based on profiling.

Designing settings to ensure a high level of privacy, safety and security is important to minimise online risks for minors by reducing the likelihood of minors being exposed to content, interactions or functionalities that may be harmful, including in circumstances where children are unregistered on the service. To this end, providers of online social networking services and of video-sharing platform services should ensure that settings, such as those that allow tracking recipients of the service or locating them, enabling access to microphone, contacts and camera, or recommending other accounts to minors are off by default for minors. When enabled, some particularly privacy-sensitive settings, such as access to location, should be turned off after the session ends, and in any case, minors should always be made aware when activated. Furthermore, push notifications should be turned off by default and should be designed in a way that does not impair minors sleep needs and school time. To this end, push notifications should never be sent to children during their school time and core sleep hours, with the exception of where such notifications stem from urgent security alerts – for example related to account security – or interactions with their guardians. Push notifications are notifications that appear on a device to inform the recipient of the service of ongoing activities on the service regardless of whether the service is actively in use and thereby encouraging users to continue the use of the service. Additionally, where some settings and features may be particularly harmful to minors, providers should make them inaccessible for minors. Such harmful features can be filters impairing minors’ mental well-being for example by disproportionately embellishing, distorting or idealizing a child’s image – excluding harmless filters such as those mimicking animals – as well as features increasing social comparison such enabling children to see the numbers of reactions on their content.

Minors should be protected from contact-related risks, including cyberbullying, harassment, and those seeking to groom, sexually abuse or extort minors, human traffickers and those seeking to recruit minors into criminal gangs or promote violence, radicalisation, violent extremism and terrorism, as perpetrators often use the digital space to reach out to children. Consequently, interactions between minors and unregistered recipients of the service, as well as unknown recipients of service, especially adults, should have robust safeguards. Providers of online social networking services and video-sharing platform services should ensure that information about the minor, such as profile information, biography, activities, list of friends, followers and similar information cannot be accessed by recipients of the service by default, and in any event, by recipients of the service without accounts. Minors should be empowered to exercise effective control over the visibility of their personal information, such as their profile photo, profile information, content shared, contacts, activities and history or any other data shared on the account or profile. Contact details from minors – including but not limited to address, email address and telephone number – should not be shared with other recipients of the service. Minors should be able to block any other recipient of the service, manage content shared and regulate the interaction and related metrics, such as likes and number of followers. By default, the hosting of livestreams or other real-time transmissions should be disabled, as should access to the minor’s account information by recipients of the service who have not been explicitly accepted. To ensure that the possibility to enable these settings remains proportionate, this should depend on the age and evolving capacities of the minor, for example by ensuring that public accounts and the possibility to host livestream should only be accessible to children above the minimum age and if explicitly consented by their guardian.

Commercial practices occur in different forms on digital services and can have particular persuasive effects on minors, who face diverse, dynamic and personalised tactics, through for example, advertisements, product placements, the use of virtual currencies, influencer marketing, sponsorship or AI-enhanced nudging. In line with, and without prejudice to, the existing horizontal legal framework, in particular the Directive 2005/29/EC of the European Parliament and of the Council that is fully applicable to all commercial practices including towards minors as consumers and the rules in Regulation (EU) 2022/2065 on advertising (Article 26, Article 28(2) and Article 39) and dark patterns (Article 25). In the particular case of dark patterns, Regulation (EU) 2022/2065 acts as the “safety net” complementing Directive 2005/29/EC. Economic transactions may be harmful to minors’ safety and security when using the service, especially where they do not understand the consequences of the transaction they are making. Therefore, minors should be clearly informed about economic transactions taking place online. To this end, purchases carried out within the service should be labelled as an economic transaction in an easy comprehensible manner and in real time. Virtual currencies and other tokens may also cause unwanted spending, therefore all kind of purchases should be displayed in the national currency of the habitual residence of the minor. Moreover, providers of online social networking services and of video-sharing platform services should ensure that minors as vulnerable consumers are not exploited and should not design their platform in such a way that can lead to excessive, impulsive or unwanted spending. This should include notably introducing a separation or friction between content and the purchasing of related products as well as preventing minors from being exposed to loot boxes and other products, where they offer random or unpredictable outcomes or gambling-like features.

Given the particular vulnerabilities of minors and the risks that AI companions and general conversational chatbots may pose to their health, safety, fundamental rights and well-being, providers of such AI systems should implement safety by design measures tailored to the specific characteristics and risks stemming from those systems in order to offer minors an age-appropriate experience. Safeguards should include safe settings and prohibitions on addictive designs. Furthermore, minors should not be exposed to features of the system displaying behaviours or simulating emotions or interpersonal relationships that are likely to create emotional and other dependencies, including when such dependencies may negatively impact relationships with other humans and the development of the minor. In order to prevent such systems from accumulating sensitive data of minors and potentially reinforce harmful interaction patterns over time, the persistent conversational memory of interactions with minors should be disabled by default except where necessary to protect their safety. AI companions and general conversational chatbots accessible to minors should also be subject to appropriate testing and evaluation before being placed on the market or put into service and at regular intervals thereafter.

