Impact AnalysisAnalysis of impacts

Glossary

1 Introduction: Political and legal context

1.1 Context

The digital world has become an essential part of the daily lives of children, influencing their social life, development, education and the way they consume and access entertainment and information.

Globally, both the negative impact of the online world on children, as well as the opportunities it represents, has been the subject of increased attention and scrutiny. In December 2025, Australia became the first country to implement legislation delaying access to social media until the age of 16 (¹) with further duty of care obligations now under consideration. The UK (²) and Brazil (³) have dedicated comprehensive risk-based legal and policy frameworks to protect minors online with the UK also considering delaying access to social media (⁴). Canada (⁵), Japan (⁶), Indonesia (⁷) and others are considering comparable approaches (⁸). In the United States, the topic has gained increasing attention at both federal and state level (⁹), with recent litigation shifting towards new liability risks for platform providers (¹⁰). More recently, the G7 Leaders endorsed principles to strengthen the protection of children online (¹¹).

The European Union has made protecting minors online one of its main priorities and is at the forefront of efforts to ensure a safe and empowering online environment for children. Recognising that the protection of mental health of children online is one of the greatest challenges of this decade (¹²), Commission President Ursula von der Leyen announced the establishment of a panel of specialists to advise her on the best approach for Europe on child safety online in her 2025 State of the Union address (¹³). The panel brought together specialists from diverse fields including the medical profession, child psychology, computer science, child rights, data protection and consumer rights, as well as youth and parents’ representatives.

Following a series of meetings that took place in the first half of 2026, the Co-Chairs of the Special Panel on child online safety, Prof. Dr. Jörg M. Fegert and Dr. Maria Melchior, presented the Report in July 2026. Based on 6 guiding principles, including a developmental approach, equality and diversity, protection of minors, accountability of digital services and consumer rights, empowerment and media education and children’s rights and participation, the Report sets out recommendation to improve child safety online. In particular, it recommends EU-wide access restrictions to social media and other digital services, including AI companions, below age 13, harmonised safety by design rules for social media, other digital service and certain artificial intelligence (‘AI’) systems accessible to minors and proportionate, privacy-preserving age assurance systems (¹⁴).

The European Parliament has also called for strengthening the protection of children online. In its resolution of November 2025, the European Parliament called for a harmonised European digital age limit of 16 years for access to social media, video-sharing platforms and AI companions, and of 13 years for access to social media with parental consent (¹⁵). The resolution highlights the importance of age-appropriate design and safety by design and by default to ensure a safe online environment for minors, calling on the Commission to propose legislation (¹⁶). Further, the European Parliament also notes the existing national fragmentation around age assurance and calls for a European approach providing legal certainty (¹⁷).

Member States have also prioritised this topic and have called for strengthening protections. Upon the initiative of the Danish presidency, 25 Member States signed the Jutland Declaration in October 2025 calling for a safer online environment, including via age-appropriate design and safety by design and by default and effective and privacy-preserving age verification on social media and other relevant digital services that pose a significant risk for minors (¹⁸). In its conclusions of October 2025 and of March 2026, the European Council also stressed the importance of protecting minors online, including through a digital age of majority (¹⁹). At national level, Member States are considering adopting age restrictions for access to certain digital services with France adopting its legislation in Parliament in July 2026. In 2026, France, Greece, Norway, Poland, Austria and Belgium notified their draft legislation via the EU-level Technical Regulation Information System (TRIS) under the Single Market Transparency Directive ²⁰, while several other Member States are currently undergoing consultation processes, discussing drafts within their national parliaments or announcing upcoming legislative measures. If, within three months of the notification by the Member State, the Commission finds that a notified draft national law concerns a matter covered by a proposal presented by the Commission, Member State shall postpone the adoption of the draft national law to 12 months from the date of notification (²¹).

This call for action at Member State level is supported by children, parents and the public, who are similarly asking for stronger measures to protect children online. 92% of Europeans consider the need to further strengthen children and young people’s protection online a top policy priority (²²). In particular, 54% of parents and 45% of 13-18 years old consider age delays to be an effective solution (²³). Children and stakeholders also emphasise the responsibility of platforms in providing age-appropriate services. At the Safer Internet Forum in December 2025, the 200 participants, including children, young people and representatives from civil society, highlighted the need for requirements for safety by design, including age-appropriate defaults, recommender systems and interface design. During its meeting in December 2025, the President Youth Advisory Board also pointed to the need to address addictive design and algorithmic systems (²⁴).

1.2 The European regulatory framework

As recognised by the Report of the Co-Chairs of the Special Panel, the European Union has set up a ‘powerful legislative framework’ for the protection of minors online while identifying areas that require further measures (²⁵). At its centre, the Digital Services Act (DSA) requires providers of online platforms to ensure a high level of privacy, safety and security on their platforms (²⁶). In July 2025, the Commission adopted its guidelines on the protection of minors setting out a benchmark for compliance and outlining measures platforms should take to ensure a high level of privacy, safety and security, which is required by Art. 28 DSA (²⁷). The DSA also prohibits advertisements based on profiling for minors (²⁸). As part of their risk assessments and mitigation obligations, providers of Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) must also identify, assess and mitigate any systemic risks to the rights of the child, the protection of minors and the protection of mental and physical wellbeing (²⁹). In relation to the protection of minors, the Commission has opened 10 formal proceedings against VLOPs and VLOSEs (³⁰). In the first half of 2026, the Commission notably preliminary found TikTok and Meta in breach of the DSA for their respective addictive design and in the case of Meta for failing to prevent minors under 13 from using Instagram and Facebook. Preliminary Findings and opened proceedings are an intermediate step in a Commission investigation, and the investigation continues (for opened proceedings) or VLOPs now have the possibility to exercise their right to defence (for preliminary findings), before the Commission decides on next steps in these cases. However, these steps signal the suspicion of potential lack of compliance of these providers.

In addition to the DSA, the Audiovisual Media Services Directive (AVMSD) requires video-sharing platforms (VSPs), irrespective of their size, to take appropriate measures to prevent minors from viewing harmful audiovisual content (³¹), namely to include the EU’s media content standards in their terms and conditions, mechanisms to report or flag harmful content, age verification, parental controls and content rating systems. The most harmful type of content, such as pornography or gratuitous violence, must be subject to the strictest measures. It is currently undergoing evaluation and review to identify and remedy potential shortcomings, including whether more should be done to ensure viewers, especially minors, are adequately protected from harm when they view audiovisual content online.

With regard to AI, the Artificial Intelligence Act (AI Act) lays down harmonised rules for the placement on the market, putting into service and use of artificial intelligence (‘AI’) systems and the placement on the market of general-purpose AI models in the Union aimed at protecting health, safety and fundamental rights, including the rights of children (³²). First, it prohibits AI systems that deploy subliminal, purposefully manipulative or deceptive techniques and that exploit vulnerabilities due to age. These prohibitions aim to prevent AI systems from manipulating children or exploiting cognitive and other limitations that children may have into taking decisions that they would not have otherwise taken, and to protect them from harmful undue influence, manipulation and exploitation. Second, to help avoid fraud, impersonation and deception, the AI Act obliges providers of AI systems intended to interact directly with natural persons to design and develop those systems in such a way that those persons are informed that they are interacting with an AI system. Furthermore, providers of generative AI systems are obliged to mark and enable detection of AI generated or manipulate content, while deployers of such systems must label deepfakes and published text on matters of public interest produced by such systems without human review or editorial control. Additionally, several AI use-cases with significant impact on minors’ rights are classified as high-risk AI systems under the AI Act, such as when used for certain applications in the domain of education and vocational training. High-risk AI systems must meet certain requirements to ensure they are safe and trustworthy, such as risk management, data quality, transparency and human oversight. In particular, the risk management system of a high-risk AI system needs to consider if there is a likelihood of adverse impact on persons under the age of 18 and require appropriate testing and mitigation measures. As regards the most performant general-purpose AI models, their providers must assess and mitigate possible systemic risks at Union level, including risks to the safety and well-being of minors, that may stem from the development, the placing on the market, or the use of the model.

The Commission has also taken steps to combat and prevent child sexual abuse online. In 2022, it presented a proposal for a permanent and comprehensive EU regulatory framework to prevent and combat child sexual abuse, establishing rules for online services providers to prevent the dissemination of child sexual abuse material and the grooming of children. In parallel, the re-cast of the Child Sexual Abuse Directive was recently agreed by the Parliament and the Council extending the scope of criminal offences in view of new risks. The co-legislators also recently enacted new prohibitions under the AI Act for AI systems that generate non-consensual sexually explicit and intimate content or child sexual abuse material; those prohibitions will start to apply on 2 December 2026 (³³).

The Political Advertising Regulation further introduces specific requirements for the use of targeting and ad delivery techniques in online political advertising that protect children, while allowing minors one year under the voting age to be reached by political advertising (³⁴). This enables equal conditions for first-time voters (sometimes as of the age of 16) and allows them to exercise their democratic choices in an informed manner.

In the area of consumer protection law, the Unfair Commercial Practices Directive already protects children as young consumers but the rapidly evolving business models, increasingly sophisticated marketing techniques and the large-scale proliferation of unfair practices underline the urgent need to update the regulatory framework for the digital age and to ensure its effective enforcement (³⁵). The Digital Fitness Fairness Check found that consumers, including minors, are in need of enhanced protection online (³⁶). The Commission is therefore preparing a proposal for the Digital Fairness Act (DFA) to tackle several problems that consumers face online, including unfair personalisation practices, misleading or obscure pricing practices and problems with managing contracts online, marketing by social media influencers and manipulative commercial practices.

The Better Internet for Kids strategy (BIK+) (³⁷) further supports the implementation of this legislative framework, notably the DSA. Under the BIK+, the EU co-funded network of Safer Internet Centres offers training sessions, helplines and hotlines and runs awareness raising activities. They regularly consult children and young people on their needs and view on online safety. In February 2026, the Commission also adopted the Action plan against cyberbullying to prevent cyberbullying, raise awareness and make it easier to report and ensure that victims receive adequate support (³⁸).

While legislation already exists to create a safer online environment, no single instrument takes children and their safety and empowerment as the starting point. This initiative addresses this gap and builds upon the existing framework and provide for a dedicated legislative instrument for the protection of minors online, recognising their need for additional protection and providing for clear rules to ensure their protection online.

1.3 Existing and supporting evidence

The proposed Regulation and its accompanying Staff Working Document is underpinned by a solid and robust body of existing evidence. It directly follows on the Report of the Co-Chairs of the Special Panel, which was developed through an independent process that gathered the expertise of more than 60 specialists in diverse relevant fields. It further builds on the extensive evidence and analysis gathered in the context of the Commission’s previous and ongoing engagement on the protection of minors online, as well as national and international processes. This rich body of evidence includes a variety of sources as further detailed below.

1.3.1 The Special Panel on child safety online

This independent process brought together more than 60 leading specialists from different fields, including health, child psychology and psychiatry, computer sciences, digital technology and media, social sciences and children’s rights. Representatives from youth groups, parents’ groups and children’s rights organisations also participated. The Special panel on child safety online examined risks and opportunities for children on digital services as well as the regulatory framework and gathered extensive data. Additional stakeholders provided input throughout the process such as the OHCHR, specialised think-tanks, industry representatives, regulators from third countries as well as the European Data Protection Board. The Co-Chairs of the Special Panel also had additional meetings with representatives of Member States as well as the European Parliament and its Members, especially of the Intergroup on Children’s Rights. Informed by the meetings of the Special Panel, the Co-Chairs presented their Report in July 2026 to the President of the Commission (³⁹). The Report is intended to inform future actions and provides for an analytical assessment on how to better protect and empower minors online.

1.3.2 Existing Impact Assessments

As previously noted, the proposed Regulation does not exist in a regulatory vacuum but is a part of a broader legislative framework underpinned by existing impact assessments, and consultation processes. This Staff Working Document builds on data and analysis conducted in relation to the upcoming legislative proposal of the DFA, the evaluation and review of the AVMSD, the Regulation to combat and prevent child sexual abuse and the re-cast of the Child Sexual Abuse Directive and their accompanying Impact Assessment (⁴⁰,⁴¹), the DSA and the Digital Market Act (DMA) and their accompanying Impact Assessments (⁴²,⁴³) as well as the AI Act and its accompanying Impact Assessment (⁴⁴).

In relation to the DFA, the consultation and call for evidence was opened for 12 weeks on 17 July 2025, collecting extensive feedback from citizens, public authorities and other stakeholders, which compiled relevant evidence on addictive design of digital products and deceptive or manipulative interface design, including the impact on such practices on minors. The exercise built on the Commission's 2024 Digital Fairness Fitness Check, and sought input on practices such as dark patterns, unfair influencer marketing, addictive design, unfair personalisation, unfair pricing and issues with digital contracts and simplification rules. The Commission published its summary report of the consultation on 19 December 2025 (⁴⁵). Furthermore, on 10 February 2026 the Commission launched a public consultation for the assessment of the Impact of the AVMSD, collecting feedback from an equally wide range of stakeholders, including on the best ways to strengthen the protections for minors online. Both consultative processes provided relevant evidence for the purpose of this proposal.

1.3.3 DSA Implementation and enforcement

In addition to the work preceding the adoption of the DSA, significant evidence and data have been collected during the two years of its implementation and enforcement. In terms of enforcement, and as previously mentioned, the Commission adopted 10 preliminary findings in relation to the protection of minors, and several enforcement cases are still ongoing (⁴⁶). For instance, the Commission adopted preliminary findings against TikTok for failing to ensure safe accounts for minors (⁴⁷) and for its addictive design, including features such as infinite scroll, autoplay, push notification and its highly personalised recommender system (⁴⁸), as well as preliminary findings against Meta for failing to prevent minors under 13 from using Instagram and Facebook (⁴⁹) and related to addictive design of those platforms (⁵⁰).

The protection of minors is also a main focus for several other sources of information that are available to the Commission in the context of the implementation and enforcement of the DSA, in particular the annual transparency reports, Risk Assessment reports, audit reports required to the VLOPs and VLOSEs (⁵¹), and the Commission Reports on the risk assessment cycles (⁵²), as well as dedicated stakeholder engagement action carried out by the Commission, in particular dedicated workshops with a focus on Risk Assessment (⁵³) and several roundtables with civil society (⁵⁴). Relevant studies on the protection of minors are also conducted on an ongoing basis under the DSA.

1.3.3.1 Development and adoption of the Guidelines on the protection of minors

Additionally, the guidelines on the protection of minors were developed following a comprehensive process which included a call for evidence (⁵⁵), stakeholder workshops held in October 2024 (⁵⁶) and June 2025 (⁵⁷), a targeted public consultation (⁵⁸), further engagement with children and young people (⁵⁹) and meetings of the European Board for Digital Services within its working group on the protection of minors (⁶⁰). The 2024 call for evidence received more than 170 replies (⁶¹), and the 2025 public consultation more than 300 inputs providing detailed information from a wide range of stakeholders including researchers, civil society, industry, public authorities on good practices and measures for online platforms to design their services in line with Article 28 DSA (⁶²).

1.3.4 Continuous engagement with national authorities and stakeholders

Additional evidence sources are received on a continuous basis from the European Board for Digital Services (“the Board”) and the national Digital Services Coordinators. Protection of minors, recognised as “a core value and objective of the Board”, has continuously been a priority in the activities of the Board (⁶³). During all its meetings of the Board, Digital Services Coordinators had the opportunity to update the Board of national developments related to child safety online at national level. The Board also harbours a dedicated working group on the protection of minors (⁶⁴) where issues related to the protection of minors, in particular Article 28 DSA and the Guidelines, focusing on priority topics such as age assurance, recommender systems, online interface design and risk reviews. It also provides support to national authorities as regards the roll out of the EU Age Verification blueprint.

Furthermore, national authorities have supported the Commission’s enforcement work and provided valuable inputs for the preliminary findings on 4 pornographic platforms allowing minors to access their services (⁶⁵). The opening of investigations into Snapchat compliance with the DSA - on the protection of minors - in March 2025 also relied on substantive evidence transmitted by Digital Services Coordinators (such as the German and Dutch Digital Services Coordinators). As part of a memorandum of understanding, ACM has seconded an official to closely cooperate with Commission’s services as part of the investigations.

Engagement with national authorities and stakeholders active in the protection of minors at national level has also been supported by the deployment of DSA Officers in the representation of the European Commission in all 27 Member States. As Commission’s staff stationed in the Member States, they have engaged since March 2025, with national stakeholders such as designated trusted flaggers (⁶⁶) or national Safer for Internet Centres (⁶⁷) to collect evidence and information of the challenges related to the protection of minors. Finally, they have informed the Commission services of national initiative’s aiming at having a better understanding of the impact of certain platforms on the mental health and well-being of youth.

Member States conducted national inquiries and consultative processes with regards to the protection of minors online. In June 2026, the German Commission of Independent Experts on the Protection of Children and Young People in the Digital World presented its 56 recommendations for action for better child and youth protection in the digital world (⁶⁸). The Swedish Inquiry also published its interim report analysing the conditions for the introducing an age limit for minors’ use of social media in Sweden, in particular in light of fundamental rights and freedoms (⁶⁹). In 2024, the report ‘Enfants et écrans’ was delivered to the French President, Emmanuel Macron, highlighting the role of screens on health and children’s development and proposing several recommendations to ensure an age-appropriate use of screens (⁷⁰), followed by the Inquiry Commission on the Psychological Effects of TikTok on Minor (⁷¹) of the French National Assembly. In the context of their ongoing national processes, Austria and Norway also conducted impact assessments regarding their proposals for a minimum age (⁷²,⁷³).

1.3.0 International engagement

DG CNECT concluded a series of cooperation arrangements with front runner regulators, including with the UK’s Ofcom (⁷⁴), Australia’s eSafety Commissioner (⁷⁵) Brazil’s National Data Protection Authority (⁷⁶), and Japan’s Ministry of Internal affairs and Communication (⁷⁷). DG CNECT is in regular contact via Digital Partnerships and Dialogues with other jurisdictions such as Singapore, Canada, and Switzerland (⁷⁸). On 7 November 2025, DG CNECT, Ofcom and the eSafety Commissioner, launched a trilateral technical cooperation group on age assurance to further explore ongoing regulatory and policy developments, including the Australian Social Media age restrictions’ implementation (⁷⁹).

