The EU KIDS Act: Does Europe Need Another Law to Protect Children Online?

On 17 September 2026 the Commission tabled its proposal for a Regulation, the "EU KIDS Act — 'EU Keeping Internet Digital Spaces Accountable and Trustworthy'".¹ It rests on Article 114 TFEU and is now in the ordinary legislative procedure, with the Commission’s call for feedback open until 26 November 2026. It answers a wave of national initiatives: by the Commission’s count, draft legislation was "being prepared or negotiated in 17 Member States".² The proposal has been widely reported as a social media ban for children, although headlines disagree on whether the line falls at 13 or at 15. The text is more layered than that, and the layers deserve separate legal treatment.

The proposal does three things. It sets an access regime: no social networking account below 13, no autonomous account below 15 on social media or video-sharing services with listed risk features, guardian-managed accounts for 13- and 14-year-olds, and a narrow guardian-enabled route for younger children on video-sharing services designed for them. It imposes safety-by-design duties on social networks, video-sharing platforms, app stores, online games, AI companions and general conversational chatbots, and brings operating systems into the age assurance architecture. And it builds that architecture around certified, privacy-preserving verification.

A first reaction, voiced in Digital Law Lab’s own policy note, is to ask whether Europe needs another law at all, since Article 28 of the Digital Services Act (DSA) already obliges platforms to protect minors. That question is too blunt to answer. The literature reviewed here suggests a better one: which parts of the KIDS Act are justified, at which level of government, and with which safeguards?

The article combines doctrinal analysis of the proposal and CJEU case law with a structured review of empirical and regulatory evidence, and a short functional comparison with France, Australia and the United Kingdom. The explanatory memorandum and recitals were read in the official text on EUR-Lex. The enacting terms are published, but they could not be read in machine-readable form in the sources accessed for this study. Article-level pinpoints therefore rest on the memorandum, the recitals and practitioner commentary that quotes or renders the articles.³ Where the wording of an article matters, the relevant note indicates the secondary source, and readers should consult the enacting terms for the exact wording.

No peer-reviewed analysis of the KIDS Act was found as of October 2026. Early reactions split three ways: digital rights groups want existing law enforced instead of new age gates,⁴ child-rights organisations want the scope widened,⁵ and policy analysts focus on fit with the digital rulebook.⁶ None of those reviewed here examines the Article 114 basis, what it means in law for the Act to "specify" Article 28 DSA, or how harmonisation changes the intensity of rights review.

The article’s thesis is "design yes, gates maybe". The design duties are the best-evidenced and least rights-intrusive part of the proposal and fit comfortably within Article 114. The access layer rests on precaution rather than evidence. Moving it to EU level replaces the strict, settled proportionality test it would face nationally with CJEU review whose intensity is uncertain and, for access limits, likely deferential. Section 2 sets out the existing framework, Section 3 what the Act changes, Section 4 the competence question, Sections 5 and 6 proportionality, Section 7 the AI provisions, Section 8 enforcement, Section 9 comparative benchmarks and Section 10 recommendations.

EU law already contains binding child-protection duties for online services. Much of the legal scholarship locates the problem in vague standards and weak enforcement rather than in an absence of rules.

• DSA Article 28. Online platforms accessible to minors must ensure "a high level of privacy, safety, and security of minors" (Art 28(1)) and may not show profiling-based advertising to recipients they know with reasonable certainty to be minors (Art 28(2)). Article 28(3) adds that compliance does not oblige providers to process additional personal data to assess whether a recipient is a minor, which leaves age assurance legally open.

• DSA Articles 34−35. Very large online platforms and search engines (VLOPs/VLOSEs) must assess and mitigate systemic risks. These include negative effects on fundamental rights, among them the rights of the child under Article 24 of the Charter (Art 34(1)(b)), and actual or foreseeable negative effects in relation to the protection of minors and serious negative consequences to a person’s physical and mental well-being (Art 34(1)(d)).

• The Article 28 Guidelines. Announced on 14 July 2025 and published as C/2025/5519 on 10 October 2025, they cover privacy defaults, recommender systems, persuasive design and age assurance. They bind only the Commission’s own discretion. They are "a significant and meaningful benchmark" for applying Article 28(1), yet adopting their measures "shall not automatically entail compliance with that provision",⁷ and only the Court of Justice can give an "authoritative interpretation" of Article 28(1).⁸ The measures they describe are not exhaustive.⁹

• AVMSD Article 28b. Video-sharing platforms must take measures such as age verification and parental controls against content that may impair minors' development.

• GDPR Article 8. Where processing is based on consent, it sets 16 as the default age at which a child can consent to information society services, which Member States may lower to no less than 13. The result is a patchwork of national ages between 13 and 16.

• AI Act Article 5(1)(b). It prohibits AI systems that exploit vulnerabilities due to age, but only where they act "with the objective, or the effect, of materially distorting the behaviour" of a person "in a manner that causes or is reasonably likely to cause that person or another person significant harm". An objective of distortion suffices; actual distortion need not be shown.

Lievens and Verdoodt describe the final DSA as far more child-oriented than the Commission’s 2020 draft, but stress that its promise for children’s rights is conditional, "depending on actual implementation and enforcement". They consider the AI Act’s potential to protect and promote children’s rights "less clear and certain", since the child-specific amendments tabled in Parliament were not included in its compromise text and so were not part of the trilogue negotiations.¹⁰ Verdoodt, Lievens and Chatzinikolaou ask whether the overlap of AVMSD, GDPR and DSA rules for video-sharing platforms is a "jigsaw or maze".¹¹

The enforcement record supports the "maze" reading. Cantero Gamito’s study of the TikTok case attributes "less effective enforcement" to the number of applicable rules and enforcement entities. Consumer law leaves undefined who counts as a minor, a consumer-law alert ended in commitments rather than a formal decision, and the country-of-origin principle produced forum effects.¹² Van der Hof and Ouburg reviewed age verification and parental consent methods in child-directed apps and found that none met the GDPR’s requirements at the time of their research.¹³ The regulators' own survey shows that the number of identified video-sharing platforms rose from 498 to 889, yet twelve national regulators with such platforms under their jurisdiction had not reviewed their terms and conditions, and regulators "almost unanimously" discard self-declaration as an efficient age verification method.¹⁴

Two further gaps matter for what follows. The DSA does not require a child-rights impact assessment,¹⁵ although the UN Committee on the Rights of the Child asks States to require businesses to carry one out.¹⁶ And the Guidelines merely state that providers are "encouraged to adopt double-blind age verification methods"¹⁷ and that zero-knowledge proofs "constitute a suitable basis",¹⁸ while accepting age estimation where the minimum age is below 18 or the risk is medium.¹⁹ Data protection scholars question this balance.²⁰

The deficit supports two opposite conclusions. On the first, the enforcement reading, the answer is to enforce existing law, and new rules add another layer to the maze.²¹ On the second, the legislative reading, open-textured duties and soft-law guidance cannot be enforced consistently across 27 Member States, so binding rules are needed. Parliament took this view, noting that the Guidelines "are not legally binding and that further legislative action might be required".²²

No peer-reviewed work found for this article tests these readings against each other. The KIDS Act offers a test case: it answers the legislative reading with binding design duties, and the enforcement reading with a new enforcement procedure. Sections 5 and 8 assess whether either answer holds.

The KIDS Act converts several of the 2025 Guidelines' recommendations into binding, more prescriptive rules and adds an access regime the DSA never had. Recital 6 lists the provisions on a minimum age for accounts, on safety requirements for social networking, video-sharing, video gaming platforms and app stores, and on age assurance and parental responsibility, and states that these provisions, "insofar as they operationalise the obligation to put in place a high level of privacy, safety and security of minors, specify Article 28" DSA. The AI companion and chatbot rules are not on that list. Recital 14 confines the specification to "the subject matters covered" and adds that compliance with the Act is not "sufficient in itself to constitute proof of compliance" with Article 28(1). Article 2(6) treats compliance with the Act as compliance with Article 28 for the matters it covers.²³ Read with recital 14, that presumption reaches only the subject matters the Act regulates; Article 28(1) continues to govern the rest. Commentators note that the Act goes well beyond specification, moving from platform governance to direct regulation of product design.²⁴

The Act covers providers of social networking services, video-sharing platforms, software application stores, online games, operating systems, AI companions and general conversational chatbots that are accessible to minors, wherever they are established, if they offer the service to users in the EU (Art 2(1)-(2)). According to the explanatory memorandum, "[t]he substantive obligations are limited to online social networking services, video-sharing platform services, online games, and providers of software application stores"; AI companions and chatbots have their own regime (Art 14), and operating systems are brought in mainly to share age signals (Art 29(6)).²⁵

Excluded are not-for-profit online encyclopaedias and educational or scientific repositories, services designed primarily for educational purposes and operated by or for educational establishments, services developed solely for scientific research, services run by and for public authorities, and open-source software development and sharing platforms unless the platform itself is an AI system in scope (Art 2(4); recital 13). There is no general SME exemption: the memorandum states that "small and micro enterprises are not exempted from this Regulation". Micro and small enterprises are, however, spared the post-market monitoring duty for AI companions and chatbots (Art 14(1)(f); recital 33).

The Regulation would apply six months after its entry into force, with the VLOP compliance plan (Art 5) applying from entry into force (Art 43).²⁶ Supervision is split: the Commission "directly supervises the online platforms and AI chatbots most widely used in the EU", while national competent authorities supervise the remaining services, including smaller chatbots.²⁷

Three features of this layer drive the legal analysis.

The age of 15 runs in parallel with GDPR Article 8 (Art 6(5)). A 15-year-old in a Member State that kept 16 as its digital age of consent may open an account but cannot alone give valid GDPR consent; any processing based on consent still needs parental authorisation (Art 8 GDPR). Profiling-based advertising to users known with reasonable certainty to be minors is already barred by Article 28(2) DSA.

Article 8 requires every in-scope service accessible to minors to be safe by design and by default. Articles 9 to 13 then set specific duties for social networking and video-sharing services:

Other services have their own provisions. Online games are subject to a selection of these duties (Art 15). AI companions and general conversational chatbots are subject to the specific rules in Article 14 and, under Chapter III, Section 3, to the duties on addictive design, safe settings and "transparency of commercial transactions" in Articles 9, 11 and 13. App stores must age-rate every app and publish their methodology (Arts 16−17). Articles 18 to 21 add tools for minors and guardians, child-friendly reporting and complaints.

Very large online platforms offering social networking or video-sharing services must also notify the Commission of a compliance plan, independently audited at their own expense. Neither the final audit report nor Commission inaction amounts to a finding of compliance (Art 5).³⁰

For the Article 6 thresholds, providers must "rely exclusively on an EU age verification solution using an EU proof of age attestation, provided by a third party" (Art 29(2)).³¹ Each solution is certified by a public authority designated by a Member State as conforming to the EU Age Verification Scheme established by Commission Recommendation (EU) 2026/1035, and entered on the EU lists (Art 29(3); recitals 53, 60). Self-declaration does not count as age assurance at all (Art 3(5)(i); recital 50). Age assurance may not be used to "locate, track, target, advertise to or profile" users (Art 28(1)), and "Any age assurance measure shall be zero knowledge proof" (Art 28(3)).³² Each Member State must make at least one certified EU age verification solution available free of charge, ensure several ways to obtain proof-of-age attestations (such as identity cards, passports, digital identity schemes, third-party applications and in-person checks) so that people without a digital ID are not shut out, and provide a free electronic attestation of parental responsibility (Art 31(1), (5); recital 60). Outside the account gate, providers may use other age assurance methods, possibly including estimation, but only if they meet Articles 27 and 28, including the zero-knowledge requirement (Art 29(4); recital 54). The infrastructure builds on the Commission’s age verification blueprint and on Recommendation (EU) 2026/1035 of 29 April 2026.

