Are We Protecting Children—or Building a New Internet Surveillance System?

A crucial clarification first

The headline sounds simple:

The EU is banning social media for children under 13.

But anyone who reads only that headline does not understand the KIDS Act.

The proposal presented by the European Commission on 17 September 2026 goes considerably further.

And the most important clarification is this:

As of 18 September 2026, the KIDS Act is not yet binding EU law.

It is a proposal for an EU regulation. The European Parliament and the Council must deliberate on it. The draft may still be amended during this legislative process. [1][2]

Anyone writing today that the EU has already banned social media for children is therefore going too far.

What is actually planned

The proposal envisages a tiered model.

Children under 13 should not be allowed to have their own social media accounts on the platforms covered.

At ages 13 and 14, restricted accounts controlled by parents or legal guardians should be possible.

From age 15, it should generally be possible to create an account independently. [1][2]

But the age limit is only one part of the law.

The KIDS Act also targets the design of digital services.

Certain mechanisms that may encourage excessive use are to be restricted for minors.

These include, for example, certain forms of infinite scroll, autoplay, so-called streaks, manipulative notifications, and other mechanisms designed to keep users on a platform for as long as possible. [1]

Recommendation algorithms, tracking, in-app purchases, and contact from strangers are also addressed.

This raises a remarkable question for the EU:

Is the problem really only the child’s age—or also the way the product is designed?

AI companions also come into focus

It is particularly interesting that the proposal does not concern only traditional social networks.

AI chatbots and so-called AI companions are explicitly included as well.

Under the draft, such systems must not be designed in ways that foster emotional dependency among minors.

Providers are expected to demonstrate special protective mechanisms and risk-monitoring systems. [1]

The issue is becoming more important.

Because artificial intelligence differs from a normal social media feed in one important respect:

It responds personally.

It answers.

It may remember earlier conversations.

It can offer comfort.

And in doing so, it can simulate a form of relationship.

That can already be psychologically intense for adults.

For children and adolescents, the question of dependency and susceptibility to manipulation is even more pressing.

The EU itself identifies an uncomfortable problem

The explanations accompanying the KIDS Act make clear that, in the Commission’s view, age limits alone are not enough.

The reason lies in product design.

Many platforms depend economically on users staying as long as possible, returning as often as possible, and interacting as intensively as possible.

Attention is a business model.

That fundamentally changes the debate.

Perhaps the decisive question is not:

Are children old enough for social media?

Perhaps it is:

Why have we built products whose design requires us to protect children from them by law?

What do we know about the psychological effects?

This is where the debate often becomes imprecise.

Social media is now linked to depression, anxiety disorders, loneliness, sleep problems, poorer school performance, and many other problems.

There is serious evidence for some of these connections.

Based on the HBSC survey, the World Health Organization reported an increase in problematic social media use among adolescents and differences between girls and boys. [3]

That is relevant.

But such data do not automatically prove that social media broadly causes mental illness.

Scientific reviews show a much more complex picture.

The type of use, content, personality, stage of development, social circumstances, existing mental health strains, and specific platform mechanisms can all play a decisive role. [4]

“Social media can amplify problematic effects for certain adolescents under certain conditions” is scientifically entirely different from:

“Social media makes children mentally ill.”

That distinction matters.

Three hours are not automatically three hours

Two teenagers can each spend three hours on their smartphones and have entirely different experiences.

One communicates with friends, works on a joint project, and watches educational videos.

The other is led ever deeper by a recommendation algorithm into extreme beauty ideals, self-harm content, or social exclusion.

Screen time alone tells us very little about these differences.

That is why I consider blanket time limits understandable, but not the only decisive metric.

The far more interesting question is:

What happens during that time?

A ban requires age verification

This is where the next major problem begins.

A social media ban for certain age groups can only work reliably if a platform actually knows how old a user is.

A date of birth entered by the user is obviously not enough.

Children can enter a different date.

That is why the KIDS Act provides for stronger age-verification systems. [1][2]

Among other things, the Commission is relying on data-minimising methods in which, ideally, a service learns only whether an age threshold has been met—not the user’s full identity.