These arrangements facilitate the cooperation and sharing of experience at global level. Key insights include the Australian impact assessment underpinning the Online Safety Amendment (Social Media Minimum Age) Act 2024, the eSafety Commissioner’s March 2026 compliance report and the second report co-developed by the eSafety Commissioner in partnership with Stanford University (⁸⁰,⁸¹). The evidence and enforcement of the Brazilian ECA Digital by the Brazilian Data Protection Authority (ANPD), covering strong provisions to ensure a high level of safety and privacy for minors including the prohibition of lootboxes, parental control tools and implementation of age assurance (⁸²), also contributed to the available evidence-base. Additionally, the United Kingdom, and more specifically OFCOM as the relevant independent regulator, has gathered significant evidence in the context of the adoption of the Online Safety Act and its implementation. This evidence includes an impact assessment, as well as several reports procured by OFCOM.

At multilateral level, protection of minors online has become a priority area for action with a growing body of evidence and expertise emerging across jurisdictions. On 17 June, the G7 Leaders launched a call on different jurisdictions to support a safer and more secure digital space for minors including with measures against addictive features, safety by design and age assurance (⁸³, ⁸⁴). This G7 leaders’ call builds on G7 principles on the protection of minors online, which acknowledge that the use of digital services ’can lead to compulsive, habit-forming, and other problematic uses and behaviours, which may impact self-esteem and further threaten their [minors’] health’ (⁸⁵).

1.3.1 Youth Consultations

In its meeting of December 2025, the President Youth Advisory Group discussed age restrictions and online safety in the digital environment (⁸⁶). The Youth Advisory Group brings together more than 30 young representatives, one from each EU Member State’s National Youth Council, one from the European Youth Forum, and observers from candidate countries and potential candidates for EU accession. During their meeting, the Group discussed the benefits and risks of social media, the importance of digital literacy as well as the need to ensure that digital service providers are held accountable for their services.

The EU co-funded network of Safer Internet Centres also plays a central role in supporting child participation at national level as well as in analysing and understanding online safety risks through their helplines and hotlines. Together with the Better Internet for Kids (BIK+) platform, the network reached 46 million people in 2025 alone, a presence and reach that is regularly translated into feedback to national authorities and the Commission on emerging trends and priorities in the field of child online safety. In particular, the network also supports BIK+ Ambassadors that represent children and youth in several instances on child online safety, such as the Safer Internet Forum, the national events on Safer Internet Day or the European Forum on the Rights of the Child. In December 2025, the annual Safer Internet Forum, which involved over 200 children, young people and representatives from civil society, industry and national authorities, discussed the topic of age restrictions to social media, approaches to online safety and respecting children’s rights (⁸⁷).

In the context of the preparation and adoption of the action plan against cyberbullying, a wide variety of stakeholders have been consulted, including children and young people through targeted and public consultations. Thanks to the Commission’s survey carried out via the EU Children’s Participation Platform, 6300 children were able to give their inputs on cyberbullying and help shape the action plan (⁸⁸). The EU Children’s Participation Platform was also used in the context of a consultation linked to the upcoming Digital Fairness Act. Questions were also raised in relation to rules for joining social media. In total, 4,786 children aged 12-17 were from all EU Member States and EU citizens living abroad took part in the survey. Children emphasised that they want the online environment to be safer, with stronger rules for services (⁸⁹).

1.3.2 Additional studies

Between March and April 2026, the Commission conducted a Eurobarometer survey on the impact of excessive screen time and social media on young people’s mental health collecting data from more than 26,000 13-18 years old and more than 12,000 parents across all 27 Member States (⁹⁰). The annual survey carried out in the context of the State of the Digital Report as well as the Special Eurobarometer on the digital Decade provided additional data points in terms of the growing and sustained concern for Europeans to protect children online (⁹¹,⁹²).

In August 2026, the Commission procured an additional study (‘the external study’) for the purpose of complementing the existing body of evidence and support the proposed Regulation and its accompanying Staff Working Document. The study examines the impact of age assurance on the fundamental rights of children as well as adults and analyses the economic impacts of implementing age assurance solutions from the perspective of the services and systems in scope. The results of the study are expected to be finalised and published in Q4 2026.

Taken together, this body of evidence and consultation processes constitute a solid foundation for the proposed Regulation and underpin the findings of its accompanying Staff Working Document.

2 State of play And problem statement: the protection of minors in the European union

The proposal for a dedicated instrument for the protection of minors online responds to several identified problems regarding the safety of minors in the online environment. These problems include (1) a fragmented internal market, (2) an evolving online environment with certain services and systems that are risky and not appropriate for minors and (3) a lack of clear requirements for age assurance.

2.1 A fragmented internal market

Across the European Union, Member States are discussing or adopting new measures restricting access to certain online services considered risky for children under a specified age (⁹³). In July 2026, the French Parliament voted on a national measure restricting access to social media for under 15 years old which was foreseen to enter into force in September 2026 and is pending a review following a negative decision of the Constitutional Court (⁹⁴). Several other Member States are well advanced in their process of adopting similar measures. The draft national laws were notified by France in April 2026 (⁹⁵) and in September 2026 (⁹⁶), Italy (⁹⁷), Greece (⁹⁸), Austria (⁹⁹), Norway (¹⁰⁰) and Belgium (¹⁰¹)to the Commission in the course of 2025 and 2026. Entry into force is expected for Greece and Austria in January 2027.

Consultative processes have also been set up in several Member States. In June 2026, Germany’s expert committee and Sweden’s inquiry concluded with recommendations respectively proposing a minimum age limit at 13 (¹⁰²) and of 15 (¹⁰³). In almost all other Member States, legislation has been announced by governments or is being discussed in national parliaments. Several Member States have also indicated a preference for action at European level. Figure 1 provides an overview of national developments; it includes the stage of the process, the ages being proposed, and whether parental consent is being considered (¹⁰⁴).

Figure 1: Overview of national developments as of 7 September 2026.

The legislations discussed at national level differ in several aspects including their scope, age limits and types of restrictions.

2.1.1 Differences in proposed scope

In terms of scope, some Member States, such as Greece (¹⁰⁵) and France (¹⁰⁶), define the restricted services as online platforms under the DSA that can be considered as an online social networking service as defined under the Digital Markets Act (DMA). Norway is additionally considering the further criterion of “harmful” defined as “a service that, through its design, features or content, can be harmful to children's emotional, cognitive or health development or safety” to limit the scope of the access restrictions (¹⁰⁷). Austria, on the other hand, defines the scope of their restriction based on the definition of a VSP under the AVMSD which offers at least one functionality considered harmful to minors (¹⁰⁸). The law sets out a non-exhaustive list of such functionalities, the supervisory authority being empowered to identify others as appropriate. The draft notified by Italy proposes to restrict access to both social media services and VSPs. Belgium takes another approach combining a broad scope ‘intermediary services’ with a qualitative criterion of ‘negatively impact the physical, mental or moral development of minors’ similar to Norway. This criterion would be assessed by the Flemish Government which would then prepare a list of the services to fall within the scope of the age restriction (¹⁰⁹).

2.1.2 Differences in proposed age limits

In terms of age, the Greek and French draft legislation prohibits access to under-15s. In Norway, under the current draft, the age limit would be set at 16. Some Member States have also proposed different ages including 13 and 14 (¹¹⁰). Additionally, allowing for a lower age limit with parental consent is discussed in for example Denmark and Greece (¹¹¹). It should be added that while some legislation relies on the actual age of the minor, some refer to the year in which the minor turns a certain age (¹¹²).

Figure 2 Minimum age proposed or discussed by EU Member State as of August 2026

2.1.3 Differences in the proposed restrictions and additional measures

In terms of types of restrictions, national drafts refer to limiting “access”. It remains unclear whether this would focus on account creation, as suggested by the French first notified draft (¹¹³), or if this would extend to overall access to a service. Account restrictions are different from an access restriction: an account restriction might not limit access to certain parts or content of the service which may be accessible without a log-in.

Some Member States are proposing and discussing legislation going beyond establishing a minimum age by also providing additional requirements regarding age assurance or obligations relating to safety-by design. Greece, for instance, requires that providers in scope apply appropriate, proportionate and reliable age verification methods, which can be supplemented by age estimation methods when deemed necessary (¹¹⁴). Austria’s notified draft also outlines requirements for age verification including data minimisation, functional separation between the VSP and the age verification provider, non-traceability of the age credentials and interoperability amongst others (¹¹⁵).

2.1.4 Legal uncertainty, compliance costs and an unequal level of protection for minors

In practice, the emergence of diverging national laws is already leading to a fragmented internal market. Access to a specific online service might be delayed in one Member State but not in others, depending on the scope of the legislation and its exemptions. Additionally, it might be restricted for different age groups and subjected to parental consent in only some Member States. The practical implementation of these national laws might also differ in terms of entry into force, application to access or accounts, specific requirements for age verification and enforcement frameworks.

Those diverging national measures impact the provision of digital services and possibly could extend in the future to other systems (such as certain chatbots), a market that is inherently cross-border in nature and operates across the European Union. It leads to significant compliance burdens for providers of such services and systems, including for certain small and micro enterprises which are included in the scope of some national measures. As large competitive advantages already exist, it creates an additional barrier for scaling-up and increases the competitive advantage for companies large enough to absorb such costs.

Furthermore, this patchwork of national measures gives rise to enforcement difficulties. Under the current legal framework, authorities from Member States may have to enforce the access restrictions of other Member States against providers established in their territory. This would require competent authorities to have knowledge and understanding of the measures taken by all other Member States, as well as multiply processes and procedures for enforcing restrictions.

Children will also face different levels of protection across the European Union, where they will be able to access different services at different ages, with a three-year gap between certain Member States, and under different circumstances. This sends contradictory messages to parents and children alike about the age-appropriateness of certain services and the risks associated with them. The lives of children may not be constrained to one Member State, as children might have families or friends living in a different Member State, or simply go to school or spend long periods of time in a different Member State than that in which they reside. This impacts the effective implementation of those measures, and the normative change sought. Peer pressure and social expectations will remain for children to join the online services concerned at a young age.

Overall, emerging national legislation will create a patchwork of access restrictions leading to a complex and uncertain regulatory environment for digital services and possibly other systems that could be affected in the future, creating an uneven level of protection for minors across the European Union, enforcement complexity and compliance costs.

2.2 An insufficient level of protection for minors online

Children’s lives are increasingly shaped by the online environment, which is now deeply embedded in their social, educational and leisure activities, as well as their development. However, this growing digital engagement is not matched by an equivalent sense and standard of safety. Across Europe, only 48% of children aged 9–16 report feeling safe online, while many also recognise that they spend too much time on the internet (¹¹⁶). Children are going online at younger ages and spending more time online as they grow older (¹¹⁷,¹¹⁸). By adolescence, screen use occupies a substantial part of daily life. In Europe, young people aged 13-18 report spending an average of 4.5 hours a day on screens on school days and 6.1 hours a day at weekends; nearly half (46%) spend more than 6 hours a day, and 14% spend more than 10 hours (¹¹⁹).

2.2.1 The risks faced by children online

During the time spent online, children are exposed to many risks. As detailed in the Report of the Co-Chairs of the Special Panel, these risks are wide-ranging and often interconnected. They include exposure to harmful or age-inappropriate content, cyberbullying, unwanted contact from strangers, infringements of privacy and dignity, and serious adverse effects on mental and physical health. The Report also stresses that these risks often overlap and may affect some groups of minors more severely, including children with disabilities, those from minority backgrounds, and those with pre-existing mental health difficulties (¹²⁰,¹²¹,¹²²,¹²³,¹²⁴,¹²⁵,¹²⁶,¹²⁷,¹²⁸,¹²⁹).

Table 1 below synthesises a range of risks categories that children frequently encounter online, drawing on the Report of the Co-Chairs of the Special Panel alongside additional evidence from EU institutions, regulators and independent research.

Table 1 Overview of risks minors face online.

These risks, individually and in combination, carry serious consequence for children’s mental health and well-being. Adolescents are already a particularly vulnerable group when it comes to mental health. In Europe 59% of young people report ¹⁵⁰emotional or psychosocial difficulties (¹⁵¹). A growing body of evidence links online platforms and related systems to these vulnerabilities through three main pathways, namely excessive or displaced use driven by platform design, harmful content, and -interactions (¹⁵²,¹⁵³).

A recent study found that social media use was associated with an increase in ADHD-related symptoms in children over time (¹⁵⁴). Beyond time spent online, adverse experiences in digital spaces matter too. Online victimisation, including cyberbullying, has been associated with deliberate self-harm and suicidal ideation (¹⁵⁵), and cyberbullying more broadly is linked to a range of emotional difficulties, including persistent sadness, social isolation and heightened anxiety (¹⁵⁶,¹⁵⁷). Eurobarometer data further indicate that nearly one in three adolescents report feeling stressed, sad or socially excluded because of social media, with social comparison and fear of missing out identified among the main resources of pressure (¹⁵⁸,¹⁵⁹). These effects, however, are not uniform. They vary across services, design features and individual circumstances (¹⁶⁰).

These patterns of intensive digital engagement are also associated with physical health impacts. Based on self-reports covering 30 days before the survey, children report symptoms including tired eyes, fatigue, headaches, concentration difficulties and sleep problems, with prevalence rising sharply among the heaviest screen users (¹⁶¹). More broadly, excessive or inappropriate use of digital services and systems may contribute to reduced physical activity, less time spent outdoors, and shorter or poorer-quality sleep, including by displacing sleep, increasing psychological stimulation, and suppressing melatonin production (¹⁶²).

2.2.2 Age specific challenges

As emphasised by the Report of the Co-Chairs of the Special Panel and as illustrated by Figure 3, the risks minors face online evolve across developmental stages, shaped patterns of exposure, interaction and vulnerability. Available evidence indicates that early digital exposure may have long-term impact on mental health and well-being. Receiving a smartphone early in life has been associated with a higher likelihood of severe mental health difficulties in early adulthood, with early social media access, cyberbullying and poor-quality offline relationships as relevant mediating pathways (¹⁶³). This is especially significant because childhood and early adolescence coincide with stages in which cognitive control, emotional regulation and resistance to social pressure remain under development (¹⁶⁴,¹⁶⁵), with heightened vulnerability persisting well into adolescence, as reward sensitivity and concern with social evaluation intensify while these capacities are still maturing (¹⁶⁶,¹⁶⁷,¹⁶⁸,¹⁶⁹,¹⁷⁰).

Figure 3 Psychological vulnerability throughout development.Source: Taken from the Report of the Co-Chairs of the Special Panel(¹⁷¹).

2.2.3 The emergence of new risks from AI

These developmental vulnerabilities are increasingly compounded by the growing integration of AI into children’s digital lives. While AI may provide significant benefits for minors, including by supporting their development and education and by facilitating access to information, age-appropriate services and personalised learning opportunities, minors may be more susceptible to harms arising from their interactions with AI than adults, due to their age, maturity and stage of cognitive, emotional and social development. In particular, minors may have a more limited capacity to critically assess the accuracy, reliability and underlying intentions of AI-generated content and interactions, and may therefore be more likely to rely on advice or recommendations provided by AI, or to develop excessive reliance or dependency on such systems and models. Such risks are further heightened where those systems and models simulate social relationships, provide personalised or adaptive interactions, operate persistently or in emotionally salient contexts.

AI companions and chatbots are increasingly used by minors to establish such interpersonal or social interactions that may substitute healthy social and trusted relationships with other humans (¹⁷²,¹⁷³,¹⁷⁴,¹⁷⁵). Particularly serious risks arise when minors are exposed to illegal, sexualised, violent or otherwise age-inappropriate or harmful content generated by those AI chatbots, including sexualised and romantic conversations, that may distort minors’ understanding of relationships, intimacy, consent and appropriate sexual behaviour, creating gender-biased, unrealistic or harmful expectations about interpersonal relationships and interactions; when minors have interactions relating to self-harm or suicide; or in the context of the provision of other harmful advice minors may obtain and exposure to content that may encourage self-harm (¹⁷⁶, ¹⁷⁷). The use of such chatbots may also give rise to potentially serious risks of minors’ emotional dependency, social withdrawal, and a reduced engagement in real-life relationships, as well as adverse impact on their safety, physical, emotional and mental well-being and interference with their development of independent judgement, cognitive capacities and social skills. AI chatbots may be designed or optimised to please users, agree with them, or mirror their views and emotions. For minors, this can reinforce immature, risky, or harmful beliefs and behaviours instead of challenging them appropriately.

These chatbots may also exploit vulnerabilities with manipulative design such as behavioural nudging, exploiting children’s curiosity, reward sensitivity, and impulsivity (¹⁷⁸). This can lead to compulsive use, with adolescents spending hours each day interacting with AI at the expense of schoolwork and real-world relationships, diminished autonomy and, in several cases, emotional distress when access is restricted or the system is altered (¹⁷⁹). Moreover, biases embedded in AI systems, including algorithmic and societal ones, may further amplify the spread of harmful content and misinformation, entrenching stereotypes that children can internalise from an early age (¹⁸⁰).

2.2.4 Specific risks on online games

Estimates show that ~80% of minors between 2 and 18 spend 30% of entertainment time gaming (¹⁸¹). While playing online games, minors can find entertainment, environments to connect, communicate and share as well as other benefits such as finding community and escaping stress or negative feelings (¹⁸²,¹⁸³). A wide variety of online games exist, which differ in type and business model, with many also offer features resembling online platforms and posing similar risks (¹⁸⁴). Open communication and the creation of user-generated content on these services may expose children to cyberbullying, grooming, radicalisation or age-inappropriate content (¹⁸⁵). Certain games may also use specific commercial practices that can exploit the vulnerability of children and cause unwanted spending, compulsive or addictive behaviours, such as loot boxes, pay-to-advance mechanisms and certain in-app purchases and virtual currencies (¹⁸⁶,¹⁸⁷,¹⁸⁸). Additionally, gaming disorder is now included in the WHO International Classification of Diseases, with evidence suggesting that boys between 11 and 15 face heightened risk of problematic use and affect adolescents facing possible behavioural and emotional issues as well as psychosocial and sleep-related disturbs (¹⁸⁹).

2.2.5 The benefits of the online environment

Despite exposure to a wide range of risks, digital services and systems also offer important opportunities for minors. For many children and young people, the digital sphere offers spaces for participation, social connection and community-building, including for those who may feel marginalised or isolated offline (¹⁹⁰). Social media and other digital services and systems can facilitate peer affirmation and relationship-building and may help reduce feelings of loneliness where in-person interaction is restricted (¹⁹¹,¹⁹²,¹⁹³), while also providing relatively low-pressure environments for identity development, self-expression and creative exploration (¹⁹⁴,¹⁹⁵).