Providers of AI companions and of general conversational chatbots accessible to minors should also implement post-market monitoring to identify and mitigate risks to minors’ health, safety and fundamental rights and their mental, physical, mental and emotional well-being and development and to assess the effectiveness of the measures put in place, unless the provider is a micro or small enterprise. In this context, it should be borne in mind that if the AI companion or general conversational chatbot is based on a general-purpose AI model with systemic risk, that models is already subject to specific risk management obligations under Regulation (EU) 2024/1689. The systemic risk management carried out by providers of those models should include the assessment, and, if necessary, mitigation of risks to the safety and well-being of minors, including risks to minors from their legitimate use of the model and from the use of the model by other persons that may cause harm to minors. It is accordingly appropriate for relevant mitigations implemented as part of this systemic risk management pursuant to Article 55 of Regulation (EU)2024/1689 to be relied upon by providers of AI companions and general conversational chatbots as part of their efforts to comply with the requirements of this Regulation. Similarly, risk assessments and mitigation measures implemented pursuant to Articles 34 and 35 of Regulation (EU) 2022/2065 may also be taken into account when performed by a provider of an AI companion or a general conversational chatbot deployed as a functionality of an online social networking service or of a video-sharing platform service in the provision of that service. Nevertheless, such mitigation measures should not be considered sufficient for compliance with the requirements set out in this Regulation.

Where an AI companion or a general conversational chatbot is deployed as a functionality of an online platform or of an online search engine, the obligations laid down in Regulation (EU) 2022/2065 should continue to apply to the provider of those intermediary services, where the conditions for their application are fulfilled. In particular, the deployment of such functionalities should not affect the application of the rules on the assessment and mitigation of systemic risks, including risks stemming from the design, functioning or use of those functionalities, insofar as they form part of the service offered by the online platform or online search engine. To ensure transparency over interactions with such systems, providers of online social networking services, of video-sharing platform services, and of online games that deploy AI companions or general conversational chatbots as a functionality in the provision of their service should also implement measures that empower minors to make informed choices whether to use those companions or chatbots and be able to opt out from such use. This should include obligations for those providers to ensure that minors are not nudged to use those systems through design techniques, such as displaying AI companions and general conversational chatbots at the top of the minor’s contacts list. Moreover, safeguards should apply to AI companions and general conversational chatbots when they are deployed as a functionality in the provision of an online game, where in-game purchases can occur.

Online games can take very different forms and can be divided into categories such as action, adventure, role-playing games, strategy, sports, simulation or puzzle games and are usually played on a PC, mobile device or console. Online games can provide minors not only entertainment, but also online environments for communication and social interaction, including for minors with disabilities. Multiplayer online games enable minors to engage with other persons and to build social connections across different age groups and geographical locations. Online games can also contribute to minor´s learning of coordination, cooperation and subjects such as science, mathematics and languages. Video gaming platforms enable users to play and create their own content or games, and disseminate them to the public. Both video games and video gaming platforms may present diverse risks to minors. This was also highlighted by the Report by the Co-Chairs of the Special Panel on Child Safety Online which highlighted that video games may expose children to harmful commercial practices or dangerous contacts and age classification systems may provide orientation and insights for parents and caregivers on game ratings.

Given the particular vulnerabilities of minors and the risks that online games may pose to their privacy, safety and security, it is important that providers of online games implement safety by design measures tailored to the specific characteristics and risks stemming from those online games in order to offer minors an age-appropriate experience. Such risks relate in particular to unsolicited communication in the video games, age-inappropriate content, and design mechanisms which can lead to addictive behaviours and excessive use. Online games with open communication expose minors to contact-related risks, including cyberbullying, harassment, and those seeking to groom, sexually abuse or extort minors, human traffickers and those seeking to recruit minors into criminal gangs or promote violence, radicalisation, violent extremism and terrorism, as perpetrators often use the digital space to reach out to children. Similarly certain settings may expose minors to content, interactions or functionalities that may be harmful, including in circumstances where children are unregistered on the service. Providers of online games should therefore implement safeguards to prevent the service from being used to entice minors to initiate contacts on other services which may pose a risk to their privacy, safety and security. This could be done through restricting link-outs where this may pose a risk to minors and by implementing warning messages to minors. Video gaming platforms may also increase the risk of minors being exposed to age-inappropriate content. Where video gaming platforms allow recipients of the service to create individual video games, the provider of the video gaming platform should put in place the necessary software and organisational measures to allow the provider of the newly created video game to comply with applicable rules.

Certain design features of online games may exploit minors’ vulnerabilities and contribute to extensive or excessive use of the service, compulsive behavioural patterns or addiction-like behaviour, with adverse effects on minors’ mental, emotional and physical well-being. Online games should therefore not expose minors to features undermining the minor’s decision to discontinue use or the absence of decision to play the online game or features or rewards incentivising engagement at regular times or with greater frequency, including through penalties or loss of benefits for failing to engage regularly or within specified time intervals.

Providers of software application stores are in a unique position concerning the way how services which pose a risk for minors may be offered recipients. To ensure a high level of privacy, safety and security for minors in the online environment, providers of software application stores should put in place an age rating system to allow to establish the age-appropriateness of software applications disseminated through their service. Such an age-rating system should apply to each software application and should take due account of the rights and best interests of the child, including minors’ evolving capacities and differing levels of maturity. Providers of software application stores should prevent minors from accessing or purchasing applications rated as age-inappropriate. Furthermore, to ensure compliance with applicable Union law and national law adopted in compliance with Union law, where the provider of a software application store becomes aware of software applications disseminated through its service that are or primarily consist of content that is subject to a higher minimum age under the applicable Union law or national law, the provider should not allow minors below that minimum age from that Member State to access or purchase those software applications through its service. For this purpose, providers of software application stores should assess the age of the recipient of the service in accordance with Chapter V of this Regulation. To ensure transparency and accountability, providers of software application stores should make publicly available, in clear and accessible terms, information on the methodology, criteria and sources underpinning their age-rating systems.

