Brussels proposes an EU-wide age limit for social media and a ban on profiling feeds for minors

Ursula von der Leyen set the terms in Strasbourg on 16 September, in her State of the Union address, before the text existed. "What we are witnessing is a great capture of our children. A capture of their attention, their focus, their minds." Then the policy, as a slogan: no social media under 13, no personal accounts under 15, and platforms that "will have to prove to us that they are safe". To the objection that the companies are too large to be governed: "Europe has the power to act. It is we who decide our rules, not Big Tech."

The next day the Commission published the proposal she had trailed, under the name EU KIDS Act, presented by von der Leyen and by Henna Virkkunen, the Executive Vice-President for Tech Sovereignty, Security and Democracy. It is a draft regulation, not a law. It now goes to the European Parliament and the Council, which will amend it, and the Commission's hope of "swift" adoption is a hope rather than a schedule.

What makes the Act worth a philosophy site's attention is not the age number. A major jurisdiction has written into a legal text a theory of what a child is owed in an environment designed, by other people, to hold that child's attention, and has done so while the empirical case for harm is openly contested by the researchers who study it.

What the text actually says#

The age architecture has three tiers. Under 13, no social media accounts, only child-friendly video services through an account managed by a guardian. From 13 to 14, a "mini account" created and supervised by a parent, with limited contacts and a cap of one hour a day. From 15, an account of one's own. The Commission's summary calls the first tier an under-13 ban; the mechanics, as Covington's analysis of the draft makes clear, run as a prohibition on providers offering accounts to anyone under 15, with a parental carve-out for 13- and 14-year-olds. The proposal does not criminalise a twelve-year-old; it makes it unlawful for a platform to have her as a customer.

The provisions that apply to everyone under 18 are the more consequential. Profiling-based recommender feeds are to be switched off by default for minors; infinite scrolling without pauses, streak-and-badge reward mechanisms, and push notifications during eight consecutive night hours are prohibited; unsolicited contact from strangers is blocked; profiles are private by default. AI chatbots and "companions" must be off by default for minors and may not be designed to "make children emotionally dependent". Online games are in scope. Fines, according to the IAPP's and Euronews's reading of the text, run to six per cent of worldwide annual turnover. Age must be established through independent certified tools, including the EU age-verification app due later this year and the European Digital Identity Wallet, which the Commission says will retain no identity documents and no biometric data; existing accounts are to be checked within six months.

Then the structural move. Very large online platforms, those with more than 45 million EU users, must submit compliance plans to the Commission and to independent auditors before offering services to children. "Our KIDS Act is reversing the burden of proof," von der Leyen said on 17 September; "it is for platforms to show they are safe by design."

One detail the coverage has passed over. The special panel von der Leyen convened in March 2026, some sixty experts co-chaired by the child psychiatrist Jörg Fegert of Ulm and Maria Melchior of INSERM, reported on 13 July and recommended an EU-wide minimum age of 13. The Commission went higher itself. The gap between what its advisers proposed and what it tabled is two years of childhood, and nobody has yet said which evidence closed it.

Where it sits among the others#

The Act specifies and extends Article 28 of the Digital Services Act, in force since 2024, under which the Commission issued guidelines on 14 July 2025 telling platforms to adjust recommender systems "to lower the risk of children encountering harmful content or getting stuck in rabbit holes of specific content". Those guidelines were advisory, and the rabbit hole of the Turkish headline is the Commission's own metaphor. The new text makes the same rules binding and adds the age tiers.

Australia's Online Safety Amendment (Social Media Minimum Age) Act 2024 took effect on 10 December 2025 at 16, with a "reasonable steps" duty on platforms; on 16 January 2026 the Prime Minister's office reported more than 4.7 million under-16 accounts deactivated, removed or restricted. Britain's Online Safety Act brought age checks into force on 25 July 2025 for pornography and for suicide, self-harm and eating-disorder content; a British minimum age of 16, announced by Keir Starmer on 15 June 2026, is still to be legislated.

The instructive case is France. Parliament passed an under-15 ban on 21 July 2026; on 14 August the Conseil constitutionnel struck it down entirely, as an infringement of freedom of expression and of private life "neither appropriate, necessary, nor proportionate". The ban gave parents no way to lift it, imposed age verification on every user, and swept in collaboration tools and games. Each defect has been engineered out of the Commission's text, which is why the parental mini account exists.

The strongest case against it, in the words of the people making it#

Christoph Schmon, writing for the Electronic Frontier Foundation on 21 September, objects that the proposal mandates "privacy-intrusive age verification across the board", that parents of teenagers must verify their own identity too, and that the Act "has not gone through a full impact assessment process". European Digital Rights, in its bulletin of 23 September, puts it in a sentence: "Instead of raising the bar and making the internet safer for all, the EU's approach seems to be one of exclusion and putting up walls." Mandatory age checks, EDRi argues, exclude anyone who cannot produce the right documents, while leaving "the business model and extractive practices of online platforms" untouched. BEUC, the consumer body, sees "serious privacy and data protection concerns"; the Czech and Estonian governments, Euronews reports, have opposed blanket bans on the ground that mandatory identification threatens everyone's privacy.

Then evasion, which is not a hypothesis. On 25 June 2026 The BMJ published the first observational study of Australia's regime, a New South Wales sample of some four hundred adolescents surveyed just before the December commencement and three months after. More than 85 per cent of the under-16s were still using restricted platforms; between 15 and 19 per cent admitted to fake accounts; daily use among 14- and 15-year-olds fell from 78 to 69 per cent and among 12- and 13-year-olds not at all. The authors called the verification "suboptimal" and their sample small and self-reported, which it was. Nicol Turner Lee and colleagues at Brookings added, in December 2025, the cost hardest to price: an age wall denies teenagers the chance to learn "gradually and with guidance".