Digital services and systems can also function as an important source of information and support, particularly for vulnerable minors looking to connect with others who share similar experiences (¹⁹⁶,¹⁹⁷). For instance, research indicates that adolescents from LGBTQI+ communities may be more inclined to use online environments to explore their sexuality and identity, access information on sexual health, and seek peer support and social connection while avoiding the risks associated with “in-person” interactions.

In addition, digital tools can enhance learning and skills development through more personalised and engaging forms of instruction (¹⁹⁸,¹⁹⁹,²⁰⁰,²⁰¹), while AI-based applications can further expand opportunities for tailored support and feedback. This enables educators to adapt teaching to student performance, provide timely feedback and support, and tailor individual assistance accordingly (²⁰²,²⁰³). Realising these benefits, however, depends on minors being able to interact safely online, which is why services and systems should be safe by design.

2.2.6 Age-inappropriate platform design

Platform design is central to both the risks outlined above and the extent to which minors can safely realise the benefits digital services offer (²⁰⁴, ²⁰⁵). This is illustrated by the Online Minor Protection Matrix developed by the European Commission’s Joint Research Centre, which maps common platform features, including recommender systems, default settings, notifications and beauty filters, onto the categories of risk with which they are most commonly associated (²⁰⁶). These features are not inherently risky; their impact depends on platform design and use. Some, such as parental controls, are generally protective, while others, such as beauty filters, are more consistently associated with harm, and many, including comments and content recommendations, may be either beneficial or harmful depending on implementation.

Platform design choices play a key role in creating these risks, as current protection for minors remain inadequate. Addictive design features and “dark patterns”, such as autoplay, infinite scrolling, gamification and push notifications, may distort minors’ ability to make autonomous choices and encourage prolonged engagement (²⁰⁷,²⁰⁸,²⁰⁹,²¹⁰,²¹¹). At the same time, recommender systems that rely on behavioural data to personalise content may steer minors towards harmful or age-inappropriate material, reinforcing repeated exposure and interaction (²¹²). Other design elements, including “like” mechanisms, read receipts, and notifications, have likewise been identified as deliberate tools for maximising engagement (²¹³,²¹⁴), reflecting the systemic risks recognised under the DSA. Emerging evidence suggest that platform design affects adolescent well-being. In a 100-day study, the use of short video platforms with engagement-maximizing feeds had overwhelmingly negative effects on well-being and self-esteem, whereas messaging-focused services showed neutral or positive effects (²¹⁵).

2.2.7 An insufficient level of compliance and legislative gaps

Overall, the online environment has not been designed with children in mind and does not cater for their evolving capacities. Children face many risks online, which can have severe impacts on their well-being, development as well as their physical and mental health. Those risks are constantly evolving together with new technologies and platforms, as children are early adopter of new technologies, they also remain the most vulnerable to these risks. While the opportunities offered by the online environment should not be underestimated, their realisation and positive impacts on the lives of children ultimately depend upon digital services and systems being safe and age appropriate.

The European Union has made the protection of minors online one of its core priorities. With the DSA, the critical role and responsibility of digital services and systems in designing a safe environment and empowering users have been recognised and enshrined in law. Article 28(1) DSA obliges providers of online platforms to put in place appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors, on their service. With the publication of its guidelines on the protection of minors in July 2025, the Commission has further set out measures that online platforms must take to ensure a high level of privacy, safety and security. They include adapting their recommender systems, account settings, reporting systems and disabling features contributing to excessive use such as streaks, autoplay, read receipt and push notifications (²¹⁶). In addition, VLOPs and VLOSEs must diligently identify, analyse and assess any systemic risks to the rights of the child, the protection of minors and any actual of foreseeable negative effects on physical and mental wellbeing (Article 34 DSA). Following this assessment, they must put in place effective measures to mitigate those risks, including adapting their online interfaces and recommender systems (Article 35 DSA).

Despite those established standards, there are concerns that providers continue to fall short and risks remain on online services for minors. In 2026 alone, the Commission preliminarily found both TikTok and Meta (²¹⁷,²¹⁸) in breach of the DSA over addictive design features and inadequate safeguards for minors, opened proceedings against Snapchat over grooming and inadequate default account settings (²¹⁹), and preliminarily found that Meta had failed to prevent minors under 13 from accessing Instagram and Facebook (²²⁰). To note again that Preliminary Findings and opened proceedings are only an intermediate step in a Commission investigation, and the investigation continues (for opened proceedings) or VLOPs now have the possibility to exercise their right to defence (for preliminary findings), before the Commission decides on next steps in these cases. However, these steps signal the suspicion of potential lack of compliance of these providers. Similarly, the Commission has some concerns as to the overall level of implementation of the guidelines on protection of minors across online platforms. These continued concerns indicate the need to further clarify existing rules and codify more precisely measures to ensure a safe and age-appropriate environment for minors online.

Concerning online games, section 2.2.4 highlights how some risks are present across types of games and are not only limited to online games that are online platforms. Some online games might therefore not be covered by existing rules while presenting similar risks, indicating the need to extend the scope of safety by design obligations.

As regards AI, while the AI Act contains several safeguards to protect health, safety and fundamental rights, including those of minors, risks to minors posed by companions and chatbots are not subject to specific safety by design measures. Under the AI Act, AI chatbots and companions are subject to the transparency requirements for AI systems directly interacting with natural persons and to the requirement to mark AI-generated content to enable its detection. Depending on other functionalities and factors, an AI companion may also constitute a prohibited practice (for example, in cases involving the exploitation of children’s vulnerabilities) or qualify as a high-risk AI system (for instance, where it incorporates emotion recognition functionalities). The Commission monitors the risks these systems can pose and has noted this as an area of concern in its report published as required under Article 112(1) AI Act (²²¹).

The current framework does not comprehensively address risks arising from AI companions and general conversational chatbots that, although not classified as high-risk AI systems, are likely to be used by or to interact with minors in everyday contexts causing risk to minors’ health, safety and fundamental rights and their well-being and development, as explained in the previous sections. Such risks vary from possible addictive designs in AI chatbots to AI features capable of displaying behaviours or simulating emotions or interpersonal relationships that may lead to emotional dependencies for minors and other physical, mental and emotional well-being and developmental concerns (²²²).

As the risks facing minors online remain high and severe, a strengthened framework must be established to ensure that digital services and systems providers adopt the necessary measures for minors as a matter of emergency. This new legislation will take the child as the starting point and enshrine the need for safety by design and age-appropriate measures across the digital environment. Clarifying and codifying rules on minimum age for certain services and systems as well as on safety by design will ease compliance and enforcement, as well as clearly put the responsibility onto the providers of those services and systems to demonstrate that their service or system is safe.

2.3 A lack of clear requirements for age assurance and ineffective implementation

To ensure a safe and age-appropriate online environment for minors, age assurance is critical as noted by the Report of the Co-chairs of the Special Panel. Indeed, age assurance underpins both age restrictions and age-appropriate safety by design measures. However, the current framework around age assurance lacks clarity and its implementation is patchy.

2.3.1 Age assurance underpins safe online experiences for minors

Age assurance is crucial to ensure that minors only access services and systems that are safe and age appropriate. Currently, many minors below the established age limit access and use digital services and systems that are not designed for them. A range of surveys indicate that in the EU millions of minors under the age of 13 use social media and have their own accounts (²²³). For example, across six countries, 34% of 9–11-year-olds report having a social media profile (²²⁴). In April 2026, the Commission preliminary found META in breach of the DSA for failing to effectively prevent minors under 13 from accessing Instagram and Facebook (²²⁵). The measures put in place by META to enforce the restrictions of 13 do not seem to be effective. The Commission also investigates TikTok and Snapchat for the same issue (²²⁶). To note again that Preliminary Findings and opened proceedings are only an intermediate step in a Commission investigation and merely indicate a suspicion of a potential lack of compliance of these providers.

Age assurance is also important to ensure that minors who are old enough to have accounts receive age-appropriate experiences. The Report of the Co-Chairs of the Special Panel emphasizes that child safety online must follow a developmental approach that tackles age-specific risks. Some online services have started – to an extent – to differentiate certain experiences for different age groups. For instance, several services now offer so-called “teen accounts”, and the terms and conditions of certain platforms only allow users above 16 or above 18 to host LIVE streams or to access adult content, and vary some account settings with age (²²⁷, ²²⁸). While the account settings on many online services are often not safe for minors even when the platforms identify them as such (²²⁹), minors automatically receive adult settings when they are not recognised as minors. The guidelines on the protection of minors make clear that ineffective age assurance such as self-declaration alone measures cannot underpin age-appropriate design. As mentioned above, the Commission investigates several very large online platforms for failing to ensure that 13-17-year-olds receive age-appropriate experiences (²³⁰, ²³¹), indicating a suspicion of potential lack of compliance of these providers.

2.3.2 Ineffective implementation of age assurance

Existing age requirements on online services are typically not developed based on children’s needs and hardly enforced. Most providers of digital services set out a minimum age to access or use their service in their terms and conditions (²³²). As noted by the OECD, the rationales behind the ages chosen by services derive from privacy and contract laws reasons rather than based on an assessment of safety or developmental appropriateness (²³³). The OECD further highlights that “very few of [the services that set a minimum age in their Terms of Service] implement age assurance in a systematic way” and that only 2 out of the 50 online services studied systematically require assure age for account creation (²³⁴). The only age check before account creation is typically self-declaration. It is widely recognised that self-declaration alone is not an effective age assurance measure, because many users do not reveal their true age (²³⁵, ²³⁶, ²³⁷). Minors routinely mis-state their age online (²³⁸). In practice, underage users can therefore easily access many age-restricted online services.

Figure 4 illustrates that both age verification and age estimation are deployed at most in haphazard way. Some services have recently started to require age checks before accessing certain high-risk features, such as live streams. Yet, many users do not use these features and users typically remain on the service if they fail to prove being old enough for an age-restricted feature. Hence, most users only need to prove their age once they have been flagged as likely underage and offered to appeal a pending account suspension. Account-based services often try to infer users’ age ex post, for instance by using age inference models that predict users age from their behaviour on the service (behavioural profiling), sometimes combined with human reviews (²³⁹). While these systems can contribute to age assurance, they have failed to detect many minors with false stated ages. This is likely due both to inherent limitations of age inference – especially for users who reveal limited information about themselves and do not share videos and images of themselves – and to implementation choices that reduce the detection of minors (²⁴⁰).

Figure 4 Circumstances in which online services use (a) age verification and (b) age estimation in 2024

(a) Use of age verification

(b) Use of age estimation

Note: Taken and adapted from OECD (2025).²⁴¹

The recent experience in Australia illustrates that it is difficult to ensure effective age assurance without concrete requirements for age checks before account creation. The Australian law only requires “reasonable steps to prevent Australians under 16 from creating or keeping accounts” (²⁴²). A range of surveys and the eSafety Commissioners own data suggest that the majority of minors who previously had social media accounts still have them (²⁴³,²⁴⁴,²⁴⁵,²⁴⁶). Crucially, most minors were never asked to prove their age (²⁴⁷). More recent laws on online age restriction typically require age checks before account creation (²⁴⁸). While no age assurance system is completely circumvention-proof, age checks before account creation likely increase the effectiveness of age restrictions.

2.3.3 The need for clear age assurance requirements

While age assurance is an important measure to ensure the safety of children online, they should not result in the exploitation of users’ personal data. Many services currently do no offer users any privacy-preserving options to verify their age. Some services force users to upload their identity documents directly to the service (²⁴⁹). This creates significant privacy and security risks because it reveals the user’s identity and often additional sensitive information on the document, such as precise birthdate, national identity number, sex, home address, and sometimes other personal characteristics (²⁵⁰). Furthermore, these data are sometimes stored for extended periods of time (²⁵¹). As emphasized by Fegert and Melchior (2026), “[a]ny method employed to check age should uphold the highest privacy and data protection standards and should not lead to the processing of identity documents and biometric data for the purpose of age estimation.” Privacy-preserving age assurance solutions are rapidly developing, and the EU Age Verification Solution allows citizens to verify their age under the highest privacy standards (²⁵²). In order to be implemented in such a way that they always remain privacy-preserving, such solutions must be mandated to respect minimum requirements, so as to ensure that age assurance measures remain in line with the fundamental rights of all users, including their right to privacy and data protection.

Overall, age assurance is an important measure for the protection of minors online, not only in terms of enforcing access restrictions to content or services that are harmful to children, but also to ensure that services are designed in an age-appropriate manner. Currently, age assurance measures are not robust nor effective and are used in a manner that may infringe upon children and adult’s rights to privacy and data protection. Clear rules are therefore necessary so that age assurance is used in a manner that serves minors in practice, is proportionate to the risk and abides by fundamental rights.

3 Proposed Regulation: a harmonised approach to children’s online safety

Considering the fragmentation of the internal market, the currently insufficient level of compliance and protection for minors online and the ineffective implementation of age assurance, a new legislative instrument is required to harmonise rules on access delays, strengthen the level of protection of minors online and provide clear criteria on the use of age assurance.

3.1 The need for a harmonised European approach

Following on the Report of the Co-Chairs of the Special Panel, this new legislative instrument aims to further improve the protection of minors in the online environment, and ensure the functioning of the single market, in particular in relation to the cross-border provision of certain online services and systems. The legal basis for the proposed Regulation is Article 114 of the Treaty on the Functioning of the European Union (TFEU) (²⁵³). In accordance with Article 114(3) TFEU, the proposed Regulation aims at ensuring a high level of protection for the health and safety of children across the Union considering new technological developments.

As noted by the Report, and as demonstrated in section 2.1, harmonised rules at Union level establishing a single legislative framework for providers of certain online services and systems accessible to minors would contribute to the proper functioning of the single market by simplifying the legal environment for providers of those services and systems, ensuring legal certainty and easing compliance.

Considering the significant risks faced by children online across the Union and the cross-border aspect of certain digital services and systems, the proposed Regulation will provide a common, clear and coherent legal framework for the protection of minors in the digital environment. By taking children and their specific needs as a starting point, the proposed Regulation will further complement the DSA and the AI Act ensuring legal certainty and a high level of protection for minors online. Children will benefit from the same level of protection across the Union.

By setting clear rules on protection of minors online, the proposed Regulation also aims at providing for the best conditions for innovative cross-border digital services and systems to develop in the European Union, in respect of children’s needs and evolving capacities.

3.2 A regulation for child online safety

In line with the recommendations of the Co-Chairs of the Special Panel, the proposed Regulation aims at ensuring a strong and coherent framework for the protection of minors online. The proposed Regulation will have the objective to (1) protect minors from being exposed to an age-inappropriate experience online, (2) ensure the respect of the rights of the child in the online environment, (3) uphold the digital single market; and (4) maintain a coherent regulatory framework and enforcement structure for the protection of minors online.

In line with those overall objectives, the proposed Regulation therefore sets out the following:

• (a)Provide for a harmonised minimum age of 15 years for creating an account on risky social networking services and video-sharing platforms;
• (b)Provide for the possibility, under certain conditions, for guardians to create accounts for minors below 15 with certain services and systems that fulfil safety requirements and allow access through such accounts with parental supervision;
• (c)Provide harmonised safety by design requirements for services and systems in scope;
• (d)Establish clear requirements and criteria for the use of age assurance systems to underpin the access delay and the implementation of safety by design measures;
• (e)Encourage and provide guidance to Member States on developing national measures and policies to support and complement the proposed Regulation;
• (f)Consolidate a coherent and robust enforcement framework to ensure timely and efficient implementation.

The sections below set out how the proposed Regulation will address each of these elements. Additionally, section 3.2.6 analyses how the proposed Regulation addresses the recommendations of the Co-Chairs of the Special Panel.

3.2.1 Provide for a harmonised minimum age of 15 years for creating an account on risky social networking services and video-sharing platforms

As outlined in the Report of the Co-Chairs of the Special Panel, and in section 2.2, certain online social media are particularly risky for minors and access to such services shall be delayed. A harmonised minimum age would ensure a uniform and high level of protection for all children across the EU on these services and systems. In line with children’s fundamental rights to freedom of expression and information, the proposed Regulation delays access only to the creation of accounts on defined categories of services, online social networking services and video-sharing platform services, that pose specific risks to minors based on their functionalities as listed under Article 6(1) of the proposal. Those functionalities aim at targeting specifically addictive or compulsive use, contacts risks, conduct risks and content risks. For instance, limiting contact and the sharing of content with strangers aims at reducing risks of grooming and child sexual abuse as offenders systematically use social media to establish contact with minors (²⁵⁴).

To further ensure the proportionality of the access delay, the scope of the proposed Regulation does not apply to certain services and systems, such as not-for-profit encyclopaedias, services and systems designed for purely educational purposes and operated by educational establishments, services and systems designed and operated for purely scientific purposes, and open-source software development platforms. In addition, the proposed Regulation also foresees the possibility of amending this list with a view to exempt other services or systems that may pose equivalently low or lower risks to minors as these categories of services and systems.

While the Report of the Co-Chairs of the Special Panel recommended a harmonised EU-wide access restriction for children under 13, the proposed Regulation delays the possibility to create an account on risky services and systems in scope until the age of 15 in view of the specific vulnerabilities of adolescents between 13-15 as pointed out in the same Report. Until 15 years old, teenagers are vulnerable to social evaluation, more prone to risk-taking and are developing their cognitive control systems. Social media and other risky services and systems can reinforce dependence on external regulation in a time where adolescents are extremely vulnerable to mental health problems (²⁵⁵). To limit their exposure to potential harm during a stage of peak developmental vulnerability, autonomous access to social networking and video-sharing platforms should be delayed.

3.2.2 Provide for the possibility for children below 15 to access certain services and systems that fulfil safety requirements with parental supervision

As recognised by the Report of the Co-Chairs of the Special Panel, children are not a homogeneous group considering their personal and individual circumstances (²⁵⁶). Children may be at different stages of development and maturity while of the same age. In this context, it is important to consider that risks of addiction emerge from the interaction between digital features, such as variable rewards, infinite scrolling and constant availability, and developmental vulnerabilities. Moreover, parents have a special role in guiding their children in accessing and using the digital world and remain best placed to assess their children’s needs and vulnerabilities.

To facilitate the child’s transition to autonomy, and in line with its best interest (²⁵⁷), guardians will have the possibility to set up an account for their children between the age of 13-15 with limited functionalities. Furthermore, for children below 13, guardians may decide to give guardian-controlled access to their children to child-friendly video-sharing services with accounts under their direct supervision. Those accounts created by guardians will fulfil specific and strengthened safety requirements, including having carried out and published an assessment of the impact of its service demonstrating the lack of risks for minors on its service. The proposed Regulation sets out how such video sharing platform services exceptionally accessible to children below 13 years through guardian-controlled access should provide a service that complies with safety by design requirements, is specifically designed for children and age-appropriate.