Codes of conduct can be an important tool to protect minors in the online environment. In that context, the Commission should encourage the drawing up or further development of voluntary codes of conduct at Union level establishing common methodologies and criteria for age rating systems, to contribute to the harmonised operation of such systems in the application of this Regulation, including by providers of software application stores.  The codes of conduct should in particular facilitate the mutual recognition and consistent application of age ratings across Member States, define appropriate criteria, methodologies and sources of information for assessing the age-appropriateness of the most relevant types of content including violent, sexual, gambling and self-harm content as well as in-app purchases, contact risks and addictive design features as well as establish the necessary remedies and redress mechanisms and ensure transparency, combined with regular, transparent and independent monitoring and evaluation of the achievement of the objectives aimed at. The refusal without proper explanations by a service provider of the Commission’s invitation to participate in the application of such a code of conduct could be taken into account, where relevant, when determining whether the service provider has infringed the obligations laid down by this Regulation. The mere fact of participating in and implementing a given code of conduct should not in itself presume compliance with this Regulation. The Pan-European system (PEGI) age classification system and PEGI Code of Conduct set a benchmark for the participating companies with respect to age labelling, promotion and marketing and reflects the video games industry’s commitment to provide information to the public in a responsible manner. The rules on codes of conduct under this Regulation could serve as a basis for already established co-regulatory efforts at the Union level to be integrated as a code of conduct. This includes, but does not concern exclusively, the PEGI age rating system, provided that it provides a high level of privacy, safety and security of minors as required by this Regulation.

Minors playing online games should benefit from the same protection in respect of economic transactions as on online social networking services and video-sharing services, including transparency as to the real monetary value of transactions carried out through virtual currencies and protection from exposure to variable reward systems, whose association with gambling-related and compulsive behaviours is well documented. Codes of conduct in the area of online games should build on existing pan-European classification and self-regulatory frameworks or age classification systems at Member State level, including their recent extension to interactive risk categories and monetisation practices, and should keep such frameworks updated in light of scientific and technological developments and emerging risks to minors. Adherence to a code of conduct assessed as adequate by the Commission may serve as an indication of compliance with the measure-based obligations laid down in this Regulation, but cannot derogate from its prohibitions.

In order to ensure a high level of privacy, safety and security of minors in the digital environment, providers of online social networking services, of video-sharing platform services, of AI companions and of general conversational chatbots and of online games should take into account the evolving capacities, interests and vulnerabilities of children throughout the design, development and operation of their service. The measures put in place should therefore at least be child-friendly, easy-to-understand, easily accessible to all minors, including those with disabilities or additional accessibility needs. Very large online platforms within the meaning of Article 33 of Regulation (EU) 2022/2065 shall ensure that such information is presented in the official language(s) of the Member States in which the service is provided. Providers of online social networking services, of video-sharing platform services, of AI companions and of general conversational chatbots and of online games should also enable minors to provide feedback on content, search results and prompts recommended to them on the service. Such feedback should be taken into account and have an imminent and durable impact on children’s experience on the service. Furthermore, minors should be progressively empowered to understand and manage their default settings. Where a minor changes a protective setting, providers should present clear warnings and offer easy reversibility, including the option to temporarily change the setting and one-click return to default settings. In order to ensure a high level of privacy, safety and security of minors, providers should not repeatedly prompt or entice minors to lower their level of protection.

In order to ensure a high level of privacy, safety and security of minors, it is necessary to put in place effective, visible and child-friendly mechanisms for reporting and for supporting minors to report content, accounts, groups, features and behaviour that may negatively affect their privacy safety and security when using the service. This includes the reporting of accounts owned by users below the minimum age, pursuant to this Regulation. Such mechanisms should not affect the application of Article 16 of Regulation (EU) 2022/2065. In order to ensure a high level of privacy, safety and security of minors, such mechanisms should, where appropriate, enable minors to submit a report in their own words and should ensure that the identity of the minor remains confidential towards other recipients of the service or users of the system by default. Reports submitted by minors should be treated as a matter of priority. Furthermore, minors should receive a confirmation of receipt, together with age-appropriate information on the follow-up process, indicative timelines and possible outcomes. Any restrictions imposed by providers following such reports by minors should be considered as a restriction of the visibility pursuant to Article 17(1), point (a) of Regulation (EU) 2022/2065, where applicable. Additionally, minors should be able to access comprehensive and appropriate support where they encounter illegal and harmful content and activities. To that end, providers of online social networking services, of video-sharing platform services, of AI companions and of general conversational chatbots, and of video gaming platforms services, should make available support tools that are easily accessible and adapted to the needs of minors and that enable referrals or connection to national support services, including Safer Internet Centres, child help and hot lines, child protection services and, where appropriate, contact details of law enforcement. Those support tools should also be connected to national online safety apps, such as the 3018 application provided by e-Enfance, where such apps exist, as well as to the European Online Safety App when available. To ensure that minors are aware of the risks in the online environment, they should be informed of the specific risks prior to posting content or enhancing the visibility of certain content such as reposting content posted by other recipients. To that end, providers of online social networking services, of video-sharing platform services, AI companions, general conversational chatbots, and of online games, should, where appropriate, implement warning messages or other suitable measures aimed at informing minors before they undertake any actions.

