The EU KIDS Act – why its impact extends beyond social media
Much of the debate about the proposed EU KIDS Act centres on children’s access to social media, warns Lawyer Peter Caddock in an opinion piece for Euronews. However, in addition to the platforms in question, companies whose services are not aimed at children could also face new obligations.
The EU KIDS Act, a proposed legislation, extends its influence far beyond social media to encompass a wide range of digital services. This includes online discussion groups, video games, and AI chatbots that may not primarily target children. The act would introduce age restrictions, stronger age verification, and the integration of child protection measures into digital services.
However, its final details are still under negotiation, leaving business leaders to ponder what adjustments might be necessary and how to ensure safeguards do not compromise the services valued by customers.
One intriguing aspect of the proposal concerns AI companions and general conversational chatbots. An AI companion is characterized by personalised, ongoing interactions that simulate or encourage social, emotional, or interpersonal relationships. This definition encompasses more than just products marketed as virtual friends, as seen in customer service chatbots that greet users by name, recall previous conversations, and offer reassurance.
While these bots may not automatically be classified as AI companions, they highlight the necessity for a precise distinction between helpful personalization and relationship-building.
To address potential emotional dependency and ensure safety, the KIDS Act proposes measures to prevent features that could foster such dependency. Providers would also be required to conduct testing and monitoring to assess the risk. However, determining what constitutes dependency is complex, especially when reassurance that is routine for one user may be significant for an isolated teenager.
Rather than making every chatbot impersonal, businesses need clear standards to differentiate useful support from harmful attachment.
The KIDS Act builds upon existing EU regulations such as the Digital Services Act and the AI Act, as well as audiovisual media rules and consumer protection legislation. Businesses will have to navigate these overlapping obligations rather than developing separate compliance programmes for each. Age verification, a critical component of the act, poses data protection questions for providers.
They must determine which personal information is necessary, whether they have a lawful basis for using it, and how long they retain or share it. The aim should be to protect children without collecting unnecessary data about all users.
Automated decisions affecting access to services may also be subject to additional GDPR safeguards. While not a blanket ban on automated decisions involving children, businesses must carefully consider these protections. Restrictions on access must also respect children's freedom of expression and access to information.
For digital services providers, adapting to the KIDS Act will likely involve changes to registration processes, content access, default settings, and interface design. The legislation distinguishes between various age assurance methods, with age verification requiring a certified third-party solution and other forms relying on more flexible methods that still meet legal requirements. Simply asking users to declare their age would not suffice.
Addictive design poses another challenge, as increased usage may indicate harmful engagement but could also reflect usefulness or enjoyment. Providers need clear risk indicators and proportionate testing expectations, rather than being obligated to predict every child's response. Business leaders should begin their preparation by mapping potentially affected features, assessing children's access, and identifying where product design and data protection requirements intersect.
This should involve collaboration between legal, product, and technology teams, not solely compliance specialists. Early planning can help prevent rushed changes that could disrupt services or user relationships.
Even if the legal uncertainties surrounding the KIDS Act are resolved, ensuring its effectiveness remains a separate challenge. Simply denying a teenager access does not guarantee the restriction will be respected. Ultimately, the law must not only be legally workable but also deliver meaningful protection in practice. Peter Caddock, a Partner at international law firm Osborne Clarke specializing in AI, privacy, and data protection, emphasizes the importance of these considerations in his work with clients across the EU and beyond.
Written by urgent.news from Euronews Business's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