3.2.3 Provide harmonised safety by design obligations for digital services and systems accessible to minors

Following recommendation 3 of the Report of the Co-Chairs of the Special Panel, the proposed Regulation specifies, harmonises and extends safety by design rules for social networking services, video-sharing platforms services, online games, AI companions and general conversational chatbots accessible to minors. As noted by the Co-Chairs, extending and harmonising these rules ensure legal certainty and a high level of protection for minors across the digital environment (²⁵⁸). Overall, these rules address inherent risks that certain features and functionalities pose to children and aim at ensuring a safer environment by design and by default.

Safety by design requirements for all services and systems in scope include a clear prohibition on addictive design features as well as requirements to provide minors with options to tune and control information suggested by recommender systems. In addition, providers of online social networking services and of video-sharing platform services that use recommender systems are required to use specific metrics capturing quality, safety and mental-health outcomes to evaluate their recommender systems. Stricter guardrails are also established to lower the risk of minors encountering harmful content or getting stuck in so-called ‘rabbit hole’ effects in which minors are exposed to prolonged chains of harmful content, including related to eating disorders, self-harm or suicide. Rules are set out to ensure that minors are provided with safe settings, including the disabling by default of the visibility of their profile to other users, of push notifications and geolocation, and provide minors with more control to manage these settings. To reduce risks of cyberbullying and grooming, contacts are limited with strangers and minors can easily block unwanted interactions. Additionally, requirements include prohibitions on spending maximisation, transparency and gambling techniques.

Online games must also implement safety by design obligations, prohibiting addictive designs that nudge children into continuing to play the game or returning to the game and requiring safe setting. Additionally, online games should implement safeguards to ensure that minors are not led to initiate contacts on other risky services.

Specifically, and in addition to these requirements, considering the risks posed by AI companions and general conversational chatbots and building on the DSA and the AI Act, such AI systems should fulfil additional obligations to ensure that AI companions and general conversational chatbots are safe for minors. In particular, providers of AI companions and general conversational chatbots are required to put in place strong child-safety protections, including designing systems so minors are not exposed to design features and systems behaviours that are likely to create emotional dependencies, and carrying out testing and post-market monitoring to identify and mitigate harms to minors’ safety, health, fundamental rights and well-being (except for systems provided by a micro or small enterprise) . Where such systems are deployed as a functionality of an online social networking services, of a video-sharing platform services, of an online game, the providers of those services should ensure that AI companions and general conversational chatbots are not automatically activated, that minors have the possibility to opt out of their used, where enabled, and are not encouraged to use them.

Additionally, software application stores are required to put in place an age rating system to establish the age-appropriateness of applications disseminated through their service. The providers of such services should ensure that minors are prevented from purchasing or downloading an app that is inappropriate for their age. In addition, where the provider becomes aware of applications which primarily consist of content that is subject to a minimum age under applicable Union law or national law in compliance with Union law, they shall prevent minors from downloading or purchasing such an application below that minimum age. A code of conduct would help create common methodologies and criteria for such age rating systems, building upon current industry practice. Codes of conduct are also foreseen in regard to online networking services, video-sharing platforms, online games, as well as AI companions and general conversational chatbots.

Under the proposed Regulation, requirements to ensure the agency of children online are also established. In line with Recommendation 2 from Chapter 4 of the Report of the Co-Chairs of the Special Panel, the proposed Regulation also strengthens reporting mechanisms. Such tools must be effective, accessible and child friendly enabling minors to get rapid support and appropriate help upon notifying. Parents are also supported through the easy-to-use, interoperable and age-appropriate parental control tools, thereby implementing Recommendation 7 of Chapter 4. Such tools for example will be mandatory for providers of AI companions and general conversations chatbots, software application stores and online games for children below the age of 13 years. In other words, those providers will be required to ensure that access to their services and systems referred below the age of 13 years is only enabled and controlled by means of the tools for guardians. Rules are established to ensure such tools enable parents to report content on behalf of their child and to manage their account settings as well as time-spent limits. To ensure these tools are effective, the proposed Regulation sets out a requirement for providers to encourage their uptake by parents. Those tools, as well as time limits, must respect children’s evolving capacities and the right to privacy. They are complementary to other safety by design requirements, they should not replace any other measures to ensure the safety of children.

3.2.4 Establish clear requirements and criteria for the use of age assurance systems to underpin the access delay and the implementation of safety by design measures

The implementation of access delays and of safety by design rules requires robust and effective age assurance systems. In line with Recommendation 2 of Chapter 3 of the Report of the Co-Chairs of the Special Panel, the proposed Regulation establishes clear criteria and safeguards for the use and deployment of such systems, ensuring proportionality, data protection and non-discrimination.

The proposed Regulation requires age verification and age assurance for three reasons. First, the access delay requires age verification before account creation for certain social networking and video-sharing services. In this case, providers should exclusively on an EU Age Verification Solution using and EU proof of age attestation, in accordance with the EU Age Verification Scheme. Second, the safety by design obligations may require age assurance to enable settings and features reserved for adults. For instance, a platform may prompt adult users to prove that they are not a minor activate recommender systems drawing primarily on engagement-based signals, to get access to information that may pose a risk to minors when encountered repeatedly or to appear in the contact suggestions of other users. For the purpose of fulfilling the relevant safety by design obligations, providers may use alternative age assurance methods, such as age estimation, provided that they meet the requirements set out in the proposed Regulation. Providers of software application stores should use age assurance to prevent minors from accessing or purchasing age inappropriate or age restricted applications. Third, where an operating system has obtained an age signal in compliance with those requirements, it should, with the user’s consent, enable the sharing of that signal with providers where required for compliance with the Regulation.

To remain proportionate, existing accounts can be exempted from the obligation to verify or assess the age, where the provider can determine with a high degree of confidence the account belongs to an adult or that the user is not a minor, as applicable. This avoids subjecting the entire adult population to unnecessary age checks. To further limit potential exclusion, providers must offer effective internal complaint-handling mechanisms that allow users to appeal incorrect age assessment.

To facilitate the implementation of privacy-preserving age verification solutions , Members States must ensure the availability of means for citizens to obtain a proof of age attestation and of at least an Age Verification Solution for the age thresholds set in the Regulation. Detailed technical, organisational, privacy and security requirements will be specified in limited secondary legislation.

Where parents create accounts for their minors or want to use tools for guardians, providers have to verify the parental responsibility of the respective adult over the child concerned. For providers to be able to carry out this verification, and for the parents concerned to be able to share this necessary proof, Member States must establish at least one privacy-preserving electronic means by which a guardian can obtain and present an attestation of parental responsibility in respect of a minor. When doing so, Member States should ensure that such means are based on authentic sources established under national law, are free of charge for the guardian, and do not entail making information on parental responsibility accessible to providers or to the public beyond confirmation that parental responsibility exists. When providers already possess a signal that an adult is a guardian of a minor, the providers can rely on that as well. Additionally, adults should be able to self-declare that they are the parent and that they exercise parental responsibility. In those cases, providers should make reasonable efforts to verify that the adult is the guardian of the minor concerned. This verification should be carried out in a privacy-preserving manner and should not lead to additional processing of personal data that could enable the identification or tracking of the adult or minor concerned. The Commission may adopt a delegated act in order to specify the proof and signals that might indicate the parental responsibility.

3.2.5 Consolidate a coherent and robust enforcement framework to ensure timely and efficient implementation

To ensure efficient enforcement in line with Recommendation 5, no new enforcement structure is created to avoid conflicting and inconsistent enforcement. Rather, the enforcement of the proposed Regulation will benefit from the existing DSA and AI Act enforcement structures and procedures. The Commission remains responsible for the enforcement against VLOPs while Member States’ Digital Services Coordinators are responsible for online platforms established on their territory. In relation to AI systems, the enforcement will rely on the AI Act framework and will be supervised by the AI Office within the Commission for AI companions [and general conversational chatbots] built on general-purpose AI models provided by the same provider or integrated into VLOPs or VLOSE in accordance with Article 75(1) AI Act. Member States’ national market surveillance authorities designated under the AI Act will be responsible for other AI companions and chatbots. Non-platform online games will be supervised by the national authorities.

The proposed Regulation further establishes a new fast-track pathway for enforcement carried out by the Commission whereby a final decision can in principle be imposed in 90 days. Providers covered by the Regulation that have been designated as VLOPs are also required to submit a compliance plan to facilitate enforcement. The compliance plan must be audited by one or more independent auditors having proven expertise in the protection of minors online.. Finally, a coordination mechanism between the Commission and competent authorities is also established to cooperate on the assessment of incidents affecting the protection of minors across the Union and to rely on each other’s expertise and resources.

3.2.6 Encourage and provide guidance to Member States on developing national measures and policies to support and complement the proposed Regulation.

As recognised by the Report of the Co-Chairs of the Special Panel, Regulation at Union level should be complemented and supported by action at national level, including through the proper prioritisation and allocation of resources to the protection of minors online (²⁵⁹).

The proposed Regulation thus imposes on Member States the obligation to support the objectives of the proposed Regulation with the establishment and implementation of national strategies to ensure that information and assistance in relation to the risks and harms addressed by the proposed Regulation are available and accessible to minors and their guardians. The proposed Regulation therefore imposes on Member States the obligation to develop and communicate strategies to fulfil the requirements of the proposed Regulation, and provides that Union funding should be made available to implement such strategies and the Commission should facilitate the exchange of best practices in particular related to digital literacy.

3.2.7 Recommendations of the Report of the Co-Chairs of the Special Panel

Chapter 3 of the Report of the Co-Chairs of the Special Panel analysed the existing legal framework and provided different recommendations to strengthen it and ensure a high level of protection for minors online. The following table provides an overview of how the different recommendations of the Report of the Co-Chairs of the Special Panel have been implemented in the proposed Regulation:

Chapter 4 of the Report of the Co-Chairs of the Special Panel further set out important recommendations to ensure the respect of children’s rights and their autonomy. The following have been implemented in the proposed Regulation:

3.3 A comprehensive regulatory framework for the protection of minors online

The proposed Regulation builds on the existing legislative framework for the protection of minors online and complements upcoming initiatives. By specifying and supplementing the DSA and the AI Act, it provides continuity and coherence to the EU regulatory framework for digital services and AI systems while developing an adapted legislative framework with specific requirements for the protection for minors online.

Upcoming initiatives will further reinforce the framework for the protection of minors online in the European Union. The ongoing evaluation and upcoming review of the AVMSD will specifically look at the protection of minors as viewers and will ensure that they are sufficiently protected when watching audiovisual content. Considering new threats and risks, it will examine whether further specification of the concept of harmful audiovisual content is needed, and what measures are necessary to ensure that minors do not encounter such content.

The Digital Fairness Act (DFA) further aims at strengthening the protection of minors online as consumers. Consumer law plays an important role in providing a safety net covering all types of traders interacting with children. It will continue to acknowledge minors as vulnerable consumers and protect them, in full complementarity with sector specific legislation, such as the proposed Regulation, from unfair and aggressive commercial practices.

Additionally, the proposal for a Regulation to prevent and combat child sexual abuse, once adopted, together with the recently adopted Recast of the Child Sexual abuse Directive, will strengthen the EU framework against child sexual abuse and exploitation, both online and offline. They will improve prevention, investigation and support for victims. As announced in the ProtectEU Strategy, the European Commission will an action plan on the protection of children against crime, which aims to complement existing instruments and fill gaps, notably strengthening coordination on the protection of children from crime both as victims and perpetrators, both online and offline.

Chapter 3 of the Report of the Co-Chairs of the Special Panel provided for some recommendations in relation to the overall regulatory framework. The table below explains how those recommendations will be implemented:

Non-legislative actions also complement this framework. The BIK+ Strategy supports the implementation of the EU’s legislative instruments through awareness raising campaigns, capacity building, and direct engagement with children, parents and educators. The network of Safer Internet Centres (SICs), co-funded by the EU, reached more than 46 million Europeans in 2025. The SICs include an awareness centre, a helpline for children on online risks, and a hotline for anonymously reporting suspected child sexual abuse material. The BIK+ platform further offers a comprehensive collection of educational resources designed to support children’s digital literacy, as well as parents, caregivers and educators.

Finally, child safety online is a global challenge requiring international cooperation. The proposal is consistent with the Union’s external policies, including the International Digital Strategy (2025) through which the EU expands and deepens its cooperation bilaterally, regionally and multilaterally (²⁶⁰). The proposal harmonises legislation EU-wide which will support the effectiveness of the EU’s external cooperation and global influence in child safety online.

4 impacts: a safer online environment for children

The impacts of the proposed Regulation have been evaluated, focusing on public health, fundamental rights and economic impacts. The evaluation builds on existing evidence, inter alia gathered in the context of the meetings of the Special Panel and the Report of the Co-Chairs of the Special Panel, the consultation process on the DSA guidelines on the protection of minors, the impact assessment of the DFA and of the AVMSD review. This was complemented by an additional study on the fundamental rights and economic impact of age assurance, as well as reference to several sources of evidence available, including relevant information shared by national authorities in the context of the European Board of Digital Services, or international partners such as the UK’s Ofcom and Australia’s eSafety Commissioner in the context of exchanges under existing agreements with these authorities.

To further complement the existing evidence, an additional study (‘the external study’) was procured by the Commission for the purpose of this Staff Working Document. The results of the study are expected to be published in Q4 2026. The study examined the impact of age assurance on the fundamental rights of children as well as adults and looked at the economic impacts of implementing age assurance solutions from the perspective of the services and systems in scope.

4.1 Public health

Overall assessment

The proposed Regulation is expected to improve minors’ health and well-being through three main pathways. It would delay access for under-15s to a limited set of higher risk services, restrict design features and recommender practices associated with harmful or compulsive use, and require age assurance and other safeguards to support age-appropriate protections in practice. It is a targeted measure, as it applies only to selected services, systems and features that present risks to minors, while broader safety by design obligations are intended to make services and systems in scope accessible to minors safer by default. Benefits are expected to be greatest for groups that are more exposed or more vulnerable to online harms, including younger adolescents, girls, minors with pre-existing mental health difficulties, and more marginalised groups. The scale of the effects will depend on effective implementation, including robust age assurance, provider compliance with design obligation, and timely enforcement.

4.1.1 Direct health impacts

Evidence indicates that minors 'online experiences are associated with adverse mental health outcomes, in particular depression and anxiety, and that these effects can be stronger for minors who already face vulnerabilities. Given this evidence, the proposed Regulation is expected to have positive direct health effects by reducing exposure to harmful online conditions and by requiring providers to build in stronger protection for minors from the outset.

As outlined in Section 2.1, evidence points to a clear association between minors’ online interactions and adverse mental health outcomes, particularly depression and anxiety, and online experiences may also reinforce difficulties that are already present (²⁶¹,²⁶²,²⁶³,²⁶⁴,²⁶⁵). Accordingly, the proposed Regulation focuses on reducing risk to minors’ privacy, safety and security through safety by design obligations applicable to social networking services, video-sharing platform services, online games, AI companions or general conversational chatbots. Specifically, the proposed Regulation requires providers subject to the minimum age to put in place age verification methods to ensure that children cannot create accounts on their services and systems, and requires services and systems in scope to put in place safety by design measures to ensure a high level of protection for minors.

A first important element affecting the health of minors online concerns the timing of access to certain services and systems. Longitudinal evidence associates earlier access to smartphones and, with it, digital services, with a higher likelihood of mental health difficulties and insufficient sleep one year later, whereas access delayed until age 13 was not similarly associated with later depression (²⁶⁶). While this can be interpreted as an association rather than definitive proof of a causal age-specific effect, it does point to a meaningful role for the timing of access. In response, the proposed Regulation introduces a harmonised minimum age of 15 for holding an account on certain online social networks and video-sharing platforms. This is also intended as a precautionary measure to limit in particular exposure during early adolescence, when vulnerability to online harms appears to be elevated.

A second important element concerns compulsive or excessive use driven by the design of certain services or systems. Neurodevelopmental evidence indicates that adolescence, particularly between 13 and 15, is a period of heightened sensitivity to reward, peer feedback and external validation (²⁶⁷,²⁶⁸), while impulse control and self-regulation are still developing (²⁶⁹). For this reason, the proposed Regulation is expected to benefit public health by limiting design choices that can encourage compulsive or excessive use among minors. It requires providers not to design, organise or operate services in a manner that is intended, or can reasonably be foreseen, to encourage compulsive or excessive use by minors. It specifically targets safety settings as well as design features such as autoplay and uninterrupted content consumption without effective and regular stopping points, notification, and features that incentivize repeated or more frequent engagement. By restricting such features as well as requiring effective time-management tools, the proposed Regulation is expected to reduce prolonged use, support self-regulation and lower associated negative impacts.

A third important element concerns sleep, which is closely linked to minors’ cognitive development, emotional regulation and mental health. Evidence show that screen use and online platform use can reduce sleep duration and quality through the displacement of sleep time, psychological stimulation before sleep and the suppression of melatonin (²⁷⁰). Evening screen use and prolonged engagement with online services and systems are associated with delayed sleep onset, reduced sleep duration and lower sleep quality, including through greater psychological stimulation before bedtime and suppression of melatonin production (²⁷¹,²⁷²). Poor sleep, in turn, negatively affects minors’ attention, memory, emotional resilience, and daytime functioning, and is associated with impaired cognitive functioning and greater vulnerability to anxiety and depression (²⁷³). The proposed Regulation addresses these risks by requiring time-management tools and notification settings that may undermine minors’ ability to disengage, especially during core sleeping hours, thereby mitigating an important mechanism through which online use may harm mental health.

The combined effect of these measures is expected to improve minors’ mental health and well-being by delaying younger adolescents’ access to higher-risk services, reducing exposure to addictive or excessive-use design features, and mitigating sleep-related harms through safer service design.

As for AI chatbots and AI companions, the safeguards foreseen in the proposed Regulation are expected to help protect minors’ health, and in particular mental health, by making AI systems and their use safer, less manipulative, and less likely to encourage harmful use or excessive attachment. Safety by design requirements and safeguards on disabling by default the persistent conversational memory of interactions with minors should help preventing such AI systems from accumulating sensitive data of minors and potentially reinforce harmful interaction patterns over time. t. Limits on attachment-developing features could help prevent unhealthy emotional attachments and reduce the risk of children treating chatbots as trusted human companions. The same measures against addictive design and tools for effective time control are also envisaged for AI companions and chatbots so similar positive impacts on the health and wellbeing of minors are expected. Requiring providers of AI companions to carry out state-of-the-art evaluations and testing before release and regularly afterwards will help protect minors’ health by early identification of health risks (e.g. testing can reveal whether a system encourages harmful behaviours, emotional dependency, or unsafe advice affecting physical or mental health), and safer system design from the outset. Testing at later stages and post-market monitoring is expected to contribute to ongoing protection as risks evolve or new risks or patterns of harm appear. This contributes to minors’ health by underlining a preventive and continuous safety approach: risks to physical, mental, and emotional health can be identified earlier, mitigated more effectively, and monitored over time as minors interact with the system in practice.

