EFF: The EU Kids Act Will Undermine Privacy for Everyone

Last week the European Commission presented its draft EU Kids Act, meant to shield minors from the risks of social media, video games, and AI systems. The digital rights group Electronic Frontier Foundation warns that this protection carries a steep cost: age gates, expanded intrusive age verification, and eroded privacy for every user—not just children.

The law bills itself as building on the Digital Services Act (DSA), turning into binding "hard law" the safety-by-design measures that until now lived only in non-binding guidelines. The proposal rests on four pillars: a social media age "delay," safety by design, age assurance with parental responsibility, and strong enforcement.

Age gates for social media

On an expert panel's advice, the draft phases access to platforms deemed "risky"—a bar cleared merely by using personalized recommenders or offering "uninterrupted content consumption." No accounts under 13; tightly parent-supervised accounts from 13 to 15; autonomous accounts in a safe-by-design environment from 15 to 18. Full access is reserved for adults.

EFF concedes the approach is at least proportionate: it is not the blanket ban a French court recently ruled unconstitutional. Age checks aren't required for existing accounts if a provider can tell with a "high degree of confidence" that a user is an adult—a vaguely defined standard. Yet the law still sweeps in virtually all mainstream services, and age thresholds remain a blunt proxy for maturity.

Non-profit encyclopedias, scientific repositories, educational services, and open-source software platforms are exempt. But there is no carve-out for small and medium enterprises, which will only entrench the dominance of well-resourced tech giants already investing in such tools.

Safety by design

The second pillar reaches wider—covering social media, video-sharing, games, AI companions, chatbots, and even app stores. Providers must make child-safe design the default and may relax only after age assurance confirms an adult user. That means curbing infinite scrolling, safer settings, reducing emotional dependency on chatbots, and contact protections in games.

EFF stresses the devil is in the details: some requirements fit poorly with the decentralized architecture of the Fediverse, and importing product-safety doctrines into speech regulation is risky—deciding what is "safe" easily becomes deciding what content people may access.

What's next

Tellingly, the Kids Act skipped a full impact assessment. EFF urges EU lawmakers to pull the teeth of its most harmful provisions and ensure the new rules don't erode the fundamental rights of all users.

Source: EFF Deeplinks