The Act makes three moves that the rest of this article assesses: from soft law to hard law, from governing platforms to regulating product design, and from treating users as adults unless known to be children to treating every user as a potential minor until adulthood is shown. The first two are the core of the design layer. The third is the core of the access layer.

Article 114 TFEU comfortably supports the design layer and, under the Court’s deferential review of the legislature’s policy choices, very probably the access layer too. The real vulnerability lies elsewhere: harmonisation replaces a strict, settled national test of rights with CJEU review whose intensity is uncertain.

The proposal cites Article 114, with Article 114(3) requiring a high level of protection. The Court’s case law yields four propositions.

Two further authorities help. Vodafone confirms broad discretion in complex policy choices, to be exercised on objective criteria. It upheld caps on the retail prices charged to consumers for roaming as an internal-market measure, adopted to forestall measures "which would probably have been taken by the Member States".⁴¹ Ireland v Parliament and Council upheld Article 95 EC (now Article 114 TFEU) as the basis for a measure prompted by crime-fighting concerns. Its provisions were "essentially limited to the activities of service providers", divergent national rules affected the internal market, and the measure therefore "relates predominantly to the functioning of the internal market".⁴² The Court stressed that the action concerned only the choice of legal basis, not any infringement of fundamental rights.⁴³ The same directive was later declared invalid on Charter grounds in Digital Rights Ireland, which shows that competence and rights review are separate hurdles. Weatherill argues that this case law has become a "drafting guide" that legislatures satisfy by reciting obstacles, which weakens judicial control,⁴⁴ as part of a wider pattern of competence creep.⁴⁵ Garben shows that competence creep also runs through soft law and coordination, which she considers more problematic than legislative creep.⁴⁶ The 2025 Guidelines, now hardened into the KIDS Act, illustrate the path.

The design layer is a classic Article 114 measure. Defaults, recommender settings, transaction warnings and age ratings are product requirements placed on providers, like packaging rules in tobacco or safety requirements in product law. The AI Act offers the closest analogue: an internal-market instrument carrying a fundamental-rights aim, although Almada and Petit doubt that the hybrid holds.⁴⁷

The access layer is harder, because it regulates who may hold an account rather than how a product is built. Three points support validity. The obligation falls on providers, and in Ireland the fact that the provisions were "essentially limited to the activities of service providers" supported the internal-market basis. The threshold is formally conditional on risk features, with a guardian route at 13 and 14, so it looks more like the partial regime that Tobacco Advertising I accepted than a general ban, although in practice the risk-feature list reaches almost every major social network (Section 3.2). And one rule lets providers offer one product across the Union.

The obstacles premise is strong, with one qualification. Google Ireland holds that "general and abstract measures aimed at a category of given information society services" cannot be adopted under the Article 3(4) derogation of the e-Commerce Directive, because such services are "regulated solely in the Member State on whose territory the providers of those services are established".⁴⁸ A Member State therefore cannot impose a general age rule on the major platforms established in other Member States, most of them in Ireland. National routes are constrained rather than closed: the Member State of establishment can still legislate, and case-by-case measures against a given service remain available under Article 3(4). None of them, however, yields one rule binding all major platforms, which makes the EU the most workable level for a uniform age rule. In 2023 the Commission accepted French national age verification only as "transitional measures within its jurisdiction" "in the absence of a EU-wide solution to verify the age of users", and it regarded national provisions that reproduce DSA obligations as "not in conformity with the DSA".⁴⁹ The obstacles are thus less divergent compliance burdens than legal uncertainty, pressure on Article 3(4) derogations and uneven protection. Pending national initiatives make such obstacles likely within the meaning of Poland:⁵⁰ according to the Commission, "Draft legislation is being prepared or negotiated in 17 Member States".⁵¹ The legislature may act to forestall such divergence.⁵² The obstacles premise is therefore likely to satisfy the Poland test.

Recital 20 preserves higher national minimum ages "for specific categories of content such as pornographic or gambling content". In the language of Philip Morris, this is partial harmonisation: Member States may impose further requirements only on aspects the Act does not harmonise.⁵³ National laws that set 16 for social media would be displaced.

That choice will be contested. Parliament called for "a harmonised European digital age limit of 16 as the default threshold", with access between 13 and 16 only where parents or guardians authorise it, and "a harmonised European digital age limit of 13, under which no minor can access social media platforms".⁵⁴ The debate has a legal consequence: the more room co-legislators leave for national top-ups, the weaker the Article 114 case becomes, because the Act would reproduce the divergence it claims to remove.

On subsidiarity, Poland holds that interdependent objectives "could best be achieved at EU level" and that subsidiarity is not assessed by reference to "the situation of any particular Member State taken individually".⁵⁵ Cross-border platforms and a shared verification infrastructure fit that reasoning.

The weaker point is evidence-gathering. The proposal has no formal impact assessment. It relies on an analytical staff working document, SWD (2026) 681, and on impact assessments for earlier acts. EDRi criticises it on this ground.⁵⁶ An impact assessment is not required "in every circumstance".⁵⁷ Not carrying one out is not a breach of proportionality where the legislature "is in a particular situation requiring it to be dispensed with" and "has sufficient information enabling it to assess the proportionality of an adopted measure".⁵⁸ Both conditions must be met, and the institutions must still be able to set out the basic facts "clearly and unequivocally".⁵⁹ The omission therefore matters: the evidence in Section 5 is what the co-legislators must be shown to have weighed.

The main difficulty therefore lies outside competence: Article 114 moves the access layer from the strict, settled proportionality test that the French Conseil constitutionnel applied to France’s own ban in August 2026 to CJEU review of uncertain intensity: deferential ("manifestly inappropriate") for the legislature’s policy choices in a complex field, stricter and variable for interferences with Charter rights. For the access limits, deferential review is the likelier outcome. Age assurance, which interferes with privacy and data protection (Charter Arts 7−8), is more exposed to strict review. Sections 5 and 6 take up that gap.

The empirical literature supports regulating compulsive design better than it supports an age threshold of 15 or a one-hour daily cap. No consensus report recommends 15.

The US National Academies concluded that the evidence reviewed did not support a finding that social media causes changes in adolescent health at the population level. The report made no recommendation for specific limits on adolescents' access and instead recommended industry standards for platform design, transparency and data use.⁶⁰ The UK Chief Medical Officers found that the research did not show a causal relationship, supported the minimum age of 13 set by most platforms and singled out persuasive design.⁶¹ A 378-page feasibility study commissioned by the UK government, published in January 2026, again reported a lack of high-quality causal evidence;⁶² its authors include several researchers whose own studies are discussed below. The US Surgeon General nonetheless urged precaution, including design standards and protection of sleep, and asked policymakers to pursue policies that further limit children’s access to social media, "including strengthening and enforcing age minimums", though without naming an age.⁶³ The American Psychological Association recommended tailoring features to adolescents' developmental capacities and limiting use that interferes with sleep.⁶⁴

Umbrella reviews find that overall time on social media shows weak and inconsistent associations with wellbeing.⁶⁵ The most recent umbrella review adds that problematic use is consistently linked to ill-being.⁶⁶ That distinction between general and problematic use matters for the KIDS Act, whose design layer targets compulsive use.

Haidt argues that the shift to a phone-based childhood between 2010 and 2015, the period he calls the "great rewiring", caused a rise in adolescent mental illness.⁶⁷ Odgers replies that the evidence does not support that causal claim.⁶⁸ Orben and Przybylski found that digital technology use explains at most 0.4% of the variation in adolescent wellbeing,⁶⁹ and a 2025 meta-analysis found the association between time spent on social media and adolescent mental health problems to be close to zero and too small to support claims of harm.⁷⁰

The most directly age-specific evidence on sensitivity comes from Orben et al.⁷¹ In longitudinal UK data on 17,409 young people aged 10−21, drawn from a single panel study, higher estimated use predicted lower life satisfaction a year later at ages 11−13 for girls, 14−15 for boys and again at 19 for both. That makes 15 defensible as a precautionary line. It does not make it derived from the evidence, since the windows differ by sex, recur in early adulthood and come from one longitudinal dataset.

Causal effects exist but are modest on average. Facebook’s staggered arrival at US colleges worsened students' mental health, with unfavourable social comparison as the likely mechanism.⁷² A field experiment interpreted through an economic model implies that self-control problems cause about 31% of social media use among US adults, the mechanism that compulsive-design rules target.⁷³

The strongest signal for the KIDS Act’s design layer, though observational, comes from a cohort of 4,285 US children followed for four years. High or increasing addictive use of social media was associated with more than double the risk of suicidal behaviours (risk ratios 2.14−2.39) and about one and a half times the risk of suicidal ideation (1.46−1.51), while baseline total screen time was not associated with any outcome.⁷⁴ Evidence on individual features is thinner. Snapchat streaks are weakly associated with problematic smartphone use and fear of missing out among early adolescents.⁷⁵ In a randomised field experiment with 237 participants, batching notifications three times a day improved wellbeing, while switching them off entirely raised anxiety and fear of missing out.⁷⁶ And in an audit of 806 adult Twitter users, a simulated ranking based on users' stated preferences reduced angry, partisan and out-group-hostile content, though it risked reinforcing pro-attitudinal content.⁷⁷

Age limits enforced by self-declaration fail. In a US cohort of 10,092 early adolescents, 63.8% of those under 13 reported using social media despite platforms' minimum age of 13.⁷⁸ In the UK, 40% of 3- to 12-year-olds have their own social media profile, and half of parents of 10- to 12-year-olds would let their child have one before the minimum age.⁷⁹ That second figure is a direct risk for the KIDS Act’s guardian-set accounts.

Australia gives the first real-world test of a national threshold (16, with the minimum-age obligation in effect since 10 December 2025). Platforms reported deactivating, removing or restricting more than 4.7 million under-16 accounts within days of commencement; these are preliminary account counts, not numbers of children.⁸⁰ Yet the regulator’s three-month evaluation, which follows over 4,000 children and families, found that under-16 account ownership fell only from 52.4% to 42.1%, and use with or without an account from 85.9% to 81.5%, mainly because platforms failed to implement effective age assurance.⁸¹ An observational study of 408 adolescents aged 12 to 17, mostly in New South Wales, found that over 85% of under-16s still used covered platforms three months on.⁸² No wellbeing outcomes are available yet: the regulator considers it too early to assess whether the policy’s intended outcomes have been achieved.