4.1.2 Indirect health impacts

Beyond its direct effects on mental health, the proposed Regulation is also expected to improve well-being indirectly by reducing the displacement of activities that are essential for healthy development. Excessive or compulsive use of social media and other online services and systems is associated with lower levels of physical activity, more sedentary behaviour, less time spent outdoors, reduced in-person social interaction and shorter or poorer-quality sleep, partly because time spent online can crowd out activities that support physical, social and emotional development (²⁷⁴,²⁷⁵,²⁷⁶). By prohibiting design features that encourage uninterrupted or repeated use, such as autoplay, endless content consumption and engagement-driven notifications, and by requiring effective time-management tools, including protections for core sleeping hours and school time, the proposed Regulation is expected to help minors free up time for offline activities that are important for physical health, social development and broader well-being.

A second indirect pathway concerns cognitive development and attentional functioning. Because the prefrontal and related systems for self-regulation, attention and executive control are still developing during childhood and adolescence, minors are especially vulnerable to environments that fragment attention and encourage constant switching between tasks, screens or applications (²⁷⁷,²⁷⁸,²⁷⁹,²⁸⁰). Research further shows that frequent smartphone or platform notifications can disrupt concentration and reduce task performance even when they are not actively opened or checked (²⁸¹,²⁸²,²⁸³). The proposed Regulation thus seeks to mitigate these risks focusing on minors as a particularly vulnerable cohort, by restricting design features that incentivize compulsive switching or prolonged engagement (²⁸⁴), and by requiring recommender systems not to exploit minors’ vulnerability or attention. Specifically, recommender systems must not give primary weight to explicit engagement-based preferences when suggesting information, and minors must be given simple tools to control, modify or reset recommendations. The safety by design measures in the proposed Regulation are expected to reduce cognitive overload and support better focus, which is closely linked to learning, emotional regulation, and healthy development more broadly.

At the same time, the proposed Regulation seeks to preserve beneficial online experiences while reducing the extent to which digital services systematically displace healthier offline activities. Its approach is to make providers responsible for designing services and systems that do not take advantage of minors’ developmental vulnerabilities, rather than placing the full burden on minors or parents to manage harmful design on their own. In that sense, the expected indirect health benefits stem not only from reducing overuse, but also from creating digital environments in which healthy routines, attention management, and balanced online-offline habits are easier to maintain.

Overall, the proposed Regulation’s indirect health benefits are expected to arise from four main effects: reducing the displacement of minors’ physical activity, face-to-face interaction and sleep; and protecting minors’ attention and cognitive development from constant interruptions and fragmented use;

4.1.3 Distributional effects

The health impacts described above are expected to have stronger protective effects for groups facing disproportionate online risks and, therefore, help to narrow existing inequalities. First, adolescents aged 13 to 15 and girls appear to experience more pronounced and persistent effects on depression and anxiety, consistent with evidence that this may be a period of heightened developmental sensitivity (²⁸⁵,²⁸⁶). Minors with pre-existing mental health difficulties also require particular attention, as online experiences may reinforce existing vulnerabilities rather than only cause new harms (²⁸⁷,²⁸⁸,²⁸⁹).

Second, adolescents from disadvantaged socio-economic backgrounds are more likely to report harmful online experiences, including cyberbullying and problematic social media use (²⁹⁰,²⁹¹,²⁹²). Although some young people from disadvantaged backgrounds may have fewer opportunities to replace online time with activities such as sports, clubs, or safe outdoor leisure, the evidence suggests they are also more exposed to the harms the proposed Regulation addresses. A similar pattern can be observed among LGBTIQ+ adolescents and minorities or marginalised groups. Safe online spaces may offer valued sources of peer support and connection, sometimes perceived as safer than offline environments (²⁹³). At the same time, these groups face higher exposure to online hate and harassment (²⁹⁴,²⁹⁵,²⁹⁶,²⁹⁷). Exposure to online hate speech has itself been linked to negative health outcomes, including panic and stress reactions, difficulty concentrating, and depression (²⁹⁸). Reducing exposure to such conducts or content is therefore likely to bring higher benefits to those most frequently targeted, including minors targeted based on ethnic or religious background, sexual orientation or disabilities, who report higher exposure to online hate speech (²⁹⁹, ³⁰⁰).

This means that whilst in principle minors from these backgrounds or groups might face some additional difficulties in adapting to a new situation in cases where they are not allowed to have accounts on certain services or systems anymore, overall they are also more likely to benefit more from stronger protections on services and systems that they and their peers use. Broadly, the proposed Regulation is thus expected to have stronger protective effects for such groups facing disproportionate online risks. By reducing exposure to harmful content and harmful online experiences, while preserving access to support information and connection, it may help narrow existing inequalities in mental and emotional health.

4.1.4 Risks and unintended effects

The proposed Regulation is designed to strengthen minors’ online safety but its benefits are likely to emerge gradually and may be accompanied by unintended effects that should be acknowledged are mitigated.

First, the full positive impacts are likely to occur progressively rather than instantaneously. Experience from jurisdictions that have introduced broad age-based restrictions on social media is instructive in this respect. Australia introduced a nationwide minimum age of 16 for social media accounts in December 2025. Early evidence suggests that a substantial proportion of minors subject to the ban have nevertheless remained on social media, underlining the practical difficulty of enforcing age verification at scale particularly during the initial implementation phase (³⁰¹). Research on the Australian experience also notes that any meaningful shift in social norms likely takes time (³⁰²). Under the proposed Regulation for the EU, however, even where minors circumvent age-based access restrictions, the core child-protection obligations would continue to apply to services accessible to minors. Providers would remain required to ensure a high level or privacy, safety and security for minors, would be prohibited from encouraging them to reduce those protections, and would need to ensure that safeguards are not easily circumvented through the design or operation of the service or system.

A second risk is displacement towards services or systems that may fall outside the minimum-age rule. If access is restricted on certain services or systems, minors may migrate towards services or systems that are not covered by the minimum-age rule, potentially exposing them to environments with fewer safeguards. This risk is partly mitigated by the horizontal structure of the proposed Regulation, which extends safety by design obligations across online services and AI companion and general conversational chatbots that are accessible to minors. Those obligations apply irrespective of the size of the service and therefore help ensure that alternative services and systems also become safer by default.

Another issue that merits careful consideration is that some minors currently rely on online services and systems, including social media and chatbots, for support, information and connection. For some children and adolescents, online environments can provide access to mental-health information, peer communities, or crisis-related support that may feel more accessible than offline alternatives. Digital spaces may also create opportunities for self-expression, social connection and advice on where to seek help. At the same time, those same environments can expose minors to additional vulnerabilities. They may encourage the formation of new relationships in ways that increase exposure to harm, while certain online behaviours, such as curating an unrealistically idealised self-image, may intensify loneliness or social isolation (³⁰³,³⁰⁴).

It is therefore important to distinguish between two separate issues. The first concerns access to support. The proposed Regulation requires providers to make it easier for children and adolescents to obtain help and to find reliable information when they encounter harmful or illegal content online. This includes directing them towards support services and trusted organisations at national and Union level. It also requires, where reasonable, clear warning messages in situations where minors are likely to publish or encounter content or interactions that may put their privacy, safety or security at risk. In practical terms, this means that support pathways related to their online experience on services or systems that they can access should remain available through provider-based tools and channels required under the proposed Regulation. This approach is consistent with broader EU action on youth mental health, including the Commission’s Communication on a comprehensive approach to mental health (³⁰⁵) and the Better Internet for Kids strategy (³⁰⁶).

The second issue concerns participation in online social environments more generally. Evidence suggests that not all forms of online engagement affect minors in the same way. More active forms of use, such as posting, commenting or interacting with others, are often associated with greater well-being and stronger perceived social support, whereas more passive behaviours, such as browsing or scrolling without interaction, are more consistently linked to depressive symptoms, loneliness and stress (³⁰⁷,³⁰⁸).

Overall, the proposed Regulation seeks to reduce minors’ exposure to harmful or age-inappropriate online experiences while preserving the benefits that digital services can offer, including access to information, social connection and support. It combines age-based restrictions for certain types of services and systems with safety by design obligations for all services and systems in scope, including support tools, as well as the possibility for minors under the minimum age to access under certain conditions those services and systems that are safer and more appropriate for younger users. As children’s online practices and the digital ecosystem will continue to evolve, the long-term effectiveness of the rules will also depend on regular review, evaluation and adaptation, so that the framework remains both proportionate and responsive to emerging technologies and developments. For that reason, the framework includes delegated and implementing powers, annual provider evaluation duties, and a future review clause requiring the Commission to assess, among other things, the effectiveness of delayed access and the broader scope of the obligations as technology and children’s digital practices evolve.

4.1.5 Mitigations

The proposed Regulation addresses the risk identified above through a combination of delayed access for minors, harmonised safety by design requirements, and measures to monitor, test and evaluate the effectiveness of the measures. The mitigation logic of the proposed Regulation is cumulative. Delayed access seeks to prevent younger children from entering online environments considered higher risk before they are better able to cope with their design and interaction features. In parallel, safety by design obligations seek to reduce risks for minors who do access services, by requiring providers to make those services safer by default, less manipulative in design, and more responsive to children’s privacy, safety and security needs. Age assurance supports both objectives, while annual monitoring, testing and evaluation are intended to ensure that safeguards remain effective over time. Table 2A provides a concise overview of the principal risks directly targeted by the proposed Regulation and the main mitigating provisions. Table 2B then identifies key limitations that could reduce the effectiveness of the proposed Regulation in practice and explains how the draft Regulation seeks to address them, while acknowledging residual constraints.

Table 2A: Risks the proposed Regulation directly addresses

Table 2B: Potential Limitation to the Proposed Regulation’s Effectiveness and Corresponding Mitigation Measures

The proposed Regulation includes delegated and implementing powers, annual provider evaluation duties, and a future review clause requiring the Commission to assess, among other things, the effectiveness of delayed access and the broader scope of the obligations as technology and children’s digital practices evolve.

Overall, the proposed Regulation combines prevention, safer service design and accountability in a structured and proportionate manner. Table 2A and 2B show, first, the direct linkage between the main risks and the corresponding protective measures and, second, the principal implementation challenges and the mechanisms to mitigate them. Together, they demonstrate how the framework is intended to reduce current harms but also to remain adaptable as risks and technologies develop.

4.2 Fundamental Rights

Article 3(3) of the TEU establishes the objective for the Union to promote the protection of the rights of the child. This fundamental right is among the values on which the Union is founded pursuant Article 2 TEU. One of the core objectives of the proposed Regulation is to ensure a high level of protection for children online, the respect, protection and fulfilment of children’s rights are therefore central to the proposed Regulation. As the online environment is marked by the complexity of interests at stake and the need to maintain a fair balance in mitigating risks for children’s rights as well as for the fundamental rights of all users, additional fundamental rights considerations have been duly taken into account. The impact of the proposed Regulation on fundamental rights besides the impact on children’s rights is considered with a focus on the impact of age assurance requirements, as these measures would be potentially affecting all users, whereas the minimum age and safety by design requirements will directly and primarily affect minors. In line with this approach, the impact on the fundamental rights that are broadly considered by experts and civil society (³⁰⁹,³¹⁰,³¹¹,³¹²,³¹³) to be most at risk of being affected for users subject to age assurance have been considered in more detail.

4.2.1 Rights of the child (Art 24 of the Charter of Fundamental Rights)

Overall, the proposed Regulation aims at improving the respect of the rights of the child online (³¹⁴). In line with their best interest, the access delay aims at ensuring a better protection of the health and security of minors’ online (³¹⁵,³¹⁶). The minimum age does not curtail their access to the digital environment as a whole but rather set a delayed start date for their autonomous access to a set of digital services that are deemed to be risky or harmful to the privacy, safety and wellbeing of younger minors. The delay particularly takes into account the evolving capacities of children, and as explained in the Report of the Co-Chairs of the Special Panel, it considers the importance for children under 15 to gradually transition to autonomous use, whilst also ensuring that such autonomous use above 15 years old remains safe by design. Indeed, the proposed Regulation sets out that in cases where a service is specifically designed for children and provides limited functionalities and all the appropriate safeguards to pose no risks for children under the minimum age, such services may be accessible under parental supervision. Additionally, exceptions to the delay are provided to ensure that the set of services covered by the minimum age does not cover those where children may need access to information, education materials, public services or other activities that are in their best interest.

Access restrictions for minors could indeed be considered as an interference with other rights of the child, notably the right to freedom of expression, participation and access to information, and they must therefore pursue a legitimate aim and be proportionate for such objective. As recognises by several judicial instances, limitations to freedom of expression and other rights should thus be justified in the best interest of the child. This should serve as principle to balance the different rights of the child in view of the recognised and documented risks to the safety, wellbeing, free development and self-determination of minors stemming from the use of types of services and systems that present certain features – i.e., notably the online environments created by “social media+”, which according to the Report of the Co-Chairs of the Special Panel “expose them to diverse risks for their physical and mental health and development at different ages” (³¹⁷).

The Report of the Co-Chairs of the Special Panel explains how the different phases in the years from 0 to 15 are particularly important for minors’ cognitive, emotional and social development, as well as for the evolution of their personality, identity and value systems. Risks evolve with the development of the child. From risks as passive online users in early ages, when much needed care risks to become neglected if substituted by screentime, thus affecting children’s attention span, language acquisition, and socio-emotional development; through risks of mismatch between continuous exposure to external stimulation and children’s evolving capacities and emerging self-perception in the years leading to adolescence; to risks of convergence of developmental sensitivities and platform-driven amplification of content and interactions in early adolescence. Research shows mental health impacts and that children are especially vulnerable under the age of 13, and until 15 adolescents transition into autonomy, so whilst supervision by caregivers and educators gradually becomes ineffective, risks are increasingly shaped by social elements of digital services, rather than individual behaviours, thus adolescents from 13 to 15 are at the peak of vulnerability to mental health issues. It is thus important to ensure that children’s rights to safety as well as healthy development and self-determination are enjoyed in conjunction with other rights – notably to information, expression or participation, free from the substantial impacts that certain online services can have on them.

Furthermore, as also enshrined in Article 24(3) of the Charter and recognised in the Report of the Co-Chairs of the Special Panel, it is important to take into account the role of guardians in supporting the minor's transition to autonomous and safe use of digital services. Until the age of 15, adolescents gradually transition from supervised development to guided online use and evolving autonomy. They increasingly encounter opportunities presented by the online world to connect, learn and develop and share their interests with others, thus whilst they may not benefit from being fully limited in their exposure, they can still enjoy safeguards and be protected from potential harm during these stages of developmental vulnerability, characterised by the convergence of identity formation, heightened socio-emotional sensitivity and decreasing effectiveness and importance of supervision by caregivers and educators. The proposed Regulation thus set out that guardians should be able to support children with the creation of child-friendly accounts, subject to safeguards ensuring effective parental supervision on the service, including the ability to adapt account settings progressively to the minor's evolving capacities, limit the duration of access and suspend the account if necessary.

The delayed start date in the proposed Regulation is therefore proportionate to the risks posed by the types of services and systems in scope, which by design present characteristics, features and functionalities that expose minors to risks related to inappropriate content, contacts, conducts and commercial practices. However, besides the services and systems subject to the general exception mentioned above, there exist the risks that some services may fall in scope of the age restriction without an established and demonstrated risk to the safety of minors, for instance designed and operated specifically and in the best interest of minors. This risk may be considered in view of a precautionary principle, which as explained in the Report of the Co-Chairs of the Special Panel also means that “age restrictions may be a necessary precautionary step until social media+ spaces are shown to be safe […] or until safe alternatives emerge” and represent “immediate measures to achieve the long-term goal of ensuring social media+ spaces are safe” (³¹⁸). The proposed Regulation thus foresees that children can access under parental supervision services that can be deemed to be designed and operated in the best interest of children. This provides the margin for guardians to take into account the specific circumstances of the child, including maturity, personal situation and socioeconomic context in connection to the type and nature of the service and system, and therefore mitigate the risk of an excessive and disproportionate age restriction, in the best interest of the child, including by adapting the settings and safeguards of the services to the age and needs of the minor.

Safety by design requirements are also key to ensure the rights of the child online (³¹⁹), including for those minors above the minimum age that increasingly experience the online environment in autonomy. Providing a safer environment for minors aim at ensuring that everyone can participate and enjoy the opportunities of the digital world without risk of being exposed to risks for mental wellbeing, harmful content or behaviours and other forms of online abuse or commercial exploitation. Thus, safety by design requirements on safe settings provide protection from exposure of minors and their content or information to unwanted contacts, abusive behaviours by other users, or risks of developing compulsive or addictive behaviours or mental health conditions linked to exposure to harmful content. Obligations on recommender systems further aim at ensuring the quality, diversity and age appropriateness of information suggested to children (³²⁰,³²¹). This is critical to stimulate children’s right to developing and holding their own opinion (³²²). Furthermore, the proposed Regulation provides that effective, visible and child-friendly mechanisms for reporting and support should be available and accessible for minors to report content, accounts, groups, features and behaviour that may negatively affect their privacy, safety and security when using the service, as well as to be informed and supported in understanding risks prior to engaging in certain activities such as posting or sharing content or enhancing the visibility of their information or that of other users.

To ensure the protection of minors online, robust and effective age assurance systems are recognised as necessary to recognise their presence online and limit their exposure to illegal or harmful products or services, as well as a being a precondition for an age-appropriate, safer and more empowering environment for children (³²³). With its clear requirements, the proposed Regulation will ensure that age assurance systems are effective, not easily circumventable, respectful of children’s privacy and implemented in line with their best interest. In recognition of the key role that parents play in the upbringing and development of their children, the proposed Regulation mandates tools for guardians, which should be available and apply as appropriate for all services and systems and all minors, in addition to supervised accounts for under 13, and accounts created by guardians for 13-15. Those tools must be provided in line with the evolving capacities of children, and in respect with their rights to privacy.