Guardians play an important role in the lives of minors, including in supporting their safe and informed navigation of the online environment. This is why guardians should be facilitated in providing such support through the availability of tools for guardians. Tools for guardians are software, features, functionalities, or applications designed to help guardians accompany their minor’s online activity, privacy, safety and well-being, while respecting children’s agency and privacy. Tools for guardians should be considered as complementing other safety by design measures but should never replace the providers’ own responsibility to ensure a high level of privacy, safety and security for minors. Since parental oversight is not always possible due to the realities of children’s living arrangements and since guardians might be absent or disengaged, compliance should not depend exclusively on guardians. Tools for guardians should at least include features for reporting content on behalf of their child, setting screen time limits, seeing and being informed on the accounts that the minor communicates with, managing account settings, as well as other features to supervise uses of the services in scope of this Regulation that may be detrimental to the minor’s privacy, safety and security. Such features may include warnings for guardians to be informed about potential repeated searches of minors related to suicide, self-harm, or eating disorders or initiate contact with or became friends with, including where such accounts belong to adults an adult. Where guardians manage minor’s settings, they should be able to choose the time period for which they intend to change such settings. These tools should be tailored to the age of the minor, taking due account of their gradual development. Tools for guardians should be age-appropriate, easy to access and activate, effective and not easily circumvented, while respecting minors’ rights to privacy, access to information and growing autonomy in accordance with their evolving capacities. For example, such tools should allow the guardian to use the tool without creating an account with the service and they should ensure that changes can only be made with the same degree of authorisation required for the initial activation of the tools. Minors should be clearly notified when such tools are activated and should, in particular where monitoring functionalities are used, receive a clear real-time indication. For very large online platforms within the meaning of Article 33(1) of Regulation (EU) 2022/2065, interoperability with third-party guardian tools should further enhance usability and effectiveness, in accordance with conditions set out by Article 6 of Regulation (EU) 2022/1925. The power to adopt acts in accordance with Article 290 TFUE should be delegated to the Commission in order to supplement this Regulation by laying down the necessary rules and technical criteria for the tools for guardians.

Certain bodies, organisations and associations have particular expertise and competence in detecting and flagging suspected infringement of this Regulation and their complaints may have a positive impact on the freedom of expression and of the freedom of information in general. Therefore, guardians and minors should have the right to mandate such a body, organisation or association in accordance with the conditions set out in Article 86 of Regulation (EU) 2022/2065 to exercise the rights conferred by this Regulation on the minors’ behalf.  In addition to the right to lodge a complaint in accordance with Article 53 of Regulation (EU) 2022/2065, minors and guardians who are recipients of the service and users of systems and any body, organisation or association should have the right to lodge a complaint against providers subject to this Regulation. Such complaints should be lodged with the competent authority determined in accordance with Article 27 of the Member State where the recipient of the service is located or established, in accordance with national principles of good administration. For AI companions and general conversational chatbots, Article 85 of Regulation (EU) 2024/1689 should apply. The possibilities to contest decisions of providers of online platforms should leave unaffected in all respects the possibility to seek judicial redress in accordance with the laws of the Member State concerned, and therefore should not affect the exercise of the right to an effective judicial remedy under Article 47 of the Charter.

Ensuring a high level of protection of minors relies not only on the measures put in place by providers, but also, for providers of very large online platforms, on their ability to demonstrate through appropriate monitoring, testing and evaluating the effectiveness of the measures implemented in accordance with Chapter III, which should be part of the risk assessments conducted pursuant Article 34 of Regulation (EU) 2022/2065. Providers should consider the most up-to-date information available and insight from scientific and academic sources for that evaluation. To monitor and assess the effectiveness of the measures over time, providers should preserve all supporting documents relating to their evaluation for at least three years.

To support the proper application of this Regulation, the Commission should encourage and facilitate the development, implementation, regular review and adaptation of voluntary Union-level codes of conduct involving, where appropriate, providers of online social networking services, video-sharing platform services, online games, AI companions, general conversational chatbots a, as well as competent authorities, civil society organisations, and other relevant stakeholders. Those codes of conduct should set out clear objectives, include specific commitments and reporting arrangements proportionate to the size and capacity of providers, and duly reflect the specific characteristics of the services concerned and the needs and interests of all parties, in particular minors. After consulting the European Board for Digital Services and the European Artificial Intelligence Board, within the scope of their respective competences, the Commission should assess, monitor and evaluate whether such codes are adequate to contribute to compliance with this Regulation.

In the interest of clarity, simplicity and effectiveness, and to ensure the effective application and enforcement of this Regulation, providers of online social networking services, video-sharing platform services, online games, AI companions and, general conversational chatbots, which do not have an establishment in the Union should designate a legal representative in a Member State where they offer their services or systems. For simplification purposes, where such providers have already appointed a legal representative under Regulation (EU) 2022/2065 or Regulation (EU) 2024/1689, they should be able to fulfil that obligation by extending the mandate of that representative to cover all matters relating to the receipt of, compliance with and enforcement of decisions issued under this Regulation.