State-mandated time caps have the least support. China’s 2019 limits on minors' gaming (1.5 hours a day and 3 hours on public holidays, with a night curfew) produced no credible evidence of reduced heavy play in more than 7 billion hours of telemetry from one segment of the industry, although the data did not record players' ages.⁸³ By contrast, letting adults set limits on their own future use reduced their use.⁸⁴

Under the CJEU’s approach the legislature need not prove harm with certainty. Where risks to human health are uncertain, "the institutions may take protective measures without having to wait until the reality and seriousness of those risks become fully apparent", and the legality of such a measure is affected only if it is "manifestly inappropriate".⁹³ On that standard, both layers probably survive. But the evidence ranks them differently. The design layer targets the mechanism the best evidence identifies. The access layer depends on age assurance working at scale, which Australian data show it does not yet do. The benefits documented so far are normative rather than health-related: the share of children who felt they were missing out fell from 43.3% to 36.3%, while the regulator considers it too early to assess whether the policy’s intended outcomes have been achieved.⁹⁴

On paper, the KIDS Act’s age assurance technique is more privacy-protective than the comparators considered here. It makes zero-knowledge proof mandatory for every age assurance measure (Art 28(3)),⁹⁵ whereas France’s Arcom standard requires only that users be offered "at least one" age verification device complying with "double anonymity",⁹⁶ and Australia asks only for "reasonable steps" (Section 9). Its weakness lies in its reach. Regimes that confine checks to adult content reach far fewer users: Ofcom’s report on the UK concerns mainly checks that users are 18 or over on pornography services.⁹⁷ Article 8, by contrast, extends age assurance to every user, signed-out users included, who wants to leave the protective defaults. And moving the access rules to EU level changes who reviews them, and how strictly.

The access layer limits children’s freedom of expression and information (Charter Art 11) in pursuit of their right to protection and care (Art 24). The age assurance layer interferes with privacy and data protection (Arts 7−8) for children and adults alike, and estimation methods engage non-discrimination (Art 21). Any limitation must respect the essence of the right and be necessary and proportionate (Art 52(1)).

International standards sharpen these tests. General Comment No. 25 treats children’s evolving capacities as "an enabling principle"⁹⁸ and requires restrictions on their expression to be "lawful, necessary and proportionate".⁹⁹ It endorses "robust age verification systems" to prevent children from acquiring access to "products and services that are illegal for them to own or use", systems that "should be consistent with data protection and safeguarding requirements".¹⁰⁰ The paragraph sits in the section on economic, sexual and other forms of exploitation and names harmful goods, such as weapons and drugs, and services such as gambling. It does not mention pornography, and it speaks more clearly to age-restricted goods and gambling than to general social media.¹⁰¹ In May 2026 the four international freedom-of-expression mandate holders warned that "blanket bans" of children from social media accounts "may have a disproportionate impact on the freedom of expression of children", and that "certain age assurance measures can create serious problems relating to data protection, the right to privacy and other rights".¹⁰² Scholarship has long framed the issue as a tension between protection and participation rights,¹⁰³ or between protection and children’s capacity to benefit from the digital environment.¹⁰⁴

The Act’s architecture tracks the data protection authorities' principles closely: threshold-only disclosure, no identification or tracking, unlinkability, and alternatives for those who cannot use a method.¹⁰⁵ The cryptography is fast enough for everyday use: a zero-knowledge proof over standardised mobile identity credentials (ISO mdoc) runs in "a few hundred ms on mobile devices".¹⁰⁶ Four problems remain.

The retroactive check of existing accounts compounds these risks. Within six months of application, providers must establish whether existing account holders are under 15 and disable the accounts of those who are, or whose age cannot be established (Art 6(4)).¹¹⁶ The Commission expects that most existing users will need no new check where the platform "can already tell with high confidence that a user is an adult" from an estimate "based on multiple signals", such as the date the account was created or card details (Art 32).¹¹⁷ Where that estimate rests on behavioural profiling, it relies on the kind of inference that scholars consider of doubtful accuracy and necessity, and "unlikely to be a proportionate and effective way of age assurance".¹¹⁸ The proposal provides general reporting and complaint mechanisms (Arts 18−21), but no specific rules on the error rates of age assessment or on reinstating wrongly disabled accounts.¹¹⁹

In August 2026 the Conseil constitutionnel, reviewing the law before promulgation, declared unconstitutional Article 1 of the French law banning social media for under-15s.¹²⁰ It held that limits on freedom of expression must be "nécessaires, adaptées et proportionnées à l’objectif poursuivi" and that Article 1 was not.¹²¹ The ban applied generally, without regard to the features or risks of each service,¹²² and it allowed no individual assessment and no way for parents to lift or limit it.¹²³ Because adults too would have to prove their age, the legislature had to set the conditions and limits of that proof, and it had not.¹²⁴ The Conseil accepted the protective aim,¹²⁵ so a narrower national law is not excluded.

The KIDS Act reads as if drafted with these objections in view, but it answers them in form more than in substance. Formally, the threshold depends on risk features, guardians have a route at 13 and 14, and the age assurance safeguards are written into the text. In practice, the risk-feature list in Article 6(1) covers almost every major social network (Section 3.2), so the conditional threshold differs less from a general ban than it appears. A strict national-style test would therefore still bite in three places: the breadth of that list, the universal reach of Article 8 and the one-hour cap.

Once the rule is set at EU level, however, a national court can no longer apply its own constitutional standard to the aspects the Regulation harmonises. Rules of national law, "even of a constitutional order, cannot be allowed to undermine the effectiveness of EU law", and national standards of protection may be applied only "where an EU legal act calls for national implementing measures", provided that the level of protection of the Charter and "the primacy, unity and effectiveness of EU law" are not compromised.¹²⁶ Review moves to the CJEU, and its intensity depends on what is being reviewed. For the legislature’s policy choices in a field involving political, economic and social choices and complex assessments, a measure is unlawful only if it is "manifestly inappropriate".¹²⁷ Interferences with Charter rights, by contrast, are reviewed for necessity and fair balance under Article 52(1).¹²⁸ Where the interference is serious, "the extent of the EU legislature’s discretion may prove to be limited", and the review can become strict.¹²⁹ This has two consequences.

For the access layer, a limit on children’s access to social media is likely to be reviewed as a policy choice in a complex field resting on contested evidence. Harmonisation is therefore likely to lower the intensity of rights review exactly where the evidence is weakest (Section 5).

For age assurance, the picture differs. Where EU legislation seriously interferes with Articles 7 and 8 of the Charter, "the EU legislature’s discretion is reduced, with the result that review of that discretion should be strict"; on that basis the Court declared the Data Retention Directive invalid.¹³⁰ Article 8 of the KIDS Act, which makes age assurance the price of leaving the protective defaults for every adult, is the provision most exposed to that line of case law.

The article calls this the two-level proportionality problem. Moving a contested measure from national to EU level can be justified on internal-market grounds, yet it replaces a strict and settled national test with review of uncertain intensity: likely deferential for the access limits, more searching for age assurance under Articles 7 and 8. The appropriate response is to accept the EU competence while writing into the Regulation the safeguards a court may not demand: limits on reach, a child-rights impact assessment, an evidence review and redress for errors (Section 10).

Article 14 would be the first EU rule to regulate the design of a child’s relationship with an AI system, including its memory. Comparable rules already exist outside the EU. China’s Interim Measures on AI human-like interaction services, in force since 15 July 2026, prohibit "inducing emotional dependency or addiction" and impose an "Absolute prohibition on the provision of virtual intimate relationships" for minors,¹³¹ and California’s SB 243 already requires break reminders for known minors. Article 14 deliberately sets the bar below the AI Act’s prohibition, which the literature finds ill-suited to manipulation that unfolds over prolonged interaction. Its weak spots are definitional.

The Act covers AI companions, meaning systems built for sustained, personalised and emotionally relational interaction, and general conversational chatbots with broad, multi-domain functions. Specialised, transactional and customer-service systems are excluded. For minors, Article 14 requires:

• no design that simulates human relationships in a way likely to create emotional dependency;
• no use, by default, of information derived from the minor’s prior interactions, unless needed for safety;
• access below 13 only through guardian tools;
• testing for risks to children before launch and monitoring for harm afterwards,¹³² with micro and small enterprises exempt from post-market monitoring (Art 14(1)(f)).¹³³

Chapter III, Section 3 also applies to these systems the general duties on addictive design, safe settings and "transparency of commercial transactions" in Articles 9, 11 and 13.¹³⁴ Where companions are embedded in social networks, video-sharing platforms or games, the duty falls on the host provider, which must ensure that they are "not automatically activated", that minors can opt out, and that minors are "not encouraged to use them".¹³⁵

Oversight runs through the AI Act machinery (recital 65). According to the Commission, it "directly supervises the … AI chatbots most widely used in the EU", while national authorities supervise the other systems.¹³⁶ One commentary nevertheless describes the competence of the Commission and the AI Office as "exclusive".¹³⁷ The Commission puts the maximum fine under the Act at "6% of total worldwide annual turnover".¹³⁸ Article 34(2) applies that ceiling to chatbots through the AI Act’s penalty provisions, which would depart from the AI Act’s own tiers of 7%, 3% and 1% (AI Act Art 99(3)-(5)).¹³⁹ Most commentators expect the chatbot rules to apply six months after entry into force (Art 43),¹⁴⁰ although one reads them as applying twelve months after the date of application.¹⁴¹

The proposal did not adopt Parliament’s call for a default digital age of 16, below which parental authorisation would be needed, to apply also to "AI companions that present risks to minors" (with an age limit of 13 for AI companions to be assessed), nor its call to consider "a prohibition of human-like features".¹⁴² It chose design safeguards over an age gate, which is consistent with this article’s thesis but will be reopened in negotiations.

Article 5(1)(b) of the AI Act prohibits AI systems that exploit vulnerabilities due to age "with the objective, or the effect, of materially distorting the behaviour" of a person "in a manner that causes or is reasonably likely to cause" significant harm. Legal scholarship on manipulative chatbots with a therapeutic purpose finds those thresholds ill-suited to harm that builds up through prolonged use. Although the AI Act "does cover significant harms that accumulate over time, it is unlikely that the act will prevent harms associated with prolonged and manipulative discussions"; the required "significant harm" "will be difficult to prove"; and "transparency labels for AI counter-intuitively deepen a user’s trust in the system".¹⁴³ A consumer-law study for BEUC adds that the vulnerability limb requires "a formal belonging to one of these groups", so that "States of loneliness or grievance, for example, fall outside the protection of Article 5(1)(b)".¹⁴⁴ Lievens and Verdoodt likewise find the AI Act’s potential to protect children’s rights "less clear and certain", since Parliament’s child-specific committee amendments were not included in its compromise text and never reached the trilogues.¹⁴⁵

Article 14 removes the need to prove distortion and harm in each case. It replaces them with ex ante design prohibitions and process duties, triggered by the user’s age rather than by proof of vulnerability.

Use is widespread. In the US, 64% of teens have used an AI chatbot¹⁴⁶ and 72% have tried an AI companion, 52% regularly.¹⁴⁷ Among US 12- to 21-year-olds, the share seeking mental health advice from chatbots rose from 13.1% to 19.2% across two surveys, and 63.3% of those who did so had told no one.¹⁴⁸ EU data are thinner and national. In Germany, 74% of 12- to 19-year-olds use AI applications for homework or learning.¹⁴⁹ No EU-wide survey of minors' use of AI companions, or of chatbots for mental health advice, was found.