As for additional requirements for AI companions and general conversational chatbots, the proposed Regulation supports the child’s rights, including their dignity, mental well-being and best interests. The proposed Regulation requires providers to avoid design features and system behaviours that simulate interpersonal relations that are likely to create emotional dependencies. This can help protect children from becoming emotionally attached to a chatbot in ways that may affect their social development, autonomy or emotional balance. Safeguards on addictive designs, safe settings and safe and secure economic transactions are also set out. Performing state of the art evaluations and testing before and after the AI companions are placed on the market and post-market monitoring strengthen the practical protection of minors’ fundamental rights over time promoting a safer digital environment.

4.2.2 Private life and privacy of communication (Art 7 of the Charter) and personal data protection (Art 8 of the Charter)

The proposed Regulation should not prejudice the high standard of personal data protection and protection of privacy of communications and private life set in EU legislation. Furthermore, measures aimed at ensuring children’ online safety can be expected to enhance their privacy. Several safety by design measures aim at ensuring that their information remains private or only shared with a limited circle if the minor so decides.

The obligation to establish age assurance systems to support the implementation of the access delay and the safety by design measures imply the processing of personal data. Considering the need for a consistent approach and the existing obligations in terms of age assurance present in EU and national legislation (³²⁴), the European Data Protection Board (EDPB) provided specific guidance and high-level principles outlining key considerations for age assurance systems to be in line with data protection requirements (³²⁵).

The proposed Regulation establishes clear requirements for the deployment and use of age assurance systems in line with the principles outlined by the EDPB ensuring a high standard of data protection. These criteria include a high level of accuracy, reliability, robustness, security, non-discrimination and non-intrusiveness. Following a risk-based approach and ensuring proportionality, age verification is only mandated for the implementation of the access delay.

As noted in the external study, age verification – whether through the EU Age Verification Solution or through comparative solutions – can be implemented in ways that are privacy-preserving by design. In that context, the external study recommended that to mitigate rights interferences, the legislative instrument should require services to use age verification methods that utilise double-blind architecture, and which incorporate technological innovations like zero-knowledge proof cryptography. The proposed Regulation requires, where age verification is required, to rely on the EU Age Verification solutions, which will have to meet the highest standards in terms of privacy and data protection, using zero-knowledge proof cryptography.

Moreover, as noted in the external study, many privacy and data protection risks that arise in the context of age assurance relate to how age assurance is deployed by service providers and how age assurance systems are operated. This includes questions of what personal data is collected, how it is processed, which entities it is shared with, and how it is stored. The study further noted that these risks can be largely mitigated through adherence to the General Data Protection Regulation, and through clear application to age assurance providers of the GDPR’s provisions on data minimisation, purpose limitation, transparency, and data protection by design and default. The proposed Regulation ensures this, by laying down additional safeguards for age assurance providers and the providers of services relying on age assurance solutions, such as further specifying the application of principles of purpose limitation, data minimisation, and data protection by design and by default. Furthermore, it should also be underscored that service providers’ implementation of the proposed Regulation’s age assurance requirements are subject to the horizontal rules of the GDPR, and they must be undertaken in strict accordance with GDPR’s principles on data processing.

Separately, the external study characterised the age assurance market as a vibrant and mature one, where age assurance providers are increasing competing and innovating on privacy and accessibility grounds. The study recommended that any future legislative proposal capitalise on this reality, by allowing service providers in scope of an age assurance requirement to utilise third-party age assurance solutions that meet high standards of privacy and security. By enabling third-party age verification solutions to adopt the EU Age Verification blueprint and by allowing service providers to adopt a range of age assurance methods for the purposes of safety by design, the proposed Regulation leverages the competitive forces of the market in favour of privacy-preserving approaches.

Accounts created by parents for their children also further requires verifying that the adult is the guardian of the minor concerned. The proposed Regulation establishes that such verification must be done in a privacy-preserving manner, through the use of ‘zero knowledge proof’, and not lead to the additional processing of data that could enable the identification or tracking of the adult or minor concerned.

Ultimately, by enshrining safeguards in law, affirming the applicability of the GDPR, and setting a baseline standard for how third-party age assurance solutions should operate, the proposed Regulation provides for the effective use and deployment of age assurance systems while ensuring a high standard of data protection for their use. The proposed Regulation provides for clear legal standards, which will promote the deployment of an innovative market of age assurance solutions respectful of fundamental rights.

As for AI companions and general conversational chatbots, the requirement for providers to avoid features posing risk of emotional dependencies protects minors’ private life because systems that simulate human emotions or relationships can encourage children to disclose intimate thoughts, feelings, routines, fears, or family matters as if they were speaking to a trusted person or friend. Limiting such design features therefore helps safeguard minors against both undue emotional influence and against the extraction or exposure of intimate aspects of their private life.

4.2.3 Freedom of expression and information (Art 11 of the Charter)

The proposed Regulation does not provide for a prior authorisation scheme. Such measures can amount to a severe limitation to freedom of speech. Additionally, the proposed Regulation does not remove the right of an individual to remain anonymous online, which could have a chilling effect on freedom of expression. The obligations set out in the proposed Regulation in terms of age assurance are not an obligation of identity verification and clear safeguards are established to this effect in the proposed Regulation. Age assurance solutions shall only share an anonymised yes/no answer to the age question.

As noted in the external study, providing end users with a choice of age assurance methods and/or deployment models as well as fallback options (e.g. manual enrolment) can mitigate the chilling effects of the age assurance process on freedom of expression. It would respond directly to the situation where users opt-out of assuring their age owing to concerns about specific age assurance approaches (rather than the principle of age assurance itself) or because they lack the necessary pre-requisite technology/identity artifacts. The proposed Regulation accounts for this potential interference with freedom of expression, by enabling the use of third-party age verification solutions that conform to the high standards of privacy and security that are set by the EU Age Verification Solution, and in the case of the safety by design requirements, by allowing for a choice of different methods of assurance.

The study further noted that an interference with freedom of expression can arise where age assurance is disproportionate, involves considerable friction, or requires excessive re-assurance by end-users (e.g. verifying their age every time they visit the same website). In line with the recommendations of the external study, the proposed Regulation allows service providers to adopt a successive validation approach, whereby service providers need not subject an end user to an assurance process if it has good grounds to believe the end-user meets the age baseline for access to a service or risky features (e.g. owing to the age of the account). Moreover, the proposed Regulation’s focus on wallet-based solutions can capitalise on advancements in reusability and interoperability of age tokens, further reducing the friction and ‘assurance fatigue’ that of-age end users might be subjected to.

Finally, as noted in the external study, much of the problematic freedom of expression interferences are borne out of data protection and privacy concerns: individuals choose not to engage with age assurance systems, or alter their behaviour following an age check, because of concerns of identification, tracking, and potential data misuse. By ensuring the legislative instrument requires the use of the the EU Age Verification Solution to verify the age for the purpose of the access delay and comparative state-of-the-art privacy-preserving approaches (as noted in section 4.2.2) in the other instances, these concerns are directly addressed.

At the same time, the proposed Regulation strengthens children’s freedom to information. By ensuring that reporting systems are age appropriate and accessible to children, children are empowered to report, contributing overall to a safer online environment. Similarly, child-friendly support tools contribute to a healthier environment and point children to diverse sources and advice that can help them navigate the online environment safely.

As for AI companions and general conversational chatbots, the safeguards listed in the proposed Regulation support children’s right to seek and receive information, and to communicate and express themselves freely, including through AI companions and general conversational chatbots. The proposed Regulation does not aim to prevent minors from using such systems as tools for learning, accessing information, asking questions, or expressing thoughts and feelings. Rather, by establishing safeguards the proposed Regulation seeks to ensure that children can benefit from these technologies without being exposed to harmful content, manipulative interactions, or emotionally risky design. Furthermore, the requirement of the proposed Regulation to put safeguards on features of the system displaying behaviours or simulating emotions or interpersonal relationships, seeks, inter alia, to ensure child’s right to receive information and form independent opinion. If an AI companion influences a child in hidden or emotionally persuasive ways, this may interfere with the child’s ability to form independent views and decisions. Safeguards set by the proposed Regulation thus help prevent undue influence and preserve personal autonomy.

Overall, the proposed Regulation protects privacy‑related freedom of expression and reinforces children’s access to information.

4.2.4 Non-discrimination (Art 21 of the Charter)

Enhancing the protection of minors online will have a positive impact in mitigating risks for children in vulnerable situations and vulnerable groups to be exposed to discriminatory behaviours. Safety by design obligations, in particular related to recommender systems and how children can influence their functioning in their best interest, will address certain discrimination concerns related to how certain online platforms amplify information and how the visibility of more extreme content or behaviours, including negatively affecting minorities or marginalised communities, can be maximised. These obligations will further empower children to better understand and have increased agency over those systems.

As noted in the external study, age verification solutions typically require the end-user to present a qualifying hard identifier – normally a passport or a national ID card – to enrol in the system and secure a digital proof of age attestation. In theory, this requirement could unfairly exclude individuals who lack qualifying hard identifiers or who lack the prerequisite technology to perform remote enrolment (i.e. a smartphone with an in-built NFC chip).

Member States can address this risk by provisioning national-level ‘manual’ enrolment mechanisms for those unable to enrol through the ‘digital-first’ approach. Most Member States already offer the possibility of enrolling in their national digital identity schemes via an in-person visit to a local municipal office or registry service, where the process can be completed ‘manually’. This ‘manual’ enrolment fall-back option should be offered by deployers of the EU Age Verification Solution and comparative age verification solutions.

With respect to age-appropriate design, it is likely that some services will choose to deploy facial age estimation (FAE) as a means of assuring the age of users. FAE systems can pose risks of algorithmic bias. They are also typically less effective at estimating the age of individuals within the 13-17 age range as they are for the 18-25 age range, and there is a risk that some of-age users who fall within the system’s ‘buffer zone’ will fail the age check. However, as noted in the external study, recent independent evaluations of facial age estimation have demonstrated continuing improvement in the accuracy and inclusivity of this method. And where age assurance is deployed in the market today, it is typical for service and systems providers to deploy successive validation or orchestration approaches to reduce concentration and exclusion risks that can arise from reliance on one method of assurance.

Finally, the proposed Regulation sets a high baseline for how age assurance deployments should ensure accuracy, reliability, and non-discrimination, among other outcomes. As noted in the external report, certain methods of age assurance, notably competence-based assessments, can be discriminatory against end-users who do not meet the assumed competency level that the age assurance deployer associates with their age group, for example, owing to a neurodivergence, age-related cognitive decline, or a medical condition impacting cognitive function. By setting a high standard for age assurance solutions, and by therefore foreclosing services from deploying problematic methods of age assurance to achieve compliance with the proposed Regulation’s requirement, greater protection for the right to non-discrimination is ensured. To further limit potential exclusion, providers must offer effective and free of charge internal complaint-handling mechanisms that allow users to appeal incorrect age assessment.

4.2.5 Proportionality (Art 52 of the Charter)

As enshrined in Article 52 of the Charter, the principle of proportionality is crucial to ensure that any EU regulation strikes a fair balance between pursued policy objective of protecting children online and all the fundamental rights enshrined in the Charter affected by the measures to achieve it. The principle of proportionality is assessed through the tripartite test of whether the measures envisaged are suitable to effectively achieve the legitimate policy objective goal, whether the measures are necessary, i.e. the least restrictive of other rights that are available to attain such policy goal, and whether different interests and rights have been balanced adequately in the choice of the measures in question.

The protection of minors online is a key policy objective of the Union. As explained in this section 4.2 and in section 2, as well as in view of initiatives of Member States and the Report of the Co-Chairs of the Special Panel, the proposed age restrictions, safety by design requirements and requirements related to age assurance for their implementation would represent necessary and suitable measures to ensure the protection of children’s rights in the digital environment, which is currently insufficient and rapidly emerging as an urgent public health and safety risk for children to be addressed, as well as proportionate in view of the limited restrictions to some of the fundamental rights impacted by the measures, including those of children as explained in section 4.2.1. As outlined in this section, the risks of disproportionate restriction to children’s rights in the Union are mitigated in the proposed Regulation by the gradual approach to imposing age restrictions to minors, enshrined in the possibility of minors to access accounts on safe services with the support, supervision and consent of their guardians, thus leading to autonomous use of safe services in line with their evolving capacities, as well as by the combination of such age restrictions supported by age assurance with safety by design measures protecting the privacy, safety and security of children. Similarly, possible risks of disproportionate impacts of age assurance measures on fundamental rights of all citizens in the Union are mitigated by the establishment of strict requirements for the implementation and operation of such age assurance methods, which must abide to the highest standards of accuracy, reliability, security, robustness, non-intrusiveness, privacy, and non-discrimination.

4.3 Economic Impacts

4.3.1 Overall Assessment

The proposed Regulation is expected to have an overall limited to moderate economic impact. The safety by design requirements largely codify existing Article 28 DSA obligations for online platforms and should therefore lead only to incremental costs for providers already broadly aligned with the DSA guidelines on protection of minors. The proposed Regulation creates an unambiguous compliance framework, which increases legal certainty, reduces fragmentation and enables more efficient enforcement. Without the proposed Regulation, providers would likely face up to 27 different sets of age restrictions and safety by design rules (see section 2.1). The rules would likely not just differ widely in terms of scopes and ages, but also include different parental control derogations, different technical requirements for age assurance, interface design, and monitoring as well as multiple enforcement structures. Such fragmentation would be extraordinarily burdensome, especially for the smallest providers with limited resources to familiarize themselves with a multitude of a different requirements and to implement them separately for each Member State. This would severely complicate the cross-border operation that is a defining feature of the digital economy (³²⁶,³²⁷).

While much of the proposed Regulation builds on the guidelines on protection of minors, it also includes targeted additions that address residual protection gaps identified by the Report of the Co-Chairs of the Special Panel. The main additional costs are likely to arise from age assurance measures – for compliance with the minimum age rules and ensure safe designs and settings for minors – as well as safety by design adjustments, and the extension of certain obligations to AI companions and general conversational chatbots, online games and small and micro enterprises. It is difficult to precisely determine the costs of these adjustments, especially for the potentially large number of small and micro providers of online services and online games that were previously not subject to Article 28 DSA. However, many of the costs are one-off design expenses for making services and systems safe for children. Recurrent costs are likely much more limited and primarily linked to maintenance and potentially marginal costs for age-assuring new accounts via third-party tools. Furthermore, those costs are mitigated by the development of the EU Age Verification Solution, the expected increased development of the market for safe design solutions, the fact that similar requirements already exist in EU law and increasingly in third countries and the avoided fragmentation of the internal market. This harmonisation, greater legal certainty, and public health benefits are expected to offset part of these costs over time.

4.3.2 Direct Compliance Costs for Providers

4.3.2.1 Providers Already Broadly Aligned with the Guidelines on the Protection of Minors

The proposed Regulation should be understood as a natural evolution of the guidelines on the protection of minors online following the recommendations of the Special Panel, rather than as a fundamentally new compliance paradigm. For services covered by the DSA, which are a substantial share of those in scope, the proposed Regulation is specifying Art. 28 of the DSA and relying on the enforcement structure of the DSA. Its core obligations follow the same protective measures that providers were already expected to implement under Article 28 DSA.. By turning these expectations into binding rules, the proposed Regulation is expected to increase legal certainty, reduce fragmentation, and support more consistent enforcement across the Union, without codifying every detail of the guidelines on the protection of minors.

This continuity runs throughout the proposed Regulation. For example, the guidelines already state very clearly that minors should not be exposed to design features that may lead to overuse or compulsive behavioural habits (§ 61(b)) (³²⁸). They spell out examples of such features in great detail (§ 61(b) and 57(b)) and call for concrete measures to be implemented, such as providing high safety settings by default, avoiding certain interface designs or offering effective time management tools (§ 61(c)), as well as easy to use, access and interoperable tools for guardians (§81 and 82) (³²⁹). The proposed Regulation’s article on addictive design codifies these expectations into clear and binding rules. Similarly, § 64–67 of the guidelines lay out the same expectations on the design of recommender systems that are encoded in the proposed Regulation’s article on recommender systems. In addition, §18 of the guidelines sets out that online platforms should conduct a risk review. The proposed Regulation requires VLOPs to monitor, test and evaluate implemented measures as part of the risk assessments carried out under Article 34 of the DSA. Indeed, under Article 34 of the DSA, VLOPs are already required to identify, analyse and assess systemic risks to the rights of the child, the protection of public health and minors as well as physical and mental wellbeing (³³⁰).It should also be noted that VLOPs are already required to undergo annual audits at their expense under Article 37 of the DSA. Table 2 illustrates that the proposed Regulation’s safety by design obligations appear to a great extent already in the guidelines on the protection of minors, with quite targeted additions.

These overlaps suggest that, for diligent providers already substantially aligned with the guidelines, the proposed Regulation largely formalises practices that should already be in place. The most notable additions, the harmonised minimum age of 15 for certain services, clearer requirements for age assurance and guardian control tools are discussed below and remain largely within the logic of the guidelines and are consistent with broader global trends towards stronger child protection standards.

The proposed Regulation should therefore generate only limited, incremental burdens for providers that are already substantially aligned with the guidelines. In most cases, they are likely to stem less from entirely new operational obligations than from the need to translate existing practices into a clearer, enforceable compliance framework and to make any targeted adjustments required by specific new elements of the proposed Regulation. Additional short-term adjustments should be weighed against the longer-term cost savings associated with a clearer and more harmonised Union-wide framework avoiding fragmented national approaches.

In short, the proposed Regulation builds on – not replaces – the guidelines on the protection of minors. It retains their protective and proportionate logic while making it more predictable and enforceable. For businesses already compliant with the guidelines, the transition should be relatively smooth, with limited additional costs and the benefit of greater legal certainty across the internal market.

Table 2 Continuity with safety by design obligations in 2025 guidelines on the protection of minors and DSA Articles

4.3.2.2 Age Assurance Requirements

Scope of the obligation and cost-mitigation features

Age assurance is likely to represent the most significant incremental compliance cost for some providers. As explained in section 3.2.4, the proposed Regulation may require age assurance measures for a range of reasons. In principle, this could lead a large number of services to require age assurance measures. It is difficult to accurately predict which online services and systems will prefer to implement age assurance measures rather than applying safe features and settings to all new, recently created and logged-out users, partly because it is difficult to predict demand for adult features and settings.

In any case, several mitigation measures are in place. First, the strict age verification methods are only required for social networking services and video-sharing services and AI companions, while the safety by design obligations and the obligation for providers of software application stores allow alternative age assurance methods. As noted in the external study, age verification systems – notwithstanding the availability of the EU Age Verification Solution – are typically more expensive to operate than alternative age estimation systems. As such, targeting of the strict age verification requirements and the obligation to rely on an EU Age Verification solution to a small subset of services for the purpose of the access delay, while enabling a broader range of assurance methods for the safety by design obligations, will ensure compliance costs are proportionate to the level of risk involved (³³¹).