Given the evolving nature of cross-cutting risks that minors may be exposed to within the online world, which is driven by constant innovation, the power to adopt acts in accordance with Article 290 TFUE should be delegated to the Commissions in order to amend the prohibitions on practices intended, or which can reasonably be foreseen, to encourage compulsive or excessive use of the service by minors, the measures ensuring that recommender systems are designed in way that ensures a high level of privacy, safety and security of minors, the default settings ensuring minors’ accounts are set to a high level of privacy, safety and security, the measures ensuring a high level of privacy, safety and security of minors as regards contacts between minors and other recipients of the service, the measures limiting the visibility of any information shared by minors and their interactions with other recipients of the service, the measures ensuring a high level of protection of health, safety, fundamental rights and well-being of minors that may access AI companions and general conversational chatbot systems, the measures ensuring a high level of privacy, safety and security of minors on online games, and the measures ensuring agency for minors. This aims at ensuring that the measures on safety by design remain effective and keep pace with practices Such amendments should be limited to what is necessary to address minors’ privacy, safety and security.

In order to verify the parental responsibility for the purpose of the creation of an account by the guardian for the benefit of a minor, providers should be able to use signals deriving from the publicly accessible databases at the Member States’ level, such as those related to education or public birth registries, that the respective adult is a guardian of the minor concerned. Furthermore, in certain cases providers may already possess a signal that an adult is a guardian of a minor, such as in the case of past engagements with the service by the concerned minor and respective adult. In addition, adults should be able to self-declare that they exercise parental responsibility. Where such self-declaration is made, providers should make reasonable efforts to verify that the adult is the guardian of the minor concerned. Such verification should be carried out in a manner that respects data protection principles, particularly data minimization through the use of so-called ‘zero knowledge proof’, and should not lead to additional processing of personal data enabling the determination of the identity or tracking of the adult or minor concerned. This is without prejudice to the measures that the provider should be able to take to comply with its obligation under Article 18 of Regulation (EU) 2022/2065. The power to adopt acts in accordance with Article 290 TFUE should be delegated to the Commission in order to amend this Regulation by specifying the proof and signals that might indicate the parental responsibility. The Commission should be able to further explore technical and operational requirements for the possibility to include EU age verification as a tool for verification of parental responsibility.

The assessment of the user’s age is necessary for the effective implementation of the obligations laid down in this Regulation concerning registration with online social networking services, video-sharing platforms that are subject to a minimum age, access to age-inappropriate software applications and ensuring a high level of privacy, safety and security for minors through safety by design measures. The methods used should be accurate (such accuracy should be regularly assessed against appropriate, clear and publicly available metrics, under real-life circumstances and allow for correct determination of a user meeting the age threshold), reliable (for a method to be reliable, it should come from a reliable source, be available continuously at any time, and work in different real-world circumstances), robust (it should not be easy to circumvent), and should not be intrusive (not requiring recipients of the service to disclose their identity, precise age or other personal data where establishing that a relevant age threshold has been reached is sufficient) nor discriminatory (the chosen method should be appropriate and available for all users regardless of disability, language, ethnic, gender, religious and minority backgrounds). Where age assurance solutions do not meet these requirements, they should not be deemed compliant with this Regulation. Mere self-declaration by recipients of the service is not a sufficient age assurance solution for the purpose of compliance with this Regulation, and should not, on its own, be considered an appropriate nor effective measure when the protection of minors requires a reliable determination of age.

The requirements of this Regulation on age assurance should be without prejudice to the application of Regulation (EU) 2016/679, notably the principles of purpose limitation and data minimisation as provided for in Article 5(1) points (b) and (c), thereof, as well as the requirements of data protection by design and by default. In particular, the requirements in this Regulation should not lead providers of services in scope to maintain, acquire or process more personal data than strictly technically necessary to assess if the recipient of the service is a minor. In addition, providers of services in scope should not further process this information or combine it with additional data for any other purpose. Data protection obligations should be applicable both to providers of services in scope and any third party involved in age assurance, such as providers of age assurance solutions. To ensure the highest level of privacy and data protection, age assurance solutions used should be based on state-of-the-art technology and be zero knowledge proof.

To avoid unnecessary friction for users and to limit the instances requiring age assessment, providers of software application stores and the providers of the services and systems subject to the obligations laid down in Chapter III should be able to store in relation to an account an age signal confirming that a user has already met a given age threshold. For providers of software application this means that no assurance has to be conducted for users that have already proven to have met the age threshold when trying to access or purchase software applications subject to the same or a lower threshold. The personal data processed in such age signals should be limited to what is strictly necessary for that purpose and should not be used for any other purpose.