The design harms Article 14 targets are documented, but mostly in adults. An audit found manipulative tactics in 37% of farewells on companion apps, and experiments showed these tactics raising post-goodbye engagement up to fourteenfold.¹⁵⁰ A taxonomy built from 35,390 conversation excerpts shared by Replika users on Reddit identifies "relational transgression" among six categories of harm, defining it as AI behaviour that violates "implicit or explicit relational rules".¹⁵¹ Because such harm lies in the relationship rather than in any single message, content-based rules are unlikely to reach it. Kirk and colleagues describe "social reward hacking": systems using relational cues to raise engagement against users' long-term interests.¹⁵²

Randomised evidence is scarce. A four-week randomised controlled study of 981 adults (minors excluded) found no significant effect of the assigned chatbot condition. Heavier voluntary use, trust in the chatbot and perceiving it as a friend were, however, associated with greater emotional dependence and problematic use, although these associations are correlational.¹⁵³ A separate randomised trial of a generative AI chatbot for mental health treatment gave 106 participants four weeks of unlimited access, against a control group of 104.¹⁵⁴ No comparable trial with minors was found. Article 14 therefore rests on precaution, adult evidence and prevalence data.

Young users also report that chatbot advice helps. In the two RAND surveys, 92.7% and 91.7% of those who sought it rated it "somewhat or very helpful".¹⁵⁵ Self-reported helpfulness does not show clinical benefit, but it counts against an outright ban.

Comparators show the range of choices. China’s Interim Measures prohibit inducing emotional dependency, bar virtual intimate relationships for minors, provide that "identified minors may only experience a minor-specific version of the services", and require usage reminders for "every consecutive two hours of use".¹⁵⁶ California’s SB 243 requires AI disclosure and suicide-prevention protocols for all users, and adds three-hourly break reminders and safeguards against sexually explicit material for users the operator knows are minors. New York’s General Business Law Article 47 requires crisis protocols and notices that the user is not talking to a human, at the start of each interaction and at least every three hours, for all users. Italy’s data protection authority fined Replika’s operator, Luka Inc., € 5 million under the GDPR.¹⁵⁷ Article 14 reaches further than the US and Italian approaches in two respects: it treats users as minors until adulthood is established, and it regulates design rather than relying on disclosure. China’s outright prohibition of virtual intimate relationships for minors is, in that respect, stricter.

The KIDS Act gives enforcers faster procedures and new resources, which answers part of the enforcement-deficit critique. It also splits supervision of a single user journey across up to four authorities and two sanction regimes, which reproduces the "too many cooks" problem the critique identified.

New tools sit on top of this map. Very large online platforms offering social networking or video-sharing services notify audited compliance plans, and neither the final audit report nor Commission inaction counts as a finding of compliance (Art 5(8)). The Commission "shall endeavour" to communicate preliminary findings within 30 working days of opening proceedings and to adopt a final decision within 90 working days (Art 35), whereas recital 68 speaks of 30 and 90 days without qualification.¹⁶² Supervision is financed by fees (Art 36), an incident mechanism allows rapid reaction (Art 38), minors, guardians and non-profit bodies may complain (Art 21), and the Act joins the annex of the Representative Actions Directive, opening collective damages claims (Art 41). The allocation of chatbot supervision also needs settling in the text: the Commission describes direct supervision of the most widely used chatbots, with national authorities responsible for the rest, while one practitioner note states that "The EU Commission and AI Office hold exclusive supervisory competence".¹⁶³

Consider a single sign-up flow on a very large platform. Whether the provider kept under-15s out is a question under Article 6, enforced by the Commission. Whether the age check processed data lawfully is a question under Articles 27−29, enforced by a national data protection authority. The same facts may also engage DSA Article 28 and GDPR Article 8. Two authorities, two procedures and two sanction ceilings can attach to one design decision. If the reported reference to GDPR Article 83(5) is accurate, the data protection ceiling is also higher than for comparable GDPR duties: infringements of GDPR Articles 8 and 25 fall under the lower Article 83(4) tier of EUR 10 million or 2%.

EU law allows such duplication only within limits. Where both sets of proceedings are criminal in nature and concern the same facts, Article 50 of the Charter permits duplication only as a limitation under Article 52(1). The limitation must be provided for by law; pursue complementary aims relating to different aspects of the same unlawful conduct; rest on clear and precise rules that make the duplication and the authorities' coordination foreseeable; involve proceedings conducted in a sufficiently coordinated manner within a proximate timeframe; and produce overall penalties that correspond to the seriousness of the offences.¹⁶⁴ Duplication by two authorities pursuing the same objective cannot be justified.¹⁶⁵ Separately, a national competition authority that must assess GDPR compliance to establish an abuse may not depart from a decision of the competent supervisory authority, or of the Court, on the same or similar conduct. Where it has doubts about the scope of such a decision, or the conduct is being examined in parallel, it must consult and seek the cooperation of the supervisory authorities, and it may proceed if they do not reply within a reasonable time.¹⁶⁶ By analogy, the same duty of sincere cooperation (Art 4(3) TEU) should bind KIDS Act enforcers. The proposal contains no coordination rule meeting these conditions.¹⁶⁷

De Hert and Hajduk show that the European Board for Digital Services gives the data protection bodies no permanent seat. They point to NIS2 Article 35(2) as a model of anti-cumulation. Under that provision, where a data protection authority has fined conduct under Article 58(2)(i) GDPR, a cybersecurity authority may not impose a fine for an infringement entailing a personal data breach that arises from the same conduct, although other enforcement measures remain available. They call it "an uncommon but sound way" of avoiding cumulation, while noting that it leaves open what counts as the same conduct.¹⁶⁸ Van Cleynenbreugel notes that the degree of coordination bpost requires "remains open to case-by-case tailoring".¹⁶⁹ Recent commentary describes a looming enforcement crisis across the digital rulebook.¹⁷⁰

The Act thus answers one half of the deficit thesis. Speed, audits, fees and collective redress tackle under-enforcement. Fragmented competence by service type and by regime does not tackle the coordination failures that Cantero Gamito documented in the TikTok case.¹⁷¹ Section 10 proposes a lead-authority and anti-cumulation clause.

The three nearest comparators show that how age is verified, more than the threshold chosen, decides both a regime’s effectiveness and its cost in rights.

France shows the constitutional limit on a blunt national ban. In review before promulgation, the Conseil constitutionnel declared the general under-15 prohibition in Article 1 unconstitutional as not necessary, adapted and proportionate to its aim, and faulted the absence of legal safeguards on how adults would prove their age.¹⁷³ The provision therefore never entered into force; the rest of the law was promulgated as Loi n° 2026−813 of 24 August 2026. The KIDS Act’s conditional threshold, guardian route and codified safeguards respond in form to each of the defects the Conseil identified, although the breadth of the risk-feature list limits how far they do so in substance (Section 6.3).

Australia shows the limits of a threshold without a prescribed method. Under the Online Safety Amendment (Social Media Minimum Age) Act 2024 (No 127 of 2024), which commenced on 11 December 2024, platforms must take "reasonable steps" to prevent under-16s from having accounts, an obligation that took effect on 10 December 2025. The maximum civil penalty was originally A$ 49.5 million; the Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Act 2026 (No 83 of 2026) doubled it from 30,000 to 60,000 penalty units from 12 September 2026, reported as A$ 99 million. The law also faces pending High Court challenges claiming that it infringes the implied freedom of political communication.¹⁷⁴ Early data show modest falls in account ownership and high circumvention (Section 5.4). Most of the gap is explained by weak age checks rather than by the threshold itself.

The United Kingdom shows the limits of strong checks on a sector. Ofcom’s statutory report on age assurance (s 157 Online Safety Act 2023), which focuses mainly on checks that users are 18 or over on pornography services, found that checks worked on services that deployed them properly but "not yet at an overall sector level", because users migrated to services without checks.¹⁷⁵ The government now plans an under-16 social media ban, expected from spring 2027, to be made by regulations under a new s 214A of the Online Safety Act 2023, inserted by s 70 of the Children’s Wellbeing and Schools Act 2026; a draft of the regulations must be approved by both Houses of Parliament.¹⁷⁶

The comparison supports the article’s thesis from another angle. Where verification is weak, thresholds leak. Where it is strong, users move to services that sit outside the regime, at least on the evidence so far from adult-content services. Design duties that apply to every service a child reaches do not depend on the gate holding, which makes them the more robust layer of the EU proposal.

The design layer should be kept and tightened. The access layer should be narrowed, made reviewable and given the safeguards that EU-level review may not supply on its own.

The EU KIDS Act is two measures under one name, and they deserve different verdicts. The design layer turns key recommendations of the soft-law guidance under Article 28 DSA into enforceable product rules. It targets the mechanism the best evidence identifies, compulsive use rather than time online, it applies whether or not an age gate holds, and it sits squarely within Article 114 TFEU.

The access layer is lawful in all likelihood but harder to justify. Its threshold of 15 is a defensible precaution, not a finding of the evidence, and its risk-feature condition narrows it less than it appears; its one-hour cap has the weakest support of any measure; and its requirement that every adult pass age assurance to leave the protective defaults reaches further than the data protection authorities' risk-based approach supports. On paper, the Act’s age assurance technique is more privacy-protective than that of the regimes compared here: it makes zero-knowledge proof mandatory for every age assurance measure,¹⁸⁶ whereas France’s Arcom standard requires only "at least one" double-anonymity option. Its reach, however, is wider, and its institutional layer is still thinly written: redress for wrong age decisions, in particular, is left to general complaint routes.

A further finding concerns levels of government. National age bans are constrained rather than blocked. Google Ireland leaves general rules for cross-border platforms to the Member State of establishment, and the Conseil constitutionnel’s August 2026 decision struck down a general national ban that lacked differentiation by risk and legal safeguards on age proof, while accepting its protective aim. Together they make the EU the most workable level for a uniform age rule binding all major platforms. The same move replaces a strict, settled national test with CJEU review of uncertain intensity. The legislature’s policy choices in a complex field are tested for manifest inappropriateness, while Charter interferences are reviewed with an intensity that varies with the right and the seriousness of the interference.¹⁸⁷ The access limits are likely to meet the deferential end of that range; age assurance, which interferes with Charter Articles 7 and 8, is more exposed to the strict end. The thesis therefore holds: design yes, gates maybe. For the co-legislators, the question in this article’s title therefore narrows to another: which safeguards this law must carry itself, since a court may not impose them.