Technically, that is attractive.

In practice, however, difficult questions still arise.

How do you prove your age without revealing your identity?

The more reliable an age check is supposed to be, the more it must know about or verify the user.

Possible methods range from identity documents and age attestations by trusted third parties to biometric age estimation.

Every method has drawbacks.

Identity documents provide very reliable information, but create data protection risks.

Biometric estimates may appear more data-efficient, but they are not perfect and can classify people incorrectly.

Simple self-declarations protect privacy better, but can easily be circumvented.

The European Data Protection Board therefore calls for age verification to process only the data that are actually necessary. [5]

The OECD also points to substantial practical differences between available age-verification systems. [6]

The problem suddenly affects adults too

If a platform must prevent children from using it, it may also need to be able to establish that adult users really are adults.

This means that a child-protection measure could potentially change access to the internet for everyone.

That does not necessarily mean that everyone will have to upload their passport to Instagram in the future.

But the political debate must not ignore this consequence either.

An effective age limit and maximum anonymity can compete with one another in certain situations.

This tension must be resolved technically and legally.

Does that mean everything should stay as it is?

No.

That would be the next overly simple answer.

Children are not small adults.

Their ability to assess risks, control impulses, and understand social consequences is still developing.

Digital platforms can at the same time use psychological mechanisms that capture attention:

variable rewards,

social validation,

fear of missing out,

notifications,

streaks,

automatically loaded content,

algorithmically optimised recommendations.

That is precisely why I find one idea in the KIDS Act especially important:

Responsibility should not rest solely with children and their parents.

Providers should also be held responsible for how their products are designed.

“Parents simply need to pay closer attention” is not enough

That sentence is convenient.

It shifts almost all responsibility onto families.

But parents today are not competing with a single television programme.

They are competing with highly sophisticated digital systems whose business models partly depend on capturing and retaining attention as efficiently as possible.

Parental guidance remains important.

But a safety concept that works only if millions of parents understand every algorithm, every dark pattern, and every new platform feature is not a particularly robust safety concept.

That is why “safety by design” is fundamentally an interesting approach.

But who actually defines “safe”?

That is where the next difficult level begins.

If a platform claims that its recommendation algorithm is optimised for the safety of minors, we must ask:

How is safety measured?

Who monitors it?

Which content is considered problematic?

How transparent are the criteria?

Which scientific standards are used?

And how can an authority audit a recommendation system that is constantly changing?

Laws can set objectives.

The complicated work begins with their technical implementation.

Why 15 of all ages?

Laws need clear thresholds.

Biological and psychological development, however, rarely follows such hard lines.

A person does not suddenly change overnight before their 15th birthday from a child in need of protection into a fully competent social media user.

The age limit is therefore inevitably a regulatory simplification of a continuous developmental process.

That is not automatically wrong.

But it means that we should not later measure the law’s success solely by how many 14-year-olds have been kept away from a platform.

What should also matter is whether the platform itself has become safer.

The most uncomfortable question is not only about children

If infinite scroll, streaks, autoplay, and certain notifications are effective enough that minors are supposed to be protected from them, another question inevitably arises:

What do the same mechanisms do to adults?

At 18, we do not become immune to psychological influence.

That does not mean adults therefore need the same legal restrictions.

But informed self-determination requires us to understand how digital products try to influence our behaviour.

Perhaps the KIDS Act will therefore lead in the long term to a much broader discussion:

not only about children on the internet,

but about the architecture of our digital attention.

Child protection must not mark the end of critical questions

The KIDS Act contains approaches that go far beyond a simple social media ban.

Those parts in particular deserve serious discussion.

At the same time, “child protection” must not become a term after which critical questions automatically stop.

We must examine whether the measures actually work.

We must investigate what data are processed for age checks.

We must monitor which people are wrongly excluded.

We need independent research into which forms of digital use genuinely cause harm and which may even be helpful.

And we should not give in to the illusion that a birthday solves a complex social problem.

Children need protection.

But good protection does not only mean closing a door.

Sometimes, it means rebuilding the room behind it.