The case for the Act is shorter. Nearly two-thirds of respondents to the July 2026 Eurobarometer supported EU rules restricting children's access by age; Leanda Barrington-Leach of the 5Rights Foundation called the shift in the burden of proof "a win for children's rights". Evasion and privacy, on this view, are implementation problems, and no product-safety regime is abandoned because some consumers defeat it.

Mill drew his line at exactly this place#

The obvious objection, that the state has no business protecting people from their own choices, is one John Stuart Mill disposed of in advance. The harm principle in On Liberty (1859) arrives with an exclusion clause. "It is, perhaps, hardly necessary to say that this doctrine is meant to apply only to human beings in the maturity of their faculties. We are not speaking of children, or of young persons below the age which the law may fix as that of manhood or womanhood. Those who are still in a state to require being taken care of by others, must be protected against their own actions as well as against external injury." Von der Leyen could have quoted him.

Notice what Mill leaves open: "the age which the law may fix". He treats the boundary as conventional, and European law has already fixed it elsewhere: the General Data Protection Regulation puts the age of consent to data processing by an online service at 16, while allowing member states to lower it to 13, and most have. The Commission's panel said 13; the Commission says 15; Australia says 16. Nobody has a principled derivation of any of these numbers; they are chosen by weighing an uncertain harm against an uncertain loss.

Mill also supplies the argument the Commission is actually relying on, in a later chapter, concerning a bridge. An officer who sees a man about to cross a bridge known to be unsafe, with no time to warn him, "might seize him and turn him back, without any real infringement of his liberty; for liberty consists in doing what one desires, and he does not desire to fall into the river." The bridge case is about information, not childhood: intervention is licensed when the person cannot know what he is choosing. The ban on profiling feeds and infinite scroll for everyone under 18 is a bridge argument. It rests on the claim that the decision to keep scrolling is not, in the relevant sense, a decision the scroller has made.

Feinberg, soft paternalism and the engineered choice#

Joel Feinberg's Harm to Self (1986), the third volume of The Moral Limits of the Criminal Law, gives that intuition its most careful form. Feinberg distinguishes hard paternalism, which overrides a competent adult's fully voluntary self-regarding choice, from soft paternalism, which intervenes only where the choice is substantially nonvoluntary, or where intervention is needed to find out whether it is. The Commission's design chapter is soft paternalism so understood. It does not say a fifteen-year-old may not watch what she likes. It says that a feed tuned on her behavioural data to maximise her time on the service is a mechanism operating on her will rather than an expression of it, and that the state may remove the mechanism while leaving her free to find the same content by other routes.

That argument has two weaknesses. The first is that it proves too much: if an engagement-optimised feed compromises voluntariness, it does so for adults, and Jessica Galissaire of Interface Europe made the point in July, that safety-by-design should apply to all users. The Commission has confined the remedy to minors because that is where the political consensus lies, not because the voluntariness argument stops at 18. The second is Feinberg's own. In "The Child's Right to an Open Future" (1980) he describes children's autonomy rights as held in trust, to be exercised later, and violated by adults who foreclose options before the child can choose among them. An age wall forecloses options; so, arguably, does a habit-forming feed installed at eleven. Feinberg does not tell you which foreclosure is worse, only that both need justifying in the same currency.

The evidence gap is real, and it does not settle the question#

This publication reported the empirical dispute in detail on the day the Act appeared, in its analysis of what social media amplifies: Jonathan Haidt's causal thesis, Candice Odgers's rejoinder in Nature that the rewiring claim "is not supported by science", the Vuorre and Przybylski nulls, and the 2026 reply by Haidt's collaborators that aggregation hides concentrated harm. What the KIDS Act adds is a way of reading it.

The figures the Commission leans on are real but modest. The WHO Europe HBSC survey of nearly 280,000 adolescents in 44 countries, published on 25 September 2024, found that "problematic" social media use, a screening measure, rose from 7 per cent in 2018 to 11 per cent in 2022, with girls at 13 per cent and boys at 9. Pew's survey of 1,458 American teenagers in autumn 2025 found four in ten online "almost constantly". Neither is a finding of harm; both are findings of exposure. Odgers, writing in The Atlantic on 18 December 2025 about the Australian experiment, warned against reading across borders: "Kids in Norway differ from kids in Australia for all kinds of reasons."

Here the reversal of the burden of proof stops being an administrative detail. For a decade the platforms have had the benefit of scientific doubt: the harm was unproven, so the design stood. Von der Leyen's sentence moves the doubt to the other side of the table. Under the KIDS Act, uncertainty about whether an engagement-optimised feed harms fourteen-year-olds counts against the feed. That is a decision about who bears the cost of not knowing, political rather than scientific, which is not a criticism; it is the allocation European product-safety law already makes for toys and medicines, as Lies Craeynest of Kids Unplugged Belgium pointed out in July. It is also one that Odgers's reading of the evidence would not by itself support, and a Parliament legislating on this basis should say so rather than pretend the science compelled it.

The Parliament and the Council will spend a year or more on the text. The age tiers will be fought over; the chatbot provisions, which Eurochild already finds too vague, will be rewritten. Least likely to change is the sentence about the burden of proof, because no government in the Union wants to be seen defending the alternative. Mill left the number to the law, and the number is still open. What the Commission has decided, for the first time in a binding European text, is that a child's attention is not a resource a company may design around until someone proves it should not.