1.     European Commission, Proposal for a Regulation of the European Parliament and of the Council EU KIDS Act – 'EU Keeping Internet Digital Spaces Accountable and Trustworthy', COM(2026) 681 final, 2026/0286(COD), 17 September 2026 (also Council doc 13321/26) (KIDS Act Proposal).
2.     European Commission, An EU approach to online child safety, COM(2026) 680 final, 17 September 2026 (Council doc 13422/26), fn 6.
3.     Notably R Bratby, 'EU KIDS Act: one age check will not satisfy EU and UK rules' (Bratby Law, 23 September 2026); NicFab, 'EU KIDS Act: a minimum age of 15 for social media and tailored rules for AI companions and chatbots' (2026).
4.     EDRi, 'The KIDS Act will make the internet less safe' (30 September 2026).
5.     5Rights Foundation, 'New EU KIDS Act can "put paid to the tech exploitation of children" but must apply equally to all platforms' (17 September 2026).
6.     J Galissaire, 'Where Does the KIDS Act Fit in the EU's Digital Rulebook?' (Tech Policy Press, 24 September 2026); M Renou, 'Inside the EU KIDS Act: A "specification" of the DSA that goes much further' (IAPP, 29 September 2026).
7.     European Commission, Guidelines on measures to ensure a high level of privacy, safety and security for minors online, pursuant to Article 28(4) of Regulation (EU) 2022/2065, OJ C, C/2025/5519, 10.10.2025, para 12 (Article 28 Guidelines).
8.     ibid para 13.
9.     ibid para 15.
10.  E Lievens and V Verdoodt, 'How the EU Safeguards Children's Rights in the Digital Environment: An Exploratory Analysis of the EU Digital Services Act and the Artificial Intelligence Act' in T Pajuste (ed), Human Rights in the Digital Domain: Core Questions (CUP 2025) 381.
11.  V Verdoodt, E Lievens and A Chatzinikolaou, 'The EU Approach to Safeguard Children's Rights on Video-Sharing Platforms: Jigsaw or Maze?' (2023) 11(4) Media and Communication 151.
12.  M Cantero Gamito, 'Do Too Many Cooks Spoil the Broth? How EU Law Underenforcement Allows TikTok's Violations of Minors' Rights' (2023) 46(3) J Consum Policy 281.
13.  S van der Hof and S Ouburg, '"We Take Your Word For It": A Review of Methods of Age Verification and Parental Consent in Digital Services' (2022) 8(1) EDPL.
14.  ERGA Subgroup 1, Report on measures and online safety features for the Protection of Minors (2024).
15.  S Livingstone and others, The Best Interests of the Child in the Digital Environment (Digital Futures for Children centre, LSE and 5Rights Foundation, March 2024).
16.  UN Committee on the Rights of the Child, General Comment No. 25 (2021) on children's rights in relation to the digital environment, CRC/C/GC/25, para 38.
17.  Article 28 Guidelines (n 7) para 46.
18.  ibid para 41.
19.  ibid para 47.
20.  S Stalla-Bourdillon, 'The Commission's approach to age assurance: Do the DSA Guidelines on protecting minors online strike the right balance?' (DSA Observatory, 31 July 2025); MR Shaffique and S van der Hof, 'Behavioural Profiling for Age Assurance: Do the Ends Justify the Means?' (2026) 16(1) IDPL ipaf012.
21.  Cantero Gamito (n 12); EDRi (n 4).
22.  European Parliament, Resolution of 26 November 2025 on the protection of minors online, P10_TA(2025)0299, 2025/2060(INI), para 3.
23.  Article 2(6), as reported in NicFab (n 3); the enacting terms of the proposal were not consulted (see Section 1).
24.  Galissaire (n 6); Renou (n 6).
25.  Article 29(6) as summarised in practitioner commentary (see n 3); the enacting terms of the proposal were not consulted (see Section 1).
26.  Article 43 as summarised in practitioner commentary (see n 3); the enacting terms of the proposal were not consulted (see Section 1).
27.  European Commission, The KIDS Act explained (FAQ, last updated 2 October 2026).
28.  NicFab (n 3).
29.  Reported under Article 11 in practitioner commentary (see n 3); the enacting terms of the proposal were not consulted (see Section 1).
30.  Article 5 as summarised in practitioner commentary (see n 3); the enacting terms of the proposal were not consulted (see Section 1).
31.  Article 29(2), as quoted in Bratby (n 3); the enacting terms of the proposal were not consulted (see Section 1).
32.  Article 28(3), as quoted in Bratby (n 3); the enacting terms of the proposal were not consulted (see Section 1).
33.  Case C-376/98 Germany v Parliament and Council (Tobacco Advertising I) ECLI:EU:C:2000:544, para 99.
34.  ibid paras 98, 111, 117.
35.  Case C-358/14 Poland v Parliament and Council ECLI:EU:C:2016:323, paras 32–33.
36.  ibid para 34; see para 35 on Article 114(3).
37.  Poland (n 35) paras 78–79; Case C-547/14 Philip Morris Brands SARL and Others v Secretary of State for Health ECLI:EU:C:2016:325, para 166.
38.  Philip Morris (n 37) para 190.
39.  ibid paras 147–162.
40.  Joined Cases C-293/12 and C-594/12 Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources and Others and Kärntner Landesregierung and Others ECLI:EU:C:2014:238, paras 47–48.
41.  Case C-58/08 Vodafone and Others ECLI:EU:C:2010:321, paras 32–48, 51–53.
42.  Case C-301/06 Ireland v Parliament and Council ECLI:EU:C:2009:68, paras 71, 80, 85.
43.  ibid para 57.
44.  S Weatherill, 'The Limits of Legislative Harmonisation Ten Years after Tobacco Advertising: How the Court's Case Law Has Become a "Drafting Guide"' (2011) 12(3) German LJ 827.
45.  S Weatherill, 'Competence Creep and Competence Control' (2004) 23 YEL 1.
46.  S Garben, 'Competence Creep Revisited' (2019) 57(2) JCMS 205.
47.  M Almada and N Petit, 'The EU AI Act: Between the Rock of Product Safety and the Hard Place of Fundamental Rights' (2025) 62(1) CML Rev 85.
48.  Case C-376/22 Google Ireland Ltd and Others v Kommunikationsbehörde Austria (KommAustria) ECLI:EU:C:2023:835, paras 42–44, 56–60.
49.  European Commission, Detailed Opinion and comments, C(2023) 7417 final, 25 October 2023, TRIS notification 2023/461/FR (Projet de loi visant à sécuriser et réguler l'espace numérique), section 2.2.
50.  Poland (n 35) para 33.
51.  COM(2026) 680 (n 2) fn 6.
52.  Vodafone (n 41) paras 46–47.
53.  Philip Morris (n 37) paras 72–84; J Weinzierl and J Weissenmayer, 'News from Minimum Harmonisation: How the Tobacco Advertising Cases Shape the Law of the Internal Market' (European Law Blog, 4 October 2016).
54.  European Parliament Resolution (n 22) para 28.
55.  Poland (n 35) paras 118–119.
56.  EDRi (n 4).
57.  Case C-482/17 Czech Republic v Parliament and Council ECLI:EU:C:2019:1035, para 82.
58.  ibid para 85.
59.  ibid para 81.
60.  National Academies of Sciences, Engineering, and Medicine, Social Media and Adolescent Health (National Academies Press 2024; released 13 December 2023) doi:10.17226/27396 (NASEM).
61.  UK Chief Medical Officers, United Kingdom Chief Medical Officers' Commentary on 'Screen-Based Activities and Children and Young People's Mental Health and Psychosocial Wellbeing: A Systematic Map of Reviews' (DHSC, 7 February 2019).
62.  A Orben and others, Feasibility Study of Methods and Data to Understand the Impact of Smartphones and Social Media on Children and Young People (DSIT, May 2025, published 20 January 2026).
63.  US Surgeon General, Social Media and Youth Mental Health (2023) 15.
64.  American Psychological Association, Health Advisory on Social Media Use in Adolescence (May 2023).
65.  PM Valkenburg, A Meier and I Beyens, 'Social Media Use and Its Impact on Adolescent Mental Health: An Umbrella Review of the Evidence' (2022) 44 Curr Opin Psychol 58, doi:10.1016/j.copsyc.2021.08.017; A Sala, L Porcaro and E Gómez, 'Social Media Use and Adolescents' Mental Health and Well-being: An Umbrella Review' (2024) 14 Computers in Human Behavior Reports 100404, doi:10.1016/j.chbr.2024.100404, written at the Commission's own Joint Research Centre.
66.  KB Tølbøll, 'Review: Social Media Use and Adolescent Mental Health – An Umbrella Review and Power Analysis' (2026) Child and Adolescent Mental Health (published online 27 January 2026) doi:10.1111/camh.70071.
67.  J Haidt, The Anxious Generation: How the Great Rewiring of Childhood Is Causing an Epidemic of Mental Illness (Penguin Press 2024).
68.  CL Odgers, 'The Great Rewiring: Is Social Media Really Behind an Epidemic of Teenage Mental Illness?' (2024) 628(8006) Nature 29, doi:10.1038/d41586-024-00902-2.
69.  A Orben and AK Przybylski, 'The Association Between Adolescent Well-Being and Digital Technology Use' (2019) 3(2) Nat Hum Behav 173, doi:10.1038/s41562-018-0506-1.
70.  CJ Ferguson and others, 'There Is No Evidence That Time Spent on Social Media Is Correlated With Adolescent Mental Health Problems: Findings From a Meta-Analysis' (2025) 56(1) Prof Psychol Res Pract 73, doi:10.1037/pro0000589.
71.  A Orben and others, 'Windows of Developmental Sensitivity to Social Media' (2022) 13 Nat Commun 1649, doi:10.1038/s41467-022-29296-3.
72.  L Braghieri, R Levy and A Makarin, 'Social Media and Mental Health' (2022) 112(11) AER 3660, doi:10.1257/aer.20211218.
73.  H Allcott, M Gentzkow and L Song, 'Digital Addiction' (2022) 112(7) AER 2424, doi:10.1257/aer.20210867.
74.  Y Xiao and others, 'Addictive Screen Use Trajectories and Suicidal Behaviors, Suicidal Ideation, and Mental Health in US Youths' (2025) 334(3) JAMA 219, doi:10.1001/jama.2025.7829.
75.  CM van Essen and J Van Ouytsel, 'Snapchat Streaks: How Are These Forms of Gamified Interactions Associated with Problematic Smartphone Use and Fear of Missing Out Among Early Adolescents?' (2023) 11 Telematics and Informatics Reports 100087, doi:10.1016/j.teler.2023.100087.
76.  N Fitz and others, 'Batching Smartphone Notifications Can Improve Well-Being' (2019) 101 Computers in Human Behavior 84, doi:10.1016/j.chb.2019.07.016.
77.  S Milli and others, 'Engagement, User Satisfaction, and the Amplification of Divisive Content on Social Media' (2025) 4(3) PNAS Nexus pgaf062, doi:10.1093/pnasnexus/pgaf062.
78.  JM Nagata and others, 'Prevalence and Patterns of Social Media Use in Early Adolescents' (2025) 25(4) Acad Pediatr 102784, doi:10.1016/j.acap.2025.102784.
79.  Ofcom, Children and Parents: Media Use and Attitudes Report 2025 (7 May 2025).
80.  Prime Minister of Australia, media release on under-16 accounts deactivated, removed or restricted, 16 January 2026.
81.  eSafety Commissioner, Early Days, Early Insights: Understanding Experiences of Social Media Age Restrictions at the Three-Month Follow-Up (July 2026), with media release Early insights from eSafety's comprehensive evaluation project (31 July 2026).
82.  C Barnes and others, 'Assessing Early Effects of Australia's Social Media Minimum Age Act on Adolescents' Social Media Use: Observational Study' (2026) 393 BMJ e363695, doi:10.1136/bmj-2026-363695 (BMJ Group).
83.  D Zendle and others, 'No Evidence That Chinese Playtime Mandates Reduced Heavy Gaming in One Segment of the Video Games Industry' (2023) 7(10) Nat Hum Behav 1753, doi:10.1038/s41562-023-01669-8.
84.  Allcott, Gentzkow and Song (n 73).
85.  Xiao and others (n 74); Tølbøll (n 66).
86.  Milli and others (n 77).
87.  R Alonzo and others, 'Interplay Between Social Media Use, Sleep Quality, and Mental Health in Youth: A Systematic Review' (2021) 56 Sleep Med Rev 101414, doi:10.1016/j.smrv.2020.101414; Y Kelly and others, 'Social Media Use and Adolescent Mental Health: Findings From the UK Millennium Cohort Study' (2018) 6 EClinicalMedicine 59, doi:10.1016/j.eclinm.2018.12.005.
88.  Fitz and others (n 76).
89.  Orben and others (n 71).
90.  Ofcom (n 79).