Second, existing accounts can be exempted where the provider can determine with a high level of confidence or based on the year of account creation that the account belongs to an adult. The external study found a strong preference for ‘successive validation’ techniques within the age assurance ecosystem. ‘Successive validation’ is an age assurance deployment approach under which end-users seeking to access a restricted service are subjected to the lightest touch, lowest-friction age assurance method first, and the system falls back to higher-friction, more invasive methods (e.g. age verification) only if the user fails to pass the prior age challenge. By enabling a form of successive validation, the proposed Regulation will significantly reduce both the compliance cost for companies and the friction involved in the age assurance process (³³²).

Initial deployment costs

Initial deployment costs are expected to vary depending on whether a provider builds an in-house solution or relies on a third-party provider. As the external study explains, proprietary in-house systems are likely to involve significant start-up costs, including code development, testing, training data, secure cloud storage, and legal, compliance and product policy costs. For that reason, the choice to develop a proprietary in-house solution is likely to be exercised only by the largest service providers, if at all (³³³). In practice, smaller and most medium-sized services are more likely to procure external solutions, which generally involve relatively modest set-up costs compared with proprietary system development (³³⁴).

Available evidence suggests that the costs of age assurance are generally manageable for most providers. The Australian government has estimated 80 hours of staff time per social media service to implement age assurance measures, a cost of EUR 0.39 per check per user and a total cost of about EUR 33 million to assure the age of 21 million Australians with 4 social media accounts each (³³⁵,³³⁶). The impact assessment of the UK’s Online Safety ACT assumes 12h of developer time for backend Yoti integration and estimates a ten-year total cost between EUR 21 million and EUR 107 million to assure the age of 27 million users per year accessing pornography (³³⁷,³³⁸). It also notes that these costs are small compared to the costs of content moderation. In Ofcom’s 2026 implementation findings set-up costs were in many cases reported to be modest, often in the range of tens of thousands of pounds, although some providers reported higher costs (³³⁹). Third-party providers themselves assert short implementation times of “approximately half a day” (³⁴⁰) to one week (³⁴¹,³⁴²). While these exact claims are not interpedently verified, the external study notes that for most small and medium-sized services, integrating third-party solutions is reasonably expected to cost in the hundreds of euros or low thousands of euros, although the evidence base remains limited (³⁴³). Online services applying age assurance measures also need to offer a complaint-handling mechanisms that allow users to appeal incorrect age assessment. The set-up costs for this are expected to very limited for most services since notice and action mechanisms are already required for all online platforms under Article 16 DSA, including for small and micro enterprises.

More broadly, the external study found that third-party age assurance vendors are increasingly competing on ease of deployment considerations, with some providers marketing their services as having internal integration costs that can be completed within hours and days. Many service providers will likely also benefit from lower deployment costs that stem from the fact that website builder platforms like WordPress and Shopify – platforms which many in-scope services utilise for business operations – facilitate low-friction plug-ins to third-party age assurance providers. In addition, the external study found increasing market interest in and optimism about the potential of interoperability of age assurance deployments, and how they could reduce compliance costs for services in the medium term. Projects like euCONSENT’s AgeAware have created the technical and operational infrastructure through which age checks can be recognised across services and from which the costs of age checking can be shared. Interoperability innovations of this kind offer the further benefit of reducing the need for service providers to invest in multiple different age assurance deployments to satisfy the preferences of their user base (³⁴⁴).

Taken together, these factors should relieve providers of some of the initial deployment costs – as well as the opportunity cost in terms of developer resource – that arise from the age assurance requirement.

Ongoing operational and per-check costs

The external study distinguishes between ongoing operational costs and per-check costs. Operational costs include legal, compliance, information security, customer support and supplier due diligence costs. These costs are likely to be lower where providers rely on third-party age assurance solutions rather than proprietary in-house systems, because much of the ongoing maintenance, operational security and due diligence is handled by the vendor. The available evidence does not suggest that such operational costs have prevented effective deployment.

In addition to the numbers cited in the section on initial deployment costs , Ofcom’s 2026 implementation findings indicate that median per-check costs are low (around EUR 0.07) (³⁴⁵). They also suggest that per-check costs tend to decrease as the number of checks undertaken increases, with some large service providers understood to have faced per-checks costs of between EUR 0 and EUR 0.08 in other jurisdictions (³⁴⁶). Regarding operational costs, the Australian government has predicted that the required weekly staff time will fall from 10 hours to two hours after the first year, even for the very large providers subject to the Australian access delay. Overall, these findings suggest that age assurance is unlikely to constitute a prohibitive cost barrier for most providers, even if smaller services may face relatively greater implementation challenges. This supports the view that recurring operational costs, including per-check fees, system maintenance, compliance monitoring, and security safeguards, are likely to remain proportionate in most cases (³⁴⁷).

In the EU context, those costs may be further mitigated by the availability of the EU’s open-source age verification solution, which is intended to lower implementation barriers and reduce dependence on proprietary commercial systems. This may be particularly relevant for SMEs and smaller providers, for whom up-front investment and procurement costs can be more difficult to absorb. The privacy-preserving and secure nature of the EU Age Verification Solution should further significantly reduce the ongoing maintenance and compliance costs that service providers would face were they to operate proprietary age assurance system. The study indicates that, over time, the EU Age Verification Solution is likely to be the cheapest means for providers to deploy age verification, because its development has been publicly funded and its technical architecture has been made available in open-source form, so those initial development costs need not be recovered from relying service providers on a per-check basis (³⁴⁸).

Recent experience in the UK offers an insight into the potential cost reduction benefits of the EU Age Verification Solution. While take-up of digital-ID-based age assurance solutions has been low under the UK’s Online Safety Act (including in part, because there is no corresponding version of the open-source EU Age Verification Solution), the limited evaluation data from Ofcom suggests that digital ID-based solutions are among the cheapest available to service providers on a per-check basis (³⁴⁹). In this respect, the EU framework may offer cost-reduction opportunities that are not fully comparable to the UK context reflected in Ofcom’s evidence. The study therefore considers it reasonable to assume that providers relying on the EU solution are likely to face minimal ongoing per-check costs (³⁵⁰).

Longer-term market developments and broader compliance effects

It is important to note that the costs for age assurance should be seen against the clear expectation created by the guidelines on the protection of minors that providers take effective measures to prevent minors from accessing age-inappropriate services and experiences. Moreover, as noted in the external study, this proposed Regulation comes against a backdrop where age assurance – whether for corporate policy reasons or in response to existing regulatory requirements in the EU and third-countries – is becoming an increasing norm online for service providers (³⁵¹). Indeed, for those providers that have already moved towards more robust age assurance in response to those guidelines and in response to other commercial and regulatory imperatives, the additional cost of the present proposed Regulation is therefore expected to be more limited, and mainly related to adaptation of existing systems, and compliance documentation. The study also points to evidence from the UK that some providers incurred no additional set-up costs because they already had commercial relationships and operational integrations with age assurance vendors in place (³⁵²). This is particularly relevant for very large platforms, many of which already operate age-related controls and are developing capabilities linked to the European Age Verification framework as well as age assurance requirements in other jurisdictions. Platforms that are subject to the minimum age and have not yet implemented the EU Age Verification Solution will face some additional costs.

The external study suggests that several broader market developments are also likely to place downward pressure on costs over time. These include growing competition among third-party vendors, developments in interoperability that may allow age checks to be recognised across services and costs to be shared, and the emergence of standards that can reduce the vendor due diligence burden on service providers. The study further suggests that, as age assurance becomes a more established global norm, providers operating across borders may increasingly benefit from economies of scale by amortising deployment and compliance costs across multiple jurisdictions. Rather than there being a settled ‘consensus’, the available evidence points to a reasonable expectation that age assurance costs are likely to decrease over time as the market matures and regulatory certainty stimulates further innovation and supply (³⁵³).

Last but not least, harmonised age assurance requirements at Union level are expected to reduce legal uncertainty and market fragmentation, thereby lowering long-term compliance burdens, especially for providers operating across multiple Member States. While the introduction or upgrading of age assurance systems may entail initial adjustment costs, a more consistent regulatory framework would reduce the need to adapt services to divergent national approaches and should therefore generate efficiency gains over time.

4.3.2.3 Extension to additional entities and additional obligations for specific types of services and systems

The extension of certain protection-of-minors obligations to small and micro enterprises, app stores, AI companions and general conversational chatbots and online games, as well as minimal obligations on operating systems is expected to generate additional compliance costs for providers that are currently exempt from Article 28 DSA. Those costs may be relatively more burdensome for smaller providers because they have less internal legal, compliance and engineering capacity and fewer possibilities to spread fixed costs across a large user base. At the same time, the overall impact should remain manageable, in particular because the obligations are targeted, subject to proportionality, and in several respects reflect measures that responsible providers should already be considering where their services and systems are likely to be accessed by minors.

Small and micro enterprises

Including small and micro enterprises is justified by the nature of the problem. Exposure of minors to harmful content, contacts or design practices is not confined to large services. Available evidence indicates that harmful material and unsafe interactions can also be prevalent on smaller services, including niche or fast-growing services (³⁵⁴). Moreover, in digital markets, turnover or headcount is not a reliable proxy for societal reach or risk exposure. A relatively small provider may still attract very large numbers of users, including minors, in a short period of time, or may offer functionalities that create particularly significant risks. Exempting smaller providers altogether would therefore risk undermining the effectiveness of the initiative, creating incentives for risky activity to migrate towards less regulated services and systems, and weakening the objective of ensuring a consistently high level of protection for minors across the internal market. For the same reasons, the UK’s Online Safety Act extend to small and micro enterprises as well (³⁵⁵). To ensure proportionality, very specific exemptions were provided on AI regarding the obligations for post-market monitoring may be particularly burdensome for small and micro enterprises.

For small and micro enterprises, the main cost drivers are likely to be age assurance, where relevant, as well as safety by design changes, such as the introduction of child-friendly reporting and support as well as default-setting mechanisms. In practice, however, many smaller providers are unlikely to develop bespoke systems. They are more likely to rely on third-party age assurance, moderation, parental consent or interface solutions, which limits the need for major in-house technical investment. Indeed, as noted in the external report, the market for third-party age assurance solutions is growing at pace, with providers increasingly competing on privacy, usability, and ease of deployment. So-called ‘plug-and-play’ solutions and ready-made integrations with website builder platforms like WordPress and Shopify are a market-driven response to the specific needs of small and micro-enterprises. This reality, allied with advancements in interoperability should insulate small and micro-enterprises from significant costs under this proposed Regulation. Small and micro-enterprises will further benefit from the availability of the EU Age Verification Solution, which significantly reduces the implementation and operational costs of age assurance (³⁵⁶). The availability of shared tools, vendor services and the EU Age Verification Solution should help reduce implementation barriers. For many providers, the main burden is therefore likely to consist of one-off integration and product-adjustment work, combined with ongoing but more limited costs related to maintenance, documentation and annual testing, monitoring and evaluation.

Finally, it must be emphasized again, as highlighted in the external study, that a single, harmonised EU framework is considerably cheaper for smaller providers to comply with than a patchwork of 27 national regimes and technical requirements (³⁵⁷).

Software application stores and operating systems

The proposed Regulation also requires providers of software application stores to put in place an age‑rating system that developers must use when submitting apps. The principal administrative burden therefore falls on the providers of the software application store who will need to operate the rating framework and implement the age assurance solution. Developers may have to provide age‑related information through a short questionnaire as part of the standard app‑submission procedure, which is expected to represent only a marginal increase in workload relative to the overall app publication process.

Besides the direct administrative effort, developers may incur indirect costs if age rating process step leads to delayed approvals or if legitimate users are unable to complete the age check, potentially reducing downloads. This risk is mitigated by allowing a range of possible age‑assurance options. While the new duties could increase the market power of app‑store providers, this is mitigated by drawing up codes of conduct for age‑rating systems that aims to harmonise labels and to ensure mutual recognition and consistent application of the ratings by online‑platform providers throughout the internal market.

On the positive side, the codes of conduct will likely reduce collective costs of age ratings. On the developer side, a common age rating system across app stores significantly lowers costs as it eliminates the need to handle several age rating systems and better facilitates multihoming. This simplified entry also benefits app stores by increasing the number of available applications, in addition to the benefits of reduced efforts to developing and updating age rating methodologies and greater legal uncertainty. Common standards also help consumers navigate app stores, which in turn may benefit developers and app stores through increased downloads. Overall, the additional compliance requirements are expected to be manageable and to contribute to a higher level of protection for minors without imposing disproportionate burdens on developers or app‑store operators.

The obligations on operating systems are minimal and only require providers to share relevant age signals they have obtained. This concerns only a small number of entities and builds on existing architecture for sharing OS-level information. Hence, the necessary adjustments are expected to be minimal. On the other hand, this provision may reduce age assurance costs for other providers by avoiding repeated age assurance. The obligation therefore seems very likely to be net beneficial.

AI companions and chatbots

The proposed Regulation is likely to generate compliance and redesign costs for providers of AI systems in scope, particularly chatbots and AI companions accessible to minors. The providers would need to invest in age assurance and age-appropriate safety by design features, such as safer default settings, and time-management tools.

Additional costs may arise from adapting user interfaces to remove nudging practices, restricting features of the system or behaviours that are likely to create emotional dependencies for minors, and putting in place governance, testing and monitoring processes. This may also constrain some engagement-based business models and reduce monetisation opportunities based on prolonged interaction. These requirements may weigh more heavily on smaller providers of chatbots and AI companions, however, they could also create demand for compliance technologies, age-assurance solutions and child-safety engineering services.

Several factors mitigate these costs. First, large parts are one-off design expenses for making services and systems safe for children. Recurrent costs are likely much more limited and primarily linked to the maintenance of these systems and potentially marginal costs for age-assuring new accounts via third-party tools, which are likely to be decreasing and quite limited as described above. Second, providers would likely face these obligations under national legislation and harmonized rules avoid much larger cost of implementation of fragmented and inconsistent technical requirements and makes scaling across Member States far easier. Third, the requirement to carry out post-market monitoring to identify, assess and mitigate emerging risks to the privacy, safety and security for minors, would not apply to micro and small enterprises.

Online games

The proposed Regulation is likely to generate one-off adaptation costs for affected providers of online games.Some obligations in the proposed Regulation would require on-going costs such as Article 14(1) point (a)for providers of online games continuously updating the video game with new content or features after release and for online gaming platforms to comply with the general obligations in section VI. Business organisations have thus reported risks of substantial impacts as off-by-default requirements or restrictions for minors could affect existing monetisation models and gameplay of their products. Industry has also noted existing consolidation pressure for small and micro-enterprises, which are estimated to represent around 80% of EU video game companies (³⁵⁸).

On the other hand, existing evidence of the Commission suggests that the impacts of relevant measures could be offset by the gains in terms of reputational risk as well as simplification savings for the companies. Furthermore, only a quarter of online game users in the EU are minors (³⁵⁹). This would indicate that if these functionalities are limited or prohibited only for minors or for minors under a certain age, the overall revenue may not be substantially affected as minors do not represent a large share of expenditure on video games.

Overall, it is important to emphasize that a harmonised Union approach is expected benefit to benefit all providers and in particular smaller providers operating across borders (³⁶⁰). In the absence of clearer common rules, providers may face divergent national expectations, greater legal uncertainty and duplicated compliance efforts. A more uniform framework should reduce those frictions over time and support the emergence of standardised technical and organisational solutions, including outsourced compliance tools tailored to smaller services. The proposed Regulation also allows for the creation of codes of conduct to be developed with the involvement of providers which could, where appropriate, build on existing pan-European age classification frameworks. Overall, while the extension of obligations to small and micro enterprises, app stores, online video games and AI companions and general conversational chatbots will entail additional costs, these are expected to be proportionate to the risks addressed and manageable in light of the targeted nature of the measures, the availability of external solutions, and the benefits of harmonisation and more level competitive conditions.

4.3.2.4 Safety-by-Design Adjustments

As pointed out above the saftey by design obligations largely appear already in the guidelines on the protection of minors. Besides the inclusion of additional entities and the clearer age assurance requirements, the main additions to safety-be-design are the following: The proposed Regulation requires all services and systems in scope to implement effective, accessible and user-friendly tools for guardians that are not easily circumvented or undermined and that offer a range of minimum functionalities. It also restricts AI companions and general conversational chatbots from exposing minors to design features and system behaviours that are likely to create emotional dependencies, formalises a right to collective complaints and encourages codes of conduct for harmonised age ratings. Potentially the most significant, but one‑off, cost concerns the implementation of appropriate guardian tools. Providers will need to integrate functionalities such as time‑management controls, editing of settings related to privacy, contact, visibility, notifications, geolocation or camera, and to reporting harmful content, accounts or behaviour on behalf of their child. Once these features are built or sourced from third‑party solutions, the remaining expenses should be largely limited to periodic maintenance and updates.

Restricting AI companions and general conversational chatbots from exposing minors to design features and system behaviours that are likely to create emotional dependencies create additional compliance costs for providers, but these costs are likely to be proportionate to the underlying risk. In practice, the providers would need stronger ex-ante evaluations to assess whether design features (such as, e.g., persistent personalisation, relational language, emotional mirroring), could foster harmful attachment. Post-market monitoring, which do not apply to micro and small enterprises, would also need to be reinforced through incident reporting, periodic review of interaction patterns, and processes to detect harmful or manipulative outcomes once systems are deployed. For providers, this may increase development and operational costs, lengthen time to market, and require redesign of engagement strategies that currently rely on maximising user retention through relational features.

Regarding the prohibited features of the chatbots and companions, some examples of exploitative and manipulative practices could possibly already be covered under the prohibitions under the AI Act, thus making the costs marginal. Furthermore, many providers have already been implementing safety measures and mitigations in response to the ongoing investigations and litigations in hundreds of cases in the US on harms suffered by minors and other persons from chatbots and companions (³⁶¹). Similar safety by design measures are also required in mandatory legislation introduced in various US states on the protection of minors from harms and risks posed by chatbots and companions (³⁶²). The impacts of relevant measures would also be offset by the gains in terms of reputational risk as well as simplification savings for the companies. The costs are therefore expected to be proportionate to the risks addressed and manageable in light of the targeted nature of the measures and the benefits of harmonisation and more level playing field.

