Protecting children without checking everyone

This is an editorial opinion piece. The argument is presented by the author. Sources in notes.

Two citizens' initiatives

A European Citizens' Initiative is the one tool the EU treaties give ordinary people to put a law on the Commission's desk: collect a million verified signatures across at least seven member states, and the Commission must give a formal answer. In June it answered one signed by more than 1.29 million people and validated in 24 member states.¹ The initiative, "Stop Destroying Videogames", came from the gamers' campaign Stop Killing Games. It asked that games people have paid for keep working when the publisher switches off its servers. The Commission replied that it "cannot propose a legal obligation to keep video games playable", citing among other things publishers' intellectual property rights, and offered instead to work with the industry on a voluntary code of conduct.²

The same campaigners have since registered a second initiative, "Stop Killing The Internet: No Digital ID & No Age Verification", asking that digital identity and age checks stay "voluntary, privacy-preserving and non-discriminatory".³ In September the Commission proposed the EU Kids Act, which brings online games into scope alongside social networks, video platforms, app stores, operating systems and AI chatbots.^{4, 5} A hobby has turned into a key EU policy question that every European has reason to ask: what does it cost to make the internet safer for children, and who pays?

The monsters, by name

Safer from what, exactly? "Protecting children online" can mean almost anything, so it helps to be specific. Researchers who study children's online lives sort the risks into four groups, the "4Cs": content, contact, conduct and contract.⁶

Content is what children see. In the 2026 wave of EU Kids Online, a survey of 28,465 children aged 10 to 16 in 19 countries, 40 percent reported seeing gory or violent images, 39 percent content about ways to become very thin, and 37 percent content about hurting themselves.⁷ Recommendation systems can turn one search into an endless stream of more of the same; the Commission calls these "rabbit holes".⁸

Contact is who reaches them: strangers, and in the worst cases adults who groom children for abuse or radicalisation. The Commission's answer is "prohibiting unsolicited contact from strangers".⁹

Conduct is what other people, often other children, do to them. Three in ten children in the same survey meet hateful messages at least once a month.⁷

Contract is what the business model does to them. Loot boxes are digital "mystery boxes" bought with real money, whose contents the player sees only after paying.¹⁰ Premium in-game currencies blur what things cost, in a market where 84 percent of children aged 11 to 14 play video games regularly.¹¹ Profiling turns a child's behaviour into advertising data.

One monster runs through all four: design built to hold attention. Autoplay, infinite scroll, "streaks" that punish a missed day, and notifications that pull a child back are the Commission's own examples.⁸ Among the adolescents surveyed for the World Health Organization in Europe, problematic social media use rose from 7 percent in 2018 to 11 percent in 2022.¹² The newest arrival is the AI companion, a chatbot built to feel like a friend; the proposal bans designs "likely to create emotional dependency".⁸ Italy's data protection authority fined the maker of one such app, Replika, €5 million in 2025, finding among other things that it had no age check at all.¹³

Nearly all of these harms are properties of the service: what it recommends, whom it allows to send messages, how it charges, how it holds attention. Fixing most of them does not require knowing who the user is. Blocking strangers from contacting children is the clearest exception.

What the Act would do

The Kids Act is still a proposal; Parliament and the member states will amend it before it becomes law.⁴

Its core rule is short. Social networks and video-sharing platforms "shall not allow minors below the age of 15 to create" their own account. Between 13 and 15, a parent or guardian can hold a limited account on the child's behalf.¹⁴

To enforce that rule, the platform has to know your age, and ticking a box saying you are old enough will no longer count.¹⁵ The proposal routes the check through an EU proof-of-age attestation from a certified provider,¹⁶ and every member state must offer at least one free way to get one. The EU digital identity wallet, the phone app every member state must offer its residents under the European digital identity rules, qualifies.¹⁷

An attestation is a digitally signed statement, in this case "this person is over 15", issued by a party that has already checked who you are, for example against your national ID. Under the design the Commission published in July 2025, the platform receives a yes or a no and nothing else: no name, no birth date.¹⁸ The proposal requires the check to use a zero-knowledge proof, a cryptographic method that proves a statement without revealing the data behind it.¹⁹ What the issuer may log about each check is left to later implementing rules.²⁰

What the Act does not do matters as much. There is no daily check, and existing accounts whose holders are already established as adults "with high confidence" are left alone.²¹ The weight falls on new accounts: every new account, at any age, starts from the assumption that its holder is a child. In the words of European Digital Rights (EDRi), the Brussels-based network of digital rights organisations, services "would have to treat users as children by default unless they prove their age."²² Parents opening a guardian account must also prove they are parents.²³