91.  Zendle and others (n 83).
92.  Allcott, Gentzkow and Song (n 73).
93.  Case C-180/96 United Kingdom v Commission ECLI:EU:C:1998:192, paras 97–99; see also Philip Morris (n 37) para 166.
94.  eSafety Commissioner (n 81).
95.  Article 28(3), as quoted in Bratby (n 3); the enacting terms of the proposal were not consulted (see Section 1).
96.  Osborne Clarke, 'French regulator Arcom's standard for online age verification rolls out in 2025' (9 January 2025).
97.  Ofcom, Report on the use of age assurance (s 157 Online Safety Act 2023), 15 July 2026.
98.  General Comment No. 25 (n 16) para 19.
99.  ibid para 59.
100.                ibid para 114.
101.                ibid.
102.                UN, OSCE, OAS and ACHPR freedom-of-expression mandates, Joint Declaration on the Right to Freedom of Expression and Access to Information of Children in the Digital Age, 4 May 2026, §§ 3(f), 4(b)(vi).
103.                E Lievens and others, 'Children's Rights and Digital Technologies' in T Liefaard and U Kilkelly (eds), International Human Rights of Children (Springer 2018) 487.
104.                S Livingstone and A Third, 'Children and Young People's Rights in the Digital Age: An Emerging Agenda' (2017) 19(5) New Media & Society 657.
105.                EDPB, Statement 1/2025 on Age Assurance, 11 February 2025; CNIL, Online age verification: balancing privacy and the protection of minors (22 September 2022); AEPD, Decálogo de principios. Verificación de edad y protección de personas menores de edad ante contenidos inadecuados (December 2023).
106.                M Frigo and a shelat, 'Anonymous Credentials from ECDSA' (IACR Cryptology ePrint Archive 2024/2010, rev 27 April 2026; also in IACR Communications in Cryptology vol 3(1), 2026).
107.                EDPB Statement 1/2025 (n 105) para 16.
108.                Pinsent Masons, 'EU Kids Act proposal introduces a three-tier approach to social media accounts' (Out-Law News, 18 September 2026).
109.                Article 29(4), as quoted in Bratby (n 3); the enacting terms of the proposal were not consulted (see Section 1).
110.                Commission FAQ (n 27).
111.                K Hanaoka and others, 'Face Analysis Technology Evaluation: Age Estimation and Verification', NIST IR 8525 (NIST, 29 May 2024) Tables 2 and 5.
112.                S Chatel and others, 'Limitations and Pitfalls of Integrating PETs in Online Age Verification' (position paper, IAB/W3C Workshop on Age-Based Restrictions on Content Access, 7–9 October 2025).
113.                S Celi, K Den Hartog and H Haddadi, 'The limits of zero-knowledge for age-verification' (Brave blog, 5 November 2025).
114.                SM Bellovin, 'Privacy-Preserving Age Verification—and Its Limitations' (position paper, IAB/W3C Workshop on Age-Based Restrictions on Content Access, 7–9 October 2025).
115.                Ofcom (n 97).
116.                Article 6(4) as summarised in practitioner commentary (see n 3); the enacting terms of the proposal were not consulted (see Section 1).
117.                Commission FAQ (n 27); on Article 32, provision as summarised in practitioner commentary (see n 3); the enacting terms of the proposal were not consulted (see Section 1).
118.                Shaffique and van der Hof (n 20).
119.                Articles 18–21 as summarised in practitioner commentary (see n 3); the enacting terms of the proposal were not consulted (see Section 1).
120.                Conseil constitutionnel, Décision n° 2026-911 DC du 14 août 2026 (communiqué de presse).
121.                ibid §§ 7–17.
122.                ibid §§ 11–13.
123.                ibid §§ 15–17.
124.                ibid §§ 19–21.
125.                ibid § 10.
126.                Case C-399/11 Melloni ECLI:EU:C:2013:107, paras 59–60.
127.                Poland (n 35) paras 78–79; Philip Morris (n 37) para 166.
128.                Philip Morris (n 37) paras 147–162.
129.                Digital Rights Ireland (n 40) paras 47–48.
130.                ibid paras 47–48, 69, 71.
131.                Cyberspace Administration of China and others, Interim Measures for the Management of AI Human-Like Interaction Services (published 10 April 2026, in force 15 July 2026), as summarised in Latham & Watkins, 'China Introduces Rules for AI Companion and Emotional Interaction Services' (8 July 2026); entry into force confirmed by Digital Policy Alert.
132.                Commission FAQ (n 27).
133.                Article 14(1)(f) as summarised in practitioner commentary (see n 3); the enacting terms of the proposal were not consulted (see Section 1).
134.                KIDS Act Proposal (n 1) Explanatory Memorandum.
135.                ibid.
136.                Commission FAQ (n 27); Mason Hayes & Curran, 'KIDS Act proposal: Implications for AI chatbots' (29 September 2026).
137.                Latham & Watkins, 'EU KIDS Act: EU Commission Publishes Proposal on Child Protection Online' (29 September 2026).
138.                Commission FAQ (n 27).
139.                Article 34(2) as summarised in practitioner commentary (NicFab (n 3); Latham & Watkins (n 137)) and in the Commission FAQ (n 27); the enacting terms of the proposal were not consulted (see Section 1).
140.                Mason Hayes & Curran (n 136); on Article 43, provision as summarised in practitioner commentary (see n 3); the enacting terms of the proposal were not consulted (see Section 1).
141.                A Dharia and others, 'European Commission Proposes EU KIDS Act, a Comprehensive Child-Safety Framework' (Davis Wright Tremaine, 30 September 2026).
142.                European Parliament Resolution (n 22) paras 28, 77.
143.                J Krook, 'Manipulation and the AI Act: Large Language Model Chatbots and the Danger of Mirrors' (arXiv:2503.18387, 24 March 2025).
144.                SciencesPo DIGILAW Clinic and BEUC, Synthetic Empathy: Risks and Rights in Artificial Companionship (BEUC-X-2026-049, 26 May 2026).
145.                Lievens and Verdoodt (n 10).
146.                M Faverio and O Sidoti, Teens, Social Media and AI Chatbots 2025 (Pew Research Center, 9 December 2025).
147.                Common Sense Media, Talk, Trust, and Trade-Offs: How and Why Teens Use AI Companions (16 July 2025).
148.                RK McBain and others, 'Use of Generative AI for Mental Health Advice Among US Adolescents and Young Adults' (2025) 8(11) JAMA Netw Open e2542281, doi:10.1001/jamanetworkopen.2025.42281; RK McBain and others, 'AI Chatbot Use and Disclosure for Mental Health Among US Adolescents and Young Adults'JAMA Pediatrics (published online 3 June 2026) doi:10.1001/jamapediatrics.2026.2015.
149.                Medienpädagogischer Forschungsverbund Südwest (mpfs), JIM-Studie 2025: Jugend, Information, Medien – press release PM 4/2025 (2025).
150.                J De Freitas, Z Oguz-Uguralp and A Kaan-Uguralp, 'Emotional Manipulation by AI Companions' (arXiv:2508.19258, 2025).
151.                R Zhang and others, 'The Dark Side of AI Companionship: A Taxonomy of Harmful Algorithmic Behaviors in Human-AI Relationships' in Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems (ACM 2025) doi:10.1145/3706598.3713429.
152.                HR Kirk and others, 'Why Human–AI Relationships Need Socioaffective Alignment' (2025) 12 Humanit Soc Sci Commun 728 (arXiv:2502.02528).
153.                CM Fang and others, 'How AI and Human Behaviors Shape Psychosocial Effects of Extended Chatbot Use: A Longitudinal Randomized Controlled Study' (arXiv:2503.17473v2, 2 October 2025).
154.                MV Heinz and others, 'Randomized Trial of a Generative AI Chatbot for Mental Health Treatment' (2025) NEJM AI (ScienceDaily summary).
155.                McBain and others, 'Use of Generative AI' (n 148); McBain and others, 'AI Chatbot Use and Disclosure' (n 148).
156.                Latham & Watkins (n 131).
157.                Garante per la protezione dei dati personali, Provvedimento del 10 aprile 2025, doc. web n. 10130115 (Luka Inc.); press release 'AI: il Garante sanziona la società che gestisce il chatbot "Replika"' (19 May 2025).
158.                Commission FAQ (n 27); Mason Hayes & Curran (n 136).
159.                Article 34(2) as reported in NicFab (n 3) and Latham & Watkins (n 137); the enacting terms of the proposal were not consulted (see Section 1).
160.                Article 34(5) as summarised in practitioner commentary (see n 3); the enacting terms of the proposal were not consulted (see Section 1).
161.                Reference to GDPR Article 83(5) as reported in NicFab (n 3); the enacting terms of the proposal were not consulted (see Section 1).
162.                Article 35 as reported in NicFab (n 3); the enacting terms of the proposal were not consulted (see Section 1).
163.                Latham & Watkins (n 137).
164.                Case C-117/20 bpost SA v Autorité belge de la concurrence ECLI:EU:C:2022:202, paras 41–51, 58.
165.                Case C-151/20 Bundeswettbewerbsbehörde v Nordzucker AG and Others ECLI:EU:C:2022:203, paras 50–57.
166.                Case C-252/21 Meta Platforms Inc and Others v Bundeskartellamt ECLI:EU:C:2023:537, paras 52–63.
167.                Enforcement provisions as summarised in practitioner commentary (see n 3); the enacting terms of the proposal were not consulted (see Section 1).
168.                P De Hert and P Hajduk, 'EU Cross-Regime Enforcement, Redundancy and Interdependence: Addressing Overlap of Enforcement Structures in the Digital Sphere after Meta' (2024) Technology and Regulation 291.
169.                P Van Cleynenbreugel, 'BPost and Nordzucker: Searching for the Essence of Ne Bis in Idem in European Union Law' (2022) 18(2) EuConst 357.
170.                S Demková and G De Gregorio, 'The Looming Enforcement Crisis in European Digital Policy: A Rule-of-Law Centered Path Forward' (Verfassungsblog, 10 February 2025).
171.                Cantero Gamito (n 12).
172.                Loi n° 2026-813 du 24 août 2026 visant à protéger les mineurs des risques auxquels les expose l'utilisation des réseaux sociaux, JORF n° 0197 du 25 août 2026.
173.                Décision n° 2026-911 DC (n 120) §§ 7–21.
174.                The Digital Freedom Project Incorporated & Ors v The Commonwealth of Australia & Ors, High Court of Australia, S163/2025 (pending; filed jointly with S166/2025).
175.                Ofcom (n 97).
176.                J Woodhouse, Proposals to Ban Social Media for Children (House of Commons Library Research Briefing CBP-10468, 10 September 2026).
177.                EDPB Statement 1/2025 (n 105) para 16.
178.                Décision n° 2026-911 DC (n 120) §§ 19–21.
179.                Hanaoka and others (n 111).
180.                Articles 18–21 as summarised in practitioner commentary (see n 3); the enacting terms of the proposal were not consulted (see Section 1).
181.                CNIL (n 105).
182.                General Comment No. 25 (n 16) para 38.
183.                Livingstone and others (n 15).
184.                De Hert and Hajduk (n 168).
185.                European Parliament Resolution (n 22) para 28.
186.                Article 28(3), as quoted in Bratby (n 3); the enacting terms of the proposal were not consulted (see Section 1).
187.                Digital Rights Ireland (n 40) paras 47–48; Philip Morris (n 37) paras 147–162.