Age assurance is an umbrella term for different age assurance methods, including both age verification and age estimation. In order to ensure that recipients of the service have reached the minimum age, or where the service concerns a child-friendly service, providers of online social networking services or video-sharing platform services in scope of the access delay should put in place appropriate age verification solutions at the moment of account creation. To facilitate compliance and promote a trusted, interoperable and privacy-preserving approach to age verification across the Union, providers should exclusively use EU age verification solutions that rely on EU proof of age attestation that certified as conforming with the requirements of the EU Age Verification Scheme EU Age Verification Scheme, which is established in Commission Recommendation (EU) 2026/1035 and that are listed in the EU list of EU Verification Solutions and the EU list of providers of EU proof of age attestations. The EU Age Verification Solution relied upon by the providers should be provided by an independent third party. The standards and criteria necessary for highly effective age verification are set out on the EU Age Verification Scheme, and any third-party certified as conforming to this scheme should be considered as providing valid proofs of age. To ensure the highest level of privacy, security, accuracy, reliability and non-intrusiveness, providers of proof of age attestations and age verification solutions no other age verification solutions shall be deemed compliant with the obligations in the Regulation to assess the age than the EU Age Verification Solutions and EU proof of age attestations. These EU Age Verification Solutions and EU Proof of age attestations should meet the requirements of the EU age verification scheme, such as the use of Zero Knowledge Proof to prevent identity tracking and online linkability. Once it is established that the providers of the proof of age attestations and age verification solution meet those requirements, and notified as such by the Member States, they should be listed in the EU list of proof of age attestations and the EU list of EU age verification solutions.

For the purpose of compliance with the safety-by-design requirements laid down in Chapter III, providers should also be allowed to use alternative age assurance solutions instead of age verification, where those solutions provide a high level of accuracy, reliability, security, robustness, non-intrusiveness, privacy, and non-discrimination.

In cases when recipients of services and of systems referred to in paragraphs 1 and 4 consider that the outcome of the age assurance is incorrect, they should have access to an effective internal complaint-handling mechanism. That mechanism should enable complaints to be lodged by electronic means and free of charge, and should be easily accessible and user-friendly. In order to ensure effective redress, providers should handle such complaints diligently, impartially and without undue delay. Where a provider of an operating system has obtained, in compliance with this Regulation, an age signal of a user, that provider should, with the user’s consent, enable the sharing of that age signal with providers in scope where this is necessary for compliance with this Regulation This should not lead to the processing of any additional data other than strictly necessary for the compliance with this Regulation. This obligation on providers of operating systems, should be without prejudice to the obligations for the providers to assess and verify the age to ascertain that the age signal has been obtained in accordance with the requirements set in this Regulation.

For the purpose of ensuring uniform conditions for the application of the EU age verification scheme across the Union, implementing powers should be conferred on the Commission to lay down the specifications necessary as a basis for the functioning of the EU Age Verification Scheme, including the procedures for demonstrating and assessing conformity of the EU Age Verification solutions and the EU proof of age attestations by public authorities.

In order to ensure uniform conditions for the application of alternative age assurance solutions, the power to adopt acts in accordance with Article 290 TFUE should be delegated to the Commission in order to supplement this Regulation by specifying the requirements and specifications necessary to ensure that an age assurance solution achieves a high level of accuracy, reliability, security, robustness, non-intrusiveness, privacy, and non-discrimination and specifying the requirements necessary to ensure the secure, privacy-preserving and interoperable sharing of age signals.

Effective exercise of the possibility of the creation of a parental account for the benefit of a minor and for the effective use of tools for guardians under this Regulation requires adults with the parental responsibility to have access to the necessary means to prove such parental responsibility. Member States should therefore be required to establish at least one privacy-preserving electronic means by which a guardian can obtain and present an attestation of parental responsibility in respect of a minor. When doing so, Member States should ensure that such means are based on authentic sources established under national law, are free of charge for the guardian, and do not entail making information on parental responsibility accessible to providers or to the public beyond confirmation that parental responsibility exists. Such privacy-preserving electronic means should be effectively accessible to all guardians and minors residing in their territory, including persons with disabilities, persons with limited digital access or skills, and persons in vulnerable situations such as refugee and displaced families.

No minor should be deprived of the protection under this Regulation, and no guardian of the means to exercise it, on account of the family’s administrative, social or residence situation. Member States should therefore ensure that attestations of parental responsibility can also be obtained by families whose circumstances are not reflected in ordinary civil status records, including refugee and displaced families and legally appointed guardians of unaccompanied minors, on the basis of decisions or attestations issued by the competent authorities.

Effective age verification across the Union requires recipients of the service to have access to suitable means of obtaining proof of age attestations. Without the availability of proof of age attestations, recipients of the service are prevented from accessing services solely because they lack access to a means to verify their age. Member States should therefore ensure the availability in their territory of different means of obtaining proof of age attestations, such as through biometric identity cards and passports, digital identity schemes, third party applications or in-person age verification. Member States should ensure that these means of obtaining proof of age attestation will enable the recipients to proof that they meet the age thresholds set in this Regulation a. This should include proof of age attestations for younger children Furthermore, Member States should ensure that an EU age verification solution is available free of charge. Member States should designate public authorities for the purposes of certifying EU age verification solutions and EU proof of age attestations. To that end, Member States should communicate to the Commission the names and addresses of the public authorities designated in their territory, together with any subsequent changes, and the Commission should make that information publicly available. Member States should also notify the Commission without undue delay of EU age verification solutions and EU proof of age attestations certified as conforming with the requirements of the EU Age Verification Scheme, together with the corresponding certificate of conformity, as well as of any subsequent suspension or withdrawal of such a certificate. In order to guarantee the effective and uniform application of this Regulation across the Union, an EU age verification solution or EU proof of age attestation that has been certified that has been included in the lists referred to in Article 30(1) should be recognised by all Member States. Member States should therefore not restrict or hinder, the use within their territory of an EU age verification solution that has already been included in that list by nomination of another Member State.