The case for it, at its strongest

The harms are real, and the Act deserves its best defence before any criticism. The Commission's impact assessment rests on an observation about development: childhood and early adolescence are stages in which "cognitive control, emotional regulation and resistance to social pressure remain under development".²⁴ A special panel of more than 60 experts, co-chaired by the child psychiatrist Jörg Fegert and the epidemiologist Maria Melchior, advised the Commission this summer.²⁵ The proposal followed a call for evidence in 2024 and a public consultation in 2025, with several hundred contributions.²⁶ In the Commission's survey work, 92 percent of respondents called stronger protection of children online a top priority.²⁷

Child-rights organisations broadly welcome it. 5Rights, which campaigns for children's rights online, called the proposal "a solid basis", while asking that it apply equally to all platforms.²⁸ Eurochild, the European network of children's rights organisations, wrote that the debate "has moved beyond the polarising choice between a 'ban' and 'no ban'".²⁹

The engineering deserves credit too. The UK lets platforms and their vendors check age with photo ID, facial estimation or credit cards.³⁰ US states such as Utah push the check into the app store, and China builds it into the device.³¹ Of those models, Europe's yes-or-no proof reveals the least to the service that receives it. If an age gate must exist, this is the one I would choose.

Where the case is thin

Three gaps sit under the obligation. The first is the age itself. The Commission's own expert panel recommended EU-wide restrictions "below age 13".³² The Act sets 15 for an own account. The number appeared first in the President's State of the Union speech the day before the proposal: "No social media under the age of 13. No personal account under the age of 15."³³ Neither the proposal nor its impact assessment, as far as the published analyses show, gives a reason for moving from the panel's 13 to 15.³⁴

The second is sequence. In August 2026 the Commission ordered an external study of the impact of age assurance, due in the fourth quarter.³⁵ The obligation to check was proposed before the study of what checking does was finished.

The third is causation. Whether social media harms young people's mental health is a live scientific dispute. In 2019 the UK's four Chief Medical Officers found that the research "does not present evidence of a causal relationship between screen-based activities and mental health problems".³⁶

This does not mean the harm is imaginary. In my view, the evidence supports caution and changes to how services are designed. And basic common sense tells us that we are shaped by what we read, consume, witness and participate in, particularly in the formative years of our youth. However, the evidence does not establish that an identity check at 15 is the remedy.

Sovereignty, pointed inward

nupath.eu, the publication you are reading, uses "sovereignty" in a narrow sense: it means control and jurisdiction over the systems a society depends on. Individual freedom sits deliberately outside that definition. My premise here is that the frame exists to serve something: sovereignty is a means, and the end is a democratic society of free people.

The European digital sovereignty agenda was built to protect from the outside, against dependence on foreign cloud, foreign chips and foreign governments' access to European data. By that outward test, the Kids Act scores well. The credential that proves your age comes from a certified European source; Apple and Google do not issue it, even though their app stores and operating systems must apply the check (see our deep dive It's time to pick up the smartphone).³⁷ In our map of the world's technology blocs, Europe is the region that put the age layer in the state's wallet (Tech blocs, part one).³⁸

That is what raises the inward question. The most sovereign identity layer Europe has built so far is pointed towards the people who live here. Zero-knowledge proofs limit what the platform learns. They do not change the fact that a certified credential becomes a precondition for a new account on large parts of the internet, which leaves out anyone without a suitable phone or ID, and puts a compliance cost on small services that the largest companies absorb easily.³⁹ EDRi's Simeon de Brouwer put the first point in one line: "We are turning smartphones and identity documents into prerequisites for accessing online spaces and exercising fundamental rights."⁴⁰ Stop Killing Games raises a version of the second point for games, warning that community-run servers could not carry the load; lawyers dispute that reading.⁴¹

My prediction is that infrastructure outlives the intentions it was built with: a credential gate built for social media will be cheap to extend to the next category of service, and each extension will always come with a good reason, like children, security or health. The child-abuse file shows how that reason works, with a different instrument: the temporary rule that lets messaging services scan for abuse material voluntarily now runs to 2028, and the permanent regulation, known as chat control, is still being negotiated.⁴² In both files, the protection of children is the reason given for infrastructure that reaches everyone.

Regulate the machine, not the person

There is a better tool, and the Act already contains part of it. The features that the panel worried about are design choices: endless feeds, autoplay, notifications at night, recommendation systems tuned to keep a child scrolling. The panel asked for them to be switched off by default, and is reported to have said that "the burden of proof needs to be on providers, not regulators, parents and children."⁴³ The Act adds safety-by-design duties of its own.⁴⁴

None of this is a new idea. "Make safe products" is the foundation modern European consumer protection is built on. Food law lets regulators act when "the possibility of harmful effects on health is identified but scientific uncertainty persists".⁴⁵ Toys must be safe before they reach the shelf, and a toy with small parts carries the warning "Not suitable for children under 36 months".⁴⁶ Nobody checks a parent's ID at the toy shop. The General Product Safety Regulation, which has applied since December 2024, asks makers to weigh the risk for "vulnerable consumers such as children".⁴⁷ Even the AI Act was built on the same product-safety machinery: a high-risk system must meet its requirements before it is placed on the market.⁴⁸ Games already carry the European PEGI age labels, used in more than 35 countries since 2003.⁴⁹ Why should online games and platforms be the one product category where safety is delivered by checking the customer instead of the product?