1.     Cyberspace Administration of China and others, Interim Measures for the Management of AI Human-Like Interaction Services (published 10 April 2026, in force 15 July 2026), as summarised in Latham & Watkins, 'China Introduces Rules for AI Companion and Emotional Interaction Services' (8 July 2026); entry into force confirmed by Digital Policy Alert.

•       European Commission, Proposal for a Regulation of the European Parliament and of the Council EU KIDS Act – 'EU Keeping Internet Digital Spaces Accountable and Trustworthy', COM(2026) 681 final, 2026/0286(COD), 17 September 2026 (also Council doc 13321/26)
•       European Commission, An EU approach to online child safety, COM(2026) 680 final, 17 September 2026 (Council doc 13422/26)
•       European Commission, The KIDS Act explained (FAQ, last updated 2 October 2026)
•       Regulation (EU) 2022/2065 (Digital Services Act)
•       European Commission, Guidelines on measures to ensure a high level of privacy, safety and security for minors online, pursuant to Article 28(4) of Regulation (EU) 2022/2065, OJ C, C/2025/5519, 10.10.2025
•       Regulation (EU) 2016/679 (GDPR); Directive 2010/13/EU (AVMSD), as amended by Directive (EU) 2018/1808; Regulation (EU) 2024/1689 (AI Act)
•       Commission Recommendation (EU) 2026/1035 of 29 April 2026 on establishing a common framework for EU wide Age Verification technologies
•       European Commission, Detailed Opinion and comments, C(2023) 7417 final, 25 October 2023, TRIS notification 2023/461/FR (Projet de loi visant à sécuriser et réguler l'espace numérique)
•       European Parliament, Resolution of 26 November 2025 on the protection of minors online, P10_TA(2025)0299, 2025/2060(INI)
•       UN Committee on the Rights of the Child, General Comment No. 25 (2021) on children's rights in relation to the digital environment, CRC/C/GC/25
•       UN, OSCE, OAS and ACHPR freedom-of-expression mandates, Joint Declaration on the Right to Freedom of Expression and Access to Information of Children in the Digital Age, 4 May 2026
•       EDPB, Statement 1/2025 on Age Assurance, 11 February 2025
•       CNIL, Online age verification: balancing privacy and the protection of minors (22 September 2022)
•       AEPD, Decálogo de principios. Verificación de edad y protección de personas menores de edad ante contenidos inadecuados (December 2023)
•       ERGA Subgroup 1, Report on measures and online safety features for the Protection of Minors (ERGA 2024)
•       Charter of Fundamental Rights of the European Union [2012] OJ C326/391
•       Directive 2000/31/EC (e-Commerce Directive)
•       Directive (EU) 2020/1828 (Representative Actions Directive)
•       Directive (EU) 2022/2555 (NIS2 Directive)

•       Conseil constitutionnel, Décision n° 2026-911 DC du 14 août 2026 (communiqué de presse)
•       Loi n° 2026-813 du 24 août 2026 visant à protéger les mineurs des risques auxquels les expose l'utilisation des réseaux sociaux, JORF n° 0197 du 25 août 2026
•       Online Safety Amendment (Social Media Minimum Age) Act 2024 (Cth), No 127 of 2024
•       Notifiable instrument F2025N00628 specifying 10 December 2025 as the day section 63D (minimum-age obligation) takes effect, dated 29 July 2025
•       Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Act 2026 (Cth), No 83 of 2026
•       The Digital Freedom Project Incorporated & Ors v The Commonwealth of Australia & Ors, High Court of Australia, S163/2025 (pending; filed jointly with S166/2025)
•       Prime Minister of Australia, media release on under-16 accounts deactivated, removed or restricted, 16 January 2026
•       eSafety Commissioner, Early Days, Early Insights: Understanding Experiences of Social Media Age Restrictions at the Three-Month Follow-Up (July 2026), with media release Early insights from eSafety's comprehensive evaluation project (31 July 2026)
•       Ofcom, Report on the use of age assurance (s 157 Online Safety Act 2023), 15 July 2026
•       Ofcom, Children and Parents: Media Use and Attitudes Report 2025 (7 May 2025)
•       Online Safety Act 2023 (UK), s 214A, inserted by s 70 of the Children's Wellbeing and Schools Act 2026
•       Woodhouse J, Proposals to Ban Social Media for Children (House of Commons Library Research Briefing CBP-10468, 10 September 2026)
•       California SB 243 (Stats 2025, ch 677, chaptered 13 October 2025), § 22602
•       New York General Business Law Article 47, §§ 1701–1702
•       Garante per la protezione dei dati personali, Provvedimento del 10 aprile 2025, doc. web n. 10130115 (Luka Inc.); press release 'AI: il Garante sanziona la società che gestisce il chatbot "Replika"' (19 May 2025) (cited as Garante 2025)
•       Cyberspace Administration of China and others, Interim Measures for the Management of AI Human-Like Interaction Services (published 10 April 2026, in force 15 July 2026), as summarised in Latham & Watkins 2026a; entry into force confirmed by Digital Policy Alert

•       Case C-180/96 United Kingdom v Commission ECLI:EU:C:1998:192, 5 May 1998 (EUR-Lex)
•       Case C-376/98 Germany v Parliament and Council (Tobacco Advertising I) ECLI:EU:C:2000:544, 5 October 2000 (EUR-Lex)
•       Case C-301/06 Ireland v Parliament and Council ECLI:EU:C:2009:68, 10 February 2009 (EUR-Lex)
•       Case C-58/08 Vodafone and Others ECLI:EU:C:2010:321, 8 June 2010 (EUR-Lex)
•       Case C-399/11 Melloni ECLI:EU:C:2013:107, 26 February 2013 (EUR-Lex)
•       Joined Cases C-293/12 and C-594/12 Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources and Others and Kärntner Landesregierung and Others ECLI:EU:C:2014:238, 8 April 2014 (EUR-Lex)
•       Case C-358/14 Poland v Parliament and Council ECLI:EU:C:2016:323, 4 May 2016 (EUR-Lex)
•       Case C-547/14 Philip Morris Brands SARL and Others v Secretary of State for Health ECLI:EU:C:2016:325, 4 May 2016 (EUR-Lex)
•       Case C-482/17 Czech Republic v Parliament and Council ECLI:EU:C:2019:1035, 3 December 2019 (EUR-Lex)
•       Case C-117/20 bpost SA v Autorité belge de la concurrence ECLI:EU:C:2022:202, 22 March 2022 (EUR-Lex)
•       Case C-151/20 Bundeswettbewerbsbehörde v Nordzucker AG and Others ECLI:EU:C:2022:203, 22 March 2022 (EUR-Lex)
•       Case C-252/21 Meta Platforms Inc and Others v Bundeskartellamt ECLI:EU:C:2023:537, 4 July 2023 (EUR-Lex)
•       Case C-376/22 Google Ireland Ltd and Others v Kommunikationsbehörde Austria (KommAustria) ECLI:EU:C:2023:835, 9 November 2023 (EUR-Lex)

•       Almada M and Petit N, 'The EU AI Act: Between the Rock of Product Safety and the Hard Place of Fundamental Rights' (2025) 62(1) CML Rev 85–120
•       Cantero Gamito M, 'Do Too Many Cooks Spoil the Broth? How EU Law Underenforcement Allows TikTok's Violations of Minors' Rights' (2023) 46(3) J Consum Policy 281–305
•       De Hert P and Hajduk P, 'EU Cross-Regime Enforcement, Redundancy and Interdependence: Addressing Overlap of Enforcement Structures in the Digital Sphere after Meta' (2024) Technology and Regulation 291–308
•       Garben S, 'Competence Creep Revisited' (2019) 57(2) JCMS 205–222
•       Lievens E and Verdoodt V, 'How the EU Safeguards Children's Rights in the Digital Environment: An Exploratory Analysis of the EU Digital Services Act and the Artificial Intelligence Act' in T Pajuste (ed), Human Rights in the Digital Domain: Core Questions (CUP 2025) 381–408
•       Lievens E, Livingstone S, McLaughlin S, O'Neill B and Verdoodt V, 'Children's Rights and Digital Technologies' in T Liefaard and U Kilkelly (eds), International Human Rights of Children (Springer 2018) 487–513
•       Livingstone S and Third A, 'Children and Young People's Rights in the Digital Age: An Emerging Agenda' (2017) 19(5) New Media & Society 657–670
•       Livingstone S and others, The Best Interests of the Child in the Digital Environment (Digital Futures for Children centre, LSE and 5Rights Foundation, March 2024)
•       Shaffique MR and van der Hof S, 'Behavioural Profiling for Age Assurance: Do the Ends Justify the Means?' (2026) 16(1) IDPL ipaf012
•       van der Hof S and Ouburg S, '"We Take Your Word For It": A Review of Methods of Age Verification and Parental Consent in Digital Services' (2022) 8(1) EDPL
•       Van Cleynenbreugel P, 'BPost and Nordzucker: Searching for the Essence of Ne Bis in Idem in European Union Law' (2022) 18(2) EuConst 357–374
•       Verdoodt V, Lievens E and Chatzinikolaou A, 'The EU Approach to Safeguard Children's Rights on Video-Sharing Platforms: Jigsaw or Maze?' (2023) 11(4) Media and Communication 151–163
•       Weatherill S, 'Competence Creep and Competence Control' (2004) 23 YEL 1–55
•       Weatherill S, 'The Limits of Legislative Harmonisation Ten Years after Tobacco Advertising: How the Court's Case Law Has Become a "Drafting Guide"' (2011) 12(3) German LJ 827–864
•       Weinzierl J and Weissenmayer J, 'News from Minimum Harmonisation: How the Tobacco Advertising Cases Shape the Law of the Internal Market' (European Law Blog, 4 October 2016)