The age requirements established by this Regulation should apply effectively to both new and existing accounts. Providers of services and systems subject to the minimum age should therefore establish, within an appropriate time period, whether recipients of services or users of systems holding existing accounts have reached the applicable minimum age. Providers should not be required to carry out a new age verification where they can establish with a high degree of confidence that the applicable minimum age has already been reached, including, where appropriate, on the basis of the date on which the existing account was created. The same principle should apply where providers are required to assess the age to distinguish adults from minors for the purposes of determining the parental responsibility and for providers of software applications stores to prevent minors from accessing or purchasing age inappropriate or by applicable Union law or national law adopted in compliance with Union age restricted applications. This approach is intended to avoid requiring all recipients of the service to undergo age verification or age assurance where there is already a high degree of confidence that a user is an adult, for example on the basis of reliable information such as through previously legitimately acquired credit card details. High confidence should be based on expected performance in practice on the full user base. In order to facilitate effective oversight of the implementation of these requirements by providers of very large online platforms, those providers should set out in advance how they intend to comply with these requirements concerning existing accounts and where applicable, how they intend to rely on the relevant exceptions.

In order to ensure that existing accounts are brought into compliance with the minimum age obligations, providers of very large online platforms should before the expiry of the six month time period, submit to the competent authority a detailed implementation plan that corroborates the required high degree of confidence. To this end, the plan should set out a schematic description of the complete process pipeline used to determine the age of existing users, together with a clear account of each technical tool or measure and the underlying decision rules. Where relevant, it should be supported by robust evidence of performance under real-life circumstances derived from a statistically representative sample of the full user base – the representativeness of the sample with respect to the relevant age signals should be demonstrated – and should present accuracy, precision and recall for underage recipients as well as a full confusion matrix with granular age buckets, together with a description of how the sample and the age labels were obtained. Where the year of account creation is relied upon as a derogation, the plan should additionally provide empirical evidence and the statistical confidence that this single signal is sufficient to infer that the user has reached the applicable minimum age. The plan should also outline how the provider will monitor that the expected performance has been achieved, for example through a post‑implementation audit. Finally, the plan should demonstrate that the proposed measures respect the general age‑assurance principles of this Regulation, including accuracy, reliability, security, robustness, non‑intrusiveness, privacy and non‑discrimination.

Recognising that effective protection of minors requires not only regulatory measures but also awareness, education and empowerment, Member States should establish national strategies building on the Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee of the Regions: A digital Decade for children and your: the new European strategy for a better internet for kids (BIK+) of 11 May 2022 and its network of Safer Internet Centres with awareness activities, helplines supporting children, guardians and educators and hotlines to report suspected illegal content. Notably, Member States should promote the development of minors’ digital literacy skills so that, by the time they reach the minimum age, they are able to understand the risks of the online environment covered by this Regulation, to use digital services and systems safely and critically, and to make informed use of the protections, settings and tools that providers are required to make available. Minors, and their guardians, should have easy, free and confidential access at national level to channels through which minors can seek assistance in relation to the harms addressed by this Regulation, including unwanted contact and cyberbullying in line with the Communication from the Commission to the European Parliament, the Council, the European Economic and social Committee and the Committee of the Regions: Action plan against cyberbullying “Safer online, stronger together” of 10 February 2026. Those channels should complement the reporting and support tools provided pursuant to this Regulation, be capable of providing rapid assistance, and direct minors to further sources of support available at national level. It should be possible to support these activities, including those carried out by the Safer Internet Centres, by Union funding made available under the relevant Union programmes and instruments established under the multiannual financial framework, such as the National and Regional Partnership Plans. In order to support effective implementation, Member States should communicate the measures taken to the Commission, and the Commission should facilitate the exchange of best practices between Member States.

This Regulation should specify certain provisions of Regulation (EU) 2022/2065. In order to ensure effective supervision and enforcement of this Regulation, Chapter IV of Regulation (EU) 2022/2065 should apply to the extent that the relevant provisions regulate providers of intermediary services in scope of that Regulation. The Commission should have exclusive powers to supervise and enforce obligations laid down in this Regulation that apply to providers of very large online platforms within the meaning of Article 33 of Regulation (EU) 2022/2065.

Similarly, to avoid overlaps and ensure consistency with the existing horizontal framework applicable to AI systems under Regulation (EU) 2024/1689, the enforcement of the specific safety requirements provided for in this Regulation for AI companions and general conversational chatbots should be based on the supervisory and enforcement framework and procedures set out in Regulation (EU) 2024/1689.

Providers of online games that are video gaming platforms are subject to the supervision and enforcement structure pursuant to Regulation (EU) 2022/2065. In order to ensure coherence with enforcement under this Regulation, the competent authority responsible for the supervision of providers of online games that are video games should be a competent of the Member State of main establishment of the provider.

In order to ensure legal certainty and consistent application throughout the Union, and to avoid fragmentation of the internal market resulting from divergent national interpretations, Member State authorities should not adopt decisions that run counter to a decision taken by the Commission pursuant to this Regulation. The Commission, Digital Services Coordinators and competent authorities, where applicable, should work in close cooperation and coordinate their enforcement actions to ensure coherent, effective and complementary enforcement of this Regulation on the one hand, and Regulations (EU) 2022/2065 and 2024/1689 on the other, including by drawing on the cooperation and consistency mechanisms established in Chapter IV of Regulation (EU) 2022/2065.