The analogy has a limit, and it points the same way. Europe does check age where a product is harmful by nature: tobacco sold at a distance must pass an age check at the moment of sale,⁵⁰ and in June the EU's Court of Justice confirmed that member states can require age checks on foreign pornography sites.⁵¹ That gives a principled line. A feature that works like gambling, such as a paid loot box, can be treated like gambling: Belgium's gaming regulator ruled in 2018 that paid loot boxes fall under its gambling law, even if enforcement has since proved hard.⁵² Everything else should be made safe, like a toy, and labelled for age, as games already are. A label informs parents without identifying anyone.

This is not a case for leaving the market to sort itself out, as some would prefer. It is a case for regulating, but aiming at the product instead of the person using it. Nor is this a case for raising children in cotton wool. A safe playground still has climbing frames; it just has no rusty nails. Children learn to cope by meeting real challenges, and an age gate does not teach that, it postpones the encounter.

Design duties have a weakness, and it should be named: a default that applies only to minors still needs to know who is a minor. The way out is to make the safe setting the default for everyone. Profiling-based feeds, autoplay and night-time notifications start switched off, and any adult who wants them switches them on. The European Parliament asked for exactly this in 2023, a "right not to be disturbed" with attention-seeking features off by design,⁵³ and the Digital Fairness Act, the consumer-protection package expected before the end of the year, is meant to address addictive design for all users.⁵⁴ Where a specific feature carries a specific risk, a narrow age check at that point can be argued for, as with gambling. A credential at the front door for every new account is a different thing. Moritz Katzner, who directs European affairs for the second citizens' initiative, put it as an image: "If a town hall has problems, you address the problems inside it. You do not close the town hall or demand identity papers from everybody at the entrance."⁵⁵

Default-safe design is not free. It cuts into business models built on engagement and in-game spending, and I expect the companies that depend on them to resist design duties harder than an age gate, which leaves their products unchanged for everyone who passes it.

Default-safe design constrains the companies whose features are suspected of causing the harm, protects a 14-year-old and a 40-year-old at once, and asks nobody for papers. It needs the same evidence test, but if it proves unnecessary, users have lost nothing. EDRi put the alternative with some edge: under an age gate, it is "as if these services, practices and functionalities will magically cease to be harmful on someone's 18th birthday."⁵⁶ They don't. The World Health Organization has recognised gaming disorder as a condition since 2022,⁵⁷ and we all know stories about adults who end up spending excessive time and money on digital services; some of us have watched adults lose their grip on life through excessive online gaming.

The strongest version of the gamers' case is not about servers. It is in their second initiative, which asks that digital identity stay "voluntary, privacy-preserving, decentralised and usable without forcing citizens into one state-backed or Big-Tech-mediated wallet", and that no one be required to identify themselves to reach lawful content "unless strictly necessary, proportionate, and provided by law".³ The Kids Act already meets part of that demand: its proof of age is built to reveal nothing else. The open questions are the two words it does not yet settle: voluntary, and decentralised.

Who gets heard

Over the months the Kids Act took shape, 1.29 million validated signatures for game preservation were answered with a voluntary code of conduct.² The two cases differ, but they sit awkwardly together: when citizens ask the Commission to bind the game companies, they get a voluntary code; when the Commission wants every new user to prove their age, it proposes a law. A requirement that reaches citizens deserves at least the caution shown to one that would bind companies. Parliament will now decide much of this, and it may push further rather than back: in November 2025 it called for a default digital age limit of 16.⁵⁸

The price of a safer internet

In my view, Europe's sovereignty project was never meant as independence for its own sake. The democratic society is what is being protected; sovereignty is the means to protect it. A continent that becomes independent of foreign platforms while building an identity check into the everyday use of its own internet would, by that measure, have failed on its own terms.

At times it seems that policy circles work on the assumption that the only way to affect something is to tighten control, even when that carries an echo of virtue signalling ("at least we are doing something").

The conditions I would accept: wait for the age-assurance study the Commission has already ordered before making the check an obligation; enforce default-safe design first and measure what it achieves; keep age checks for specific, named risks and voluntary everywhere else; add a sunset clause and a review with the power to end the regime, in addition to the review the proposal already plans;⁵⁹ and build nothing that cannot be switched off once its reason is gone. Even that is risky: temporary solutions tend to become permanent out of sheer convenience. And in the current European political climate, it is easy to tighten laws and much harder to loosen them.