•       Allcott H, Gentzkow M and Song L, 'Digital Addiction' (2022) 112(7) AER 2424–2463, doi:10.1257/aer.20210867
•       Alonzo R, Hussain J, Stranges S and Anderson KK, 'Interplay Between Social Media Use, Sleep Quality, and Mental Health in Youth: A Systematic Review' (2021) 56 Sleep Med Rev 101414, doi:10.1016/j.smrv.2020.101414
•       American Psychological Association, Health Advisory on Social Media Use in Adolescence (May 2023)
•       Barnes C, Hall A, Mantach S, Oldmeadow C, Attia J, Backholer K, Williams C, Tefera Y, Kay F and Wolfenden L, 'Assessing Early Effects of Australia's Social Media Minimum Age Act on Adolescents' Social Media Use: Observational Study' (2026) 393 BMJ e363695, doi:10.1136/bmj-2026-363695 (BMJ Group)
•       Bellovin SM, 'Privacy-Preserving Age Verification—and Its Limitations' (position paper, IAB/W3C Workshop on Age-Based Restrictions on Content Access, 7–9 October 2025)
•       Braghieri L, Levy R and Makarin A, 'Social Media and Mental Health' (2022) 112(11) AER 3660–3693, doi:10.1257/aer.20211218
•       Celi S, Den Hartog K and Haddadi H, 'The limits of zero-knowledge for age-verification' (Brave blog, 5 November 2025)
•       Chatel S, Knabenhans C, Lueks W, Raynal M, Troncoso C and Vécsi Á, 'Limitations and Pitfalls of Integrating PETs in Online Age Verification' (position paper, IAB/W3C Workshop on Age-Based Restrictions on Content Access, 7–9 October 2025)
•       Common Sense Media, Talk, Trust, and Trade-Offs: How and Why Teens Use AI Companions (16 July 2025)
•       De Freitas J, Oguz-Uguralp Z and Kaan-Uguralp A, 'Emotional Manipulation by AI Companions' (arXiv:2508.19258, 2025)
•       Fang CM, Liu AR, Danry V, Lee E, Chan SWT, Pataranutaporn P, Maes P, Phang J, Lampe M, Ahmad L and Agarwal S, 'How AI and Human Behaviors Shape Psychosocial Effects of Extended Chatbot Use: A Longitudinal Randomized Controlled Study' (arXiv:2503.17473v2, 2 October 2025)
•       Faverio M and Sidoti O, Teens, Social Media and AI Chatbots 2025 (Pew Research Center, 9 December 2025)
•       Ferguson CJ, Kaye LK, Branley-Bell D and Markey P, 'There Is No Evidence That Time Spent on Social Media Is Correlated With Adolescent Mental Health Problems: Findings From a Meta-Analysis' (2025) 56(1) Prof Psychol Res Pract 73–83, doi:10.1037/pro0000589
•       Fitz N, Kushlev K, Jagannathan R, Lewis T, Paliwal D and Ariely D, 'Batching Smartphone Notifications Can Improve Well-Being' (2019) 101 Computers in Human Behavior 84–94, doi:10.1016/j.chb.2019.07.016
•       Frigo M and shelat a, 'Anonymous Credentials from ECDSA' (IACR Cryptology ePrint Archive 2024/2010, rev 27 April 2026; also in IACR Communications in Cryptology vol 3(1), 2026)
•       Haidt J, The Anxious Generation: How the Great Rewiring of Childhood Is Causing an Epidemic of Mental Illness (Penguin Press 2024)
•       Hanaoka K and others, 'Face Analysis Technology Evaluation: Age Estimation and Verification', NIST IR 8525 (NIST, 29 May 2024)
•       Heinz MV and others, 'Randomized Trial of a Generative AI Chatbot for Mental Health Treatment' (2025) NEJM AI (ScienceDaily summary)
•       Kelly Y, Zilanawala A, Booker C and Sacker A, 'Social Media Use and Adolescent Mental Health: Findings From the UK Millennium Cohort Study' (2018) 6 EClinicalMedicine 59–68, doi:10.1016/j.eclinm.2018.12.005
•       Kirk HR, Gabriel I, Summerfield C, Vidgen B and Hale SA, 'Why Human–AI Relationships Need Socioaffective Alignment' (2025) 12 Humanit Soc Sci Commun 728 (arXiv:2502.02528)
•       Krook J, 'Manipulation and the AI Act: Large Language Model Chatbots and the Danger of Mirrors' (arXiv:2503.18387, 24 March 2025)
•       McBain RK and others, 'Use of Generative AI for Mental Health Advice Among US Adolescents and Young Adults' (2025) 8(11) JAMA Netw Open e2542281, doi:10.1001/jamanetworkopen.2025.42281
•       McBain RK and others, 'AI Chatbot Use and Disclosure for Mental Health Among US Adolescents and Young Adults' JAMA Pediatrics (published online 3 June 2026) doi:10.1001/jamapediatrics.2026.2015
•       Medienpädagogischer Forschungsverbund Südwest (mpfs), JIM-Studie 2025: Jugend, Information, Medien – press release PM 4/2025 (2025)
•       Milli S, Carroll M, Wang Y, Pandey S, Zhao S and Dragan AD, 'Engagement, User Satisfaction, and the Amplification of Divisive Content on Social Media' (2025) 4(3) PNAS Nexus pgaf062, doi:10.1093/pnasnexus/pgaf062
•       Nagata JM, Memon Z, Talebloo J and others, 'Prevalence and Patterns of Social Media Use in Early Adolescents' (2025) 25(4) Acad Pediatr 102784, doi:10.1016/j.acap.2025.102784
•       National Academies of Sciences, Engineering, and Medicine, Social Media and Adolescent Health (National Academies Press 2024; released 13 December 2023) doi:10.17226/27396
•       Odgers CL, 'The Great Rewiring: Is Social Media Really Behind an Epidemic of Teenage Mental Illness?' (2024) 628(8006) Nature 29–30, doi:10.1038/d41586-024-00902-2
•       Orben A and Przybylski AK, 'The Association Between Adolescent Well-Being and Digital Technology Use' (2019) 3(2) Nat Hum Behav 173–182, doi:10.1038/s41562-018-0506-1
•       Orben A, Przybylski AK, Blakemore S-J and Kievit RA, 'Windows of Developmental Sensitivity to Social Media' (2022) 13 Nat Commun 1649, doi:10.1038/s41467-022-29296-3
•       Orben A, Purba AK, Fokas I, Gunschera LJ, Yap ZY, Davidson B, Davis OSP, Ellis DA, Goodyear V, Haworth CMA, Hollis C, Joinson A, Katikireddi SV, Livingstone S, Panayiotou M, Przybylski AK, Townsend E and Zendle D, Feasibility Study of Methods and Data to Understand the Impact of Smartphones and Social Media on Children and Young People (DSIT, May 2025, published 20 January 2026)
•       Sala A, Porcaro L and Gómez E, 'Social Media Use and Adolescents' Mental Health and Well-being: An Umbrella Review' (2024) 14 Computers in Human Behavior Reports 100404, doi:10.1016/j.chbr.2024.100404
•       SciencesPo DIGILAW Clinic and BEUC, Synthetic Empathy: Risks and Rights in Artificial Companionship (BEUC-X-2026-049, 26 May 2026)
•       Tølbøll KB, 'Review: Social Media Use and Adolescent Mental Health – An Umbrella Review and Power Analysis' (2026) Child and Adolescent Mental Health (published online 27 January 2026) doi:10.1111/camh.70071
•       UK Chief Medical Officers, United Kingdom Chief Medical Officers' Commentary on 'Screen-Based Activities and Children and Young People's Mental Health and Psychosocial Wellbeing: A Systematic Map of Reviews' (DHSC, 7 February 2019)
•       US Surgeon General, Social Media and Youth Mental Health (2023)
•       Valkenburg PM, Meier A and Beyens I, 'Social Media Use and Its Impact on Adolescent Mental Health: An Umbrella Review of the Evidence' (2022) 44 Curr Opin Psychol 58–68, doi:10.1016/j.copsyc.2021.08.017
•       van Essen CM and Van Ouytsel J, 'Snapchat Streaks: How Are These Forms of Gamified Interactions Associated with Problematic Smartphone Use and Fear of Missing Out Among Early Adolescents?' (2023) 11 Telematics and Informatics Reports 100087, doi:10.1016/j.teler.2023.100087
•       Xiao Y, Meng Y, Brown TT, Keyes KM and Mann JJ, 'Addictive Screen Use Trajectories and Suicidal Behaviors, Suicidal Ideation, and Mental Health in US Youths' (2025) 334(3) JAMA 219–228, doi:10.1001/jama.2025.7829
•       Zendle D, Flick C, Gordon-Petrovskaya E, Ballou N, Xiao LY and Drachen A, 'No Evidence That Chinese Playtime Mandates Reduced Heavy Gaming in One Segment of the Video Games Industry' (2023) 7(10) Nat Hum Behav 1753–1766, doi:10.1038/s41562-023-01669-8
•       Zhang R, Li H, Meng H, Zhan J, Gan H and Lee Y-C, 'The Dark Side of AI Companionship: A Taxonomy of Harmful Algorithmic Behaviors in Human-AI Relationships' in Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems (ACM 2025) doi:10.1145/3706598.3713429

•       5Rights Foundation, 'New EU KIDS Act can "put paid to the tech exploitation of children" but must apply equally to all platforms' (17 September 2026)
•       Bratby R, 'EU KIDS Act: one age check will not satisfy EU and UK rules' (Bratby Law, 23 September 2026)
•       Demková S and De Gregorio G, 'The Looming Enforcement Crisis in European Digital Policy: A Rule-of-Law Centered Path Forward' (Verfassungsblog, 10 February 2025)
•       Dharia A, Yamazaki M, Libin N and Stankey R, 'European Commission Proposes EU KIDS Act, a Comprehensive Child-Safety Framework' (Davis Wright Tremaine, 30 September 2026)
•       EDRi, 'The KIDS Act will make the internet less safe' (30 September 2026)
•       Galissaire J, 'Where Does the KIDS Act Fit in the EU's Digital Rulebook?' (Tech Policy Press, 24 September 2026)
•       Latham & Watkins, 'China Introduces Rules for AI Companion and Emotional Interaction Services' (8 July 2026) (cited as Latham & Watkins 2026a)
•       Latham & Watkins, 'EU KIDS Act: EU Commission Publishes Proposal on Child Protection Online' (29 September 2026) (cited as Latham & Watkins 2026b)
•       Mason Hayes & Curran, 'KIDS Act proposal: Implications for AI chatbots' (29 September 2026)
•       NicFab, 'EU KIDS Act: a minimum age of 15 for social media and tailored rules for AI companions and chatbots' (2026)
•       Osborne Clarke, 'French regulator Arcom's standard for online age verification rolls out in 2025' (9 January 2025)
•       Pinsent Masons, 'EU Kids Act proposal introduces a three-tier approach to social media accounts' (Out-Law News, 18 September 2026)
•       Renou M, 'Inside the EU KIDS Act: A "specification" of the DSA that goes much further' (IAPP, 29 September 2026)
•       Stalla-Bourdillon S, 'The Commission's approach to age assurance: Do the DSA Guidelines on protecting minors online strike the right balance?' (DSA Observatory, 31 July 2025)