The Commission should aim to adopt a final decision within 90 days from the opening proceedings for suspected infringements of this Regulation. It should also communicate its preliminary findings to the provider concerned within 30 days from opening proceedings.

The Commission should be in possession of all the necessary resources, in terms of staffing, expertise, and financial means, for the performance of its tasks under this Regulation. In order to ensure the availability of the resources necessary for the adequate supervision at Union level under this Regulation the Commission should charge an annual supervisory fee, the level of which should be established on an annual basis, on providers of online social networking services, video-sharing platform services, of software application stores and of AI companions and of general conversational chatbots, which it enjoys the competence to supervise with regard to compliance with Chapters II to V of this Regulation and that are designated as very large online platforms pursuant to Article 33 of Regulation (EU) 2022/2065. The annual supervisory fee required for the enforcement of this Regulation vis-à-vis those providers should be integrated in the supervisory fee charged to such providers of very large online platforms pursuant to Article 43 of Regulation (EU) 2022/2065. Similarly to that supervisory fee, the external assigned revenues resulting from the annual supervisory fee under this Regulation should cover additional human resources in the Commission, including officials, contract agents and national experts. Finally, the cap on the supervisory fee introduced in this Regulation should be taken together with the cap laid down in Regulation (EU) 2022/2065 and should ensure that overall resources of the Commission are sufficient to carry out its tasks under this Regulation and Regulation (EU) 2022/2065.

The overall amount of the annual supervisory fee under this Regulation should include costs related to the exercise of the Commission’s specific powers and tasks of supervision, monitoring, investigation, and enforcement in respect of the providers of the very large online platforms and search engines covered by this Regulation. In particular, it should include the costs related to the set-up, maintenance and operation of the EU Age Verification Scheme, including funding related to activities concerning the roll out the EU Age verification solution across the EU and the development of expertise and capabilities pursuant to Article 36. However, the individual annual supervisory fee should not exceed an overall ceiling for each provider of very large online platforms taking into account the economic capacity of the provider of the designated service or services.

The Commission should apply the rules and principles laid down in Article 43 of Regulation (EU) 2022/2065 when charging the annual supervisory fee under this Regulation.

In view of the importance of protecting children, the Commission, in cooperation with the Digital Services Coordinators and the Board, should develop the Union expertise and capabilities as regards the supervision of services in scope of this Regulation.

Given the importance of the impact of the services and systems in scope of this Regulation on the protection of minors, the failure of the providers to ensure a high level of privacy, safety and security and comply with the specific obligations applicable to them may rapidly come to seriously affect a substantial number of minors using their services or systems across different Member States and may cause substantial harms, while such failures may also be particularly complex to identify and address timely. The Commission, in cooperation with the competent authorities, should develop the Union expertise and capabilities, including establishing knowledge sharing networks, to respond quickly to such incidents affecting the protection of minors. Such incidents should be understood as fast-evolving situations taking place within or outside the EU, with an online dimension and presumed connection to the scope of this Regulation, that seriously and negatively affect the privacy, safety, security or health and well-being of minors the service in the Union, and that requires an immediate response, such as dangerous or harmful challenges circulating among minors and posing them at immediate risk. The Commission should therefore be able to coordinate and rely on the expertise and resources of competent authorities, for example by analysing, on a permanent or temporary basis, specific trends or issues emerging regarding those fast-evolving situations which impact minors’ health, well-being, privacy, safety, and security. Member States should cooperate with the Commission in developing such capabilities, including through secondment of personnel where appropriate, and contributing to the creation of a common Union supervisory capacity, as well as an administrative arrangement setting out procedures to facilitate a rapid response in the event of an incident affecting the protection of minors. Member States should establish minimum preparedness levels for national authorities to ensure regular communications channels between relevant national authorities and third parties and map and where relevant incident reaction protocols at national level.

This Regulation respects the fundamental rights, including children’s rights, recognised by the Charter and the fundamental rights constituting general principles of Union law. Accordingly, this Regulation should be interpreted and applied in accordance with those fundamental rights, including the respect for private and family life enshrined in Article 7 of the Charter, to the protection of personal data enshrined in Article 8 of the Charter, to freedom of expression and information, including the freedom and pluralism of the media, enshrined in Article 11 of the Charter, to non-discrimination enshrined in Article 21 of the Charter, to respect for the rights of the child enshrined in Article 24 of the Charter. When exercising the powers set out in this Regulation, all public authorities involved should achieve, in situations where the relevant fundamental rights conflict, a fair balance between the rights concerned, in accordance with the principle of proportionality.

Since the objectives of this Regulation, namely to contribute to the proper functioning of the internal market and to ensure a high level of privacy, safety, and security of children cannot be sufficiently achieved by the Member States because they cannot achieve the necessary harmonisation and cooperation by acting alone, but can rather, by reason of territorial and personal scope, be better achieved at the Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve those objectives.

The European Data Protection Supervisor was consulted in accordance with Article 42(2) of Regulation (EU) 2018/1725 of the European Parliament and of the Council, and delivered its opinion on [DATE].