As the codes of conduct are facilitated by the Commission and participation of firms is voluntary, this article is not expected to create substantial costs for businesses and instead create benefits from improved harmonisation. The collective‑complaint mechanism already exists under Article 53 DSA. For services and systems newly in scope, this obligation merely adds a procedural channel for complaints lodged with regulators and therefore does not create material implementation costs or entry‑barriers. For safety by design obligations that largely replicate the provisions in the guidelines on the protection of minors, most providers are expected to only require modest, one‑off product redesigns or adaptations to ensure formal compliance with the clarified and binding design requirements. Typical adjustments may involve changing default settings, disabling certain features such as autoplay or modifying recommender‑system signals. The associated costs are expected to be comparatively small.

It is important to recognise that, although the absolute financial impact will be lower for small and micro enterprises because their products are less complex, the relative burden may be higher for these firms. Smaller providers have more limited legal, compliance and engineering capacity and therefore may find even modest integration and monitoring tasks proportionally demanding. Nonetheless, the harmonising effects of the proposed Regulation are expected to stimulate the development of open‑source UI components and standard practices for child‑safety features. In the context of the Online Safety Act, the UK government observe continued growth in the UK’s safety tech sector and notes an “ongoing trend for ‘Safety Tech as a Service (STaaS)’” (³⁶³). Falling development costs – partly driven by more efficient coding tools (³⁶⁴) – are expected further reduce the financial and technical effort required to comply, especially for smaller providers.

The redesign and compliance costs are expected to be higher for providers whose current service design is not yet aligned with child-protection-oriented practices. However, this should also be seen in light of the fact that some of the practices concerned may already be difficult to reconcile with existing Union consumer, data protection and DSA requirements where minors are affected. To the extent that the proposed Regulation requires providers to discontinue or redesign features that depend on manipulative or otherwise harmful engagement techniques, this may reduce revenues derived from business models that are not consistent with the Union acquis or with the protective logic already underpinning Article 28 DSA. From that perspective, part of the economic effect is not a new regulatory burden in a strict sense, but the removal of advantages enjoyed by providers that have not yet internalised the costs of safer design. This can improve competitive conditions for providers that already invest in compliant and child-safe services and systems.

4.3.3 Costs for Member States

Overall, EU Member States are expected to face additional administrative, technical and enforcement costs, although these are expected to remain moderate. These costs would primarily be linked to ensuring the availability for their citizens of at least one EU Age Verification solution and means of obtaining proof of age attestations, of parental responsibility, supervising the additional entities covered by the proposed framework, and implementing the flanking national measures to support child safety. However, Member States would have faced some of these costs even without the proposed Regulation and are primary beneficiaries of the harmonisation effects, increased cross-border trade and the expected public health benefits. Furthermore, increased coverage and use of digital identity solutions will also bring wider benefits for e-governance beyond online child safety.

The proposed Regulation requires Member States to ensure the availability for their citizens of at least one age verification solution and of different means of obtaining a proof of age attestation. It is important to note that this is an obligation to ensure practical availability, not necessarily to design, develop, finance or operate a public solution. It could be met through a public solution, an eIDAS-based route, a procured private service, the use or recognition of a cross-border solution, or a hybrid model. The magnitude of the costs will therefore depend on the implementation choices made by Member States and on the extent to which existing infrastructure and market solution can be used. Member States would nevertheless face administrative tasks: mapping available solutions, ensuring that at least one route is operational, addressing accessibility gaps, facilitating cooperation and cross-border availability, and supervising providers in scope. Competent authorities may also need technical expertise to evaluate equivalence claims, investigate complaints, assess whether updates have lowered performance, and coordinate with data-protection, consumer-protection, cybersecurity and eIDAS authorities. Many of these costs are expected to be mitigated through cooperation and joint technical capacity, templates, published criteria and standard evidence packages.

It is essential to note that Article 5 of the European Digital Identity Regulation already required every EU Member State to provide at least one EU Digital Identity Wallet to all citizens, residents, and businesses by 2026, ensuring interoperability, privacy, and secure access to digital services across the EU (³⁶⁵). The EU Age Verification solution can be integrated relatively easily into the Wallet. While it has to be certified separately and published on the trusted list under the EU Age Verification Scheme, the costs associated with integrating the age verification functionality into existing digital identity infrastructure are expected to be lower than the costs of establishing such infrastructure in the first place. In practice, the costliest obligation could be ensuring the availability of in-person verification options or digital identity-based onboarding methods to ensure that individuals without a passport or electronic ID card, or without an NFC-enabled smartphone, can verify their age. These costs largely depend on the coverage of existing digital identity and in-person verification solutions in the Member State and the coverage of 15-to-17-year-olds with the necessary identity documents. In most Member States, minors can already obtain ID cards from the age of 15, and many Member States already operate digital identity solutions, at least for adults. To limit costs, additional coverage could be targeted rather than requiring universal public provision. While costs are proportionately higher in Member States with more limited existing infrastructure, increased coverage will bring clear benefits beyond online child safety, notably for e-governance and digital administration services.

The proposed Regulation also includes flanking national measures to prepare and support minors, notably ensuring easy, free and confidential access at national level to channels through which minors can seek assistance in relation to the harms, as well as awareness raising activities. However, these measures very closely follow existing initiatives, notably the action plan against cyberbullying as well as the Better Internet for Kids strategy and its network for Safer Internet Centres and should imply at most limited marginal costs (³⁶⁶, ³⁶⁷).

As discussed above, the proposed regulation covers additional entities compared to Article 28 DSA. Most smaller providers as well as online games that are video games are supervised by national authorities, which may lead to additional enforcement work. However, enforcement builds on existing DSA and AI Act enforcement structures, limiting marginal costs. Importantly, Member States would have faced many of these costs, and potentially more, without the proposed Regulation. As described in detail in section 2.1, most Member States are working on national regulatory initiatives that would lead to additional enforcement obligations. For instance, the Austrian proposal was estimated to require additional staff equivalent to 0.5 full-time equivalents, i.e. EUR 60,000 (³⁶⁸). Among other tasks, Member States would have had to assess existing technology and requirements for age verification, access restrictions and safety by design and take official action in case of serious infringements. National authorities themselves have repeatedly suggested extending obligations to small and micro enterprises, notably in the context of Working Group 6 of the European Board For Digital Services. The impacts on public authorities are further discussed in section 4.3.4.2 below.

At the same time, Member States will gain several economic benefits from the proposed Regulation. By harmonising age‑verification and safety‑by‑design rules across the Union, it is expected to reduce the need for national regimes. Much of the legislative, technical and enforcement effort that Member States would have otherwise incurred are thus avoided or reduced, while certain common technical and implementation task are undertaken at Union level. Moreover, the benefits of strengthening the internal market and fostering cross‑border trade (see 4.3.4.1) as well as the potential benefits from boosted innovation in the digital space (see 4.3.4.3) accrue primarily to the Member States. Similarly, the proposed Regulation’s public‑health objectives – including a reduction in the incidence and impact of online harms affecting minor – may translate into long‑term savings for national health and social‑care systems (see 4.3.4.4). Overall, the harmonised framework is expected to provide legal certainty, economic efficiency and societal benefits, while limiting the need for Member States to establish and maintain divergent national frameworks.

4.3.4 Broader Economic Effects

4.3.4.1 Internal Market

Beyond direct compliance costs, the proposed Regulation is expected to have broader economic effects that are overall limited to moderately positive, although some uncertainty remains as regards the scale and timing of those effects. A central consideration is the functioning of the internal market. In an area where several Member States are already moving towards national rules on age limits, access restrictions and age assurance, further Union-level clarification and harmonization of the protection of minors framework can reduce regulatory fragmentation and create a more predictable environment for cross-border service provision. This is particularly relevant for digital services and systems, which typically operate across borders and would otherwise need to adapt products, terms, technical systems and compliance processes to diverging national approaches. In that respect, the proposed Regulation is expected to generate the same type of harmonisation benefits that underpinned the DSA and the AI Act more generally: lower legal uncertainty, fewer duplicative adjustments and more level conditions of competition within the internal market. For the DSA, these were estimated to increase turnover generated cross-border by EUR 8.6 to EUR 15.5 billion (³⁶⁹). In case the DMA, the benefits from reduced fragmentation and increased cross-border trade were estimated to be EUR 92.8 billion and EUR 450 billion to EUR 1.76 trillion after 10 years respectively (³⁷⁰). While these effects are inherently difficult to quantify, this does suggest first-order economic benefits of the proposed new Regulation.

These benefits may be especially important for providers active in several Member States, including smaller firms seeking to scale across borders. In the absence of a clearer common framework, larger providers are generally better placed to absorb the fixed costs of legal analysis, technical adaptation and ongoing monitoring across multiple jurisdictions. A more harmonised Union approach can therefore help limit the extent to which fragmentation itself becomes a competitive advantage for the largest players (³⁷¹).

4.3.4.2 Public Authorities

For public authorities, the economic impact is expected to be neutral and potentially slightly positive overall. Additional costs for regulators might plausibly be offset or outweighed by savings in the public health sector from improved mental and physical health.

The proposed Regulation likely requires additional spending on regulatory capacity, both at the national and EU level, for two reasons. First, there are new obligations to enforce, notably the minimum age and the more stringent age assurance requirements. Second, investigating compliance of for the potentially large number of small and micro providers could increase case load substantially, though it is expected that first-order compliance issues are rarer among these providers and that cases are less complex. Third, regulators will need additional resources to conclude investigations in the very short, envisaged time frames. Experience has shown that stable resources and permanent staff who are well experienced with both the regulation and the particular digital service or system under investigation are key to swift enforcement.

As a reference, the Australian Government has planned AUD 76.1 million (ca. EUR 47 million) over four years from 2024–25 (and AUD 16.9 million (ca. EUR 10.4 million) per year ongoing from 2028–29) to establish the minimum age of access to social media, including AUD 12.3 million (EUR 7.6 million) per year ongoing for the Office of the eSafety Commissioner to provide regulatory oversight and enforcement functions (³⁷²). The impact assessment of the UK’s Online Safety Act has estimated costs to the regulator of GBP 62.6 million (EUR 73 million) per year (³⁷³) and for 2025/26 Ofcom has reported an increase in staff costs of GPB 16 million (EUR 18.7 million) and of ICT costs of GPB 3.7 million (EUR 4.3 million), both driven by regulation of new duties (³⁷⁴). Under the proposed regulation, part of the enforcement costs may be recouped via fees.

On the positive side, clearer obligations should make supervision and enforcement more efficient than in a situation where authorities and providers must rely primarily on broad principles and non-binding guidance. A more uniform framework may also reduce frictions linked to cross-border enforcement and reduce uncertainty for authorities as well as providers. Furthermore, to the extent that the proposed Regulation contributes to improving the mental and physical health of minors, it reduces public health care expenditure. Some economic estimates for the United States suggest that the health care cost alone for social-media related depression might be in the order of billions of dollars (³⁷⁵).

4.3.4.3 Innovation, Competition and the Digital Ecosystem

Overall, it is expected that the proposed Regulation supports innovation and level competition in the digital space. In principle, the proposed Regulation may create some additional barriers to entry, notably acquiring familiarity with the legal obligations, implementing the granular guarding control tools that are required for providers of all sizes and sectors and, where needed, age assurance measures to comply with safety by design requirements. This effect should not be overstated, but it is likely to be felt more acutely by smaller providers with limited in-house legal, engineering and compliance capacity, which could potentially impact innovation and market concentration in certain areas. Research has linked the GDPR to a substantial reduction in the number of apps available in EU app stores, citing administrative burdens, increased developer cost, reduced revenue and lack of knowledge of obligations, with stronger effects for fringe applications (³⁷⁶). While some of these concerns apply to the proposed Regulation, the concerns are mitigated by several factors. First, the testing, monitoring and evaluation obligations apply only to very large online platforms, limiting the administrative burden for smaller providers. Second, the strictest age assurance requirements (age verification) are limited to social networking and video-sharing platforms and AI companions only.

Some business models may also be affected more directly where they depend on design choices that maximise engagement in ways that are difficult to reconcile with a high level of protection for minors. To that extent, the proposed Regulation may reduce revenues associated with certain practices for some providers. However, this should be seen in context. Where the proposed Regulation mainly clarifies and codifies the protective logic already inherent in Article 28 DSA and related guidance, part of the economic adjustment reflects the removal of advantages previously enjoyed by providers that had not yet internalised the costs of safer design. This will improve competitive conditions for firms that already invest in age-appropriate and child-safe services. Thus, the harmonised legal requirements would establish a level playing field across the single market.

There are two further reasons why the proposed Regulation is expected to boost innovation. First, it likely fosters innovation in child-safe digital services and systems. In particular, it can strengthen demand for privacy-preserving age assurance tools, safer default settings, child-friendly interface design, parental tools and other technical solutions that enable compliance while limiting unnecessary data processing. Over time, this may contribute to the development of specialised compliance and safety technology markets in the Union. In that context, synergies with wider EU digital infrastructure, including the EU Digital Identity Wallet and the Union’s age verification solution, may help lower implementation costs and reduce dependence on proprietary systems. The extent of these benefits will depend on uptake and technical maturity, but such synergies could become more important over time, especially for smaller providers that rely on shared solutions rather than bespoke systems.

Second, it is important to emphasize the advantage of common harmonised rules again. The immense burden of 27 different national regimes imposing divergent requirement along a range of dimensions as well as legal uncertainty regarding concrete child safety requirements and the increasing number of related lawsuits have chilling effect on investment and can dissuade businesses from expanding and growing in the single market. The burden of different enforcement regimes and the costs for companies of dealing with multiple enforcement agencies are similarly prohibitive for smaller enterprises and thus hamper innovation. The harmonised measures would cut the costs of the evolving legal fragmentation, and the extended scope would fully level the regulatory playing field for online child safety in the EU. These benefits were also a key rationale for the DSA in the first place (³⁷⁷). More generally, a stable and predictable regulatory environment are generally seen as creating conducive to investment innovation (³⁷⁸,³⁷⁹).

4.3.4.4 Indirect Long-Term Economic Benefits

Finally, to the extent that the proposed Regulation contributes to reducing online harms affecting minors, it may also generate indirect longer-term economic benefits that are not easily quantifiable in this assessment but are likely to be relevant. Research has found significant negative impacts of early social media use on learning outcomes in PISA tests (³⁸⁰) and indicated that online distractions can reduce productivity (³⁸¹,³⁸²,³⁸³). Economic estimates for the United States suggest that the social cost of social media from depression, medical bills, lost work time and deaths could be as high as 2.4 trillion dollars (³⁸⁴, ³⁸⁵). A safer online environment may support better well-being and, over time, better educational and developmental outcomes for children. It may also reduce certain wider societal costs linked to harmful online experiences. These effects are inherently difficult to monetise and will depend on implementation and effectiveness in practice. Nevertheless, they point towards potentially important longer-term gains that go beyond the immediate compliance impacts on providers.

Taken together, the broader economic effects of the proposed Regulation appear manageable. The main negative effects are likely to arise from higher short-term costs for compliance checks, product redesign, and, for some firms, possible adjustments to business models. These effects should, however, be weighed against the expected benefits of greater harmonisation, improved legal certainty, more level competitive conditions, better enforceability and possible innovation in child-safe digital services and systems. On balance, the proposed Regulation is therefore not expected to give rise to disproportionate economic costs, while it may generate meaningful medium- to long-term benefits for the internal market and society more broadly.

5 Conclusion

The proposed Regulation will deliver a single, Union‑wide framework that safeguards children’s health, well‑being and fundamental rights while improving legal certainty for providers of digital services and systems in scope. By establishing a harmonised access delay of 15 years for social‑networking services, video‑sharing platform services and AI‑companions, it prevents exposure to the most harmful design features during the critical phase of adolescent development and improves minors' mental and physical health. The accompanying safety by design obligations – prohibiting addictive mechanics, enforcing child‑friendly default settings and guaranteeing transparent, controllable recommender systems – ensure that the services and systems which remain accessible are intrinsically age‑appropriate, thereby protecting minors from compulsive use and unsafe content. Mandatory, privacy‑preserving age‑assurance mechanisms underpinned by the EU Age Verification Solution further guarantee that only users of the required age can create accounts, whilst offering parents robust supervision tools without compromising data‑protection standards.

In parallel, the Regulation will avoid a patchwork of national rules, simplifying compliance for providers of all sizes and strengthening the single digital market. Uniform obligations reduce duplicated administrative burdens, lower compliance costs and enable more efficient, coordinated enforcement. This clearer legal environment will also encourage innovation in child‑safe technologies, such as interoperable age‑verification solutions and child-friendly interfaces, creating new market opportunities and strengthening the EU’s global leadership on online child protection. Ultimately, the proposed Regulation delivers a proportionate, evidence‑based response that enhances the safety of the online environment for all children and adolescents across the Union, creates a level‑playing field for child‑online protection, and supports the long‑term social and economic benefits of a healthier, more resilient digital generation.

From the outset, the Commission has pursued an evidence-based approach to this initiative. As announced by President von der Leyen in her 2025 State of the Union address, the Commission launched this initiative by establishing a Special Panel of leading specialists to develop recommendations for a European approach to children’s online safety. The panel brought together the latest knowledge from across health, neuroscience, psychology, computer science and child rights, alongside the experiences of children, young people and parents across the Union. Drawing on this broad expertise, as well as comprehensive input from stakeholders and young people, the Co-Chairs of the Special Panel on child online safety presented their report in July 2026.

The proposed Regulation presented by the Commission builds closely on the recommendations in the report of the Co-Chairs of the Special panel and reflects the Commission’s evidence-based approach throughout the process. In the same spirit, the Commission intends to put in place a robust monitoring and evaluation framework to assess how the new rules operate in practice, whether they achieve their objectives, and whether any unintended effects arise over time. This will help ensure that implementation remains proportionate, effective and responsive to technological and market developments.

The evaluation approach will combine different sources of evidence and draw on the highest available expertise, including independent academic partners and relevant stakeholders, with appropriate attention to children’s rights, privacy and research ethics. It will examine both implementation and outcomes, including the effectiveness of the access delay, the personal scope of the access delay, impacts on minors’ exposure to online risks and harms, broader effects on wellbeing and participation online, fundamental rights of minors and adults as well as possible consequences for parents, providers and the internal market. In doing so, the Commission will draw on relevant international experience, such as the ongoing Australian Social media age restrictions evaluation. The Commission also intends to ensure that children’s and young people’s perspectives are meaningfully reflected in this work, and to publish findings in a transparent and timely manner so that they can inform future review and adjustment of the framework. In this way, the initiative is designed not as a static intervention, but as a future-proof regulatory approach capable of learning from evidence and adapting as services, risks and user behaviour evolve.