The EU KIDS Act Is Only a Proposal: What Brands Marketing to Teens Should Do Now

If a client sells trainers, games, energy drinks, cosmetics or a study app, part of its EU audience is under 18, and much of the rest sits just above that line. On 17 September 2026 the European Commission proposed a law that would change who can hold a social media account, how feeds are ranked for minors, and how platforms establish a user's age. It is the EU KIDS Act, short for Keeping Internet Digital Spaces Accountable and Trustworthy, and it is a proposal. It binds no one until the European Parliament and the Council agree a final text.

That makes it planning material rather than an emergency. The useful work now is to find out how much of a client's plan depends on the things the proposal targets, before a final text forces the question.

What the Commission proposed

The Commission's press release sets out four pillars: a social media delay, safety by design, privacy-preserving age assurance and enforcement. The age rules are the headline.

The safety-by-design duties cover online services offering social media, video sharing, online video games, AI companions and chatbots to users under 18. The Commission lists a ban on addictive features and on profiling-based recommender feeds that drag minors into “rabbit holes” of harmful content, and prohibits infinite scroll without stopping points, reward tricks, push notifications during sleeping hours and unsolicited contact from strangers. Profiles for minors would be private by default. The Commission's Q&A adds that, for minors, personalisation based on tracking is off by default, what a child chose to follow comes first, and no data from outside the service may be used.

Enforcement is aimed at the largest platforms. Those with 45 million or more monthly active users in the EU would submit a compliance plan checked by an independent auditor, and the Commission would aim to conclude investigations within 90 days. The Q&A puts fines at up to 6% of total worldwide annual turnover.

What changes for advertisers, and what does not

The proposal does not create a new ban on targeted ads to minors, because one already exists. Article 28(2) of the Digital Services Act stops online platforms from showing ads based on profiling to a user they are aware with reasonable certainty is a minor. What the KIDS Act would change sits around the ad, not in it.

The first change is reach. If under-13s leave social media and 13 to 14-year-olds move to guardian-controlled mini accounts capped at an hour a day, the pool of teenage users that platforms can reach narrows, and the accounts that remain skew older. The second is organic distribution. Article 10 of the proposal would require social networking and video-sharing services to switch off, by default, recommendations to minors based on implicit engagement signals, which Recital 28 illustrates with time spent viewing content and click-through rates. Explicit preferences, such as topics a minor chose, would get priority. Reach from discovery, where content finds users who do not follow the account, depends heavily on implicit signals of this kind. Without them, a minor's feed leans on what they chose to follow.

The third change is the one that could reach adults. Article 6(4) of the proposal gives platforms in scope six months from the date the rules apply to establish whether holders of existing accounts are under 15, and to disable the accounts of those who are or whose age cannot be established. The Commission's Q&A says the same and adds that where a platform can already tell with high confidence that a user is an adult, no new check is needed. The press release says existing accounts would be assessed with reasonable proxies such as account creation date or credit card details. A young adult with a recent account and no card on file is the kind of user a proxy may not resolve. How many accounts that touches depends on methods platforms have not yet set out.

What to do this quarter

Audience definitions

List which EU campaigns target, or in practice reach, 13 to 17-year-olds, and which rely on 18 to 24 audiences built from engagement. Split any plan that treats Gen Z as one block into under 15, 15 to 17 and adult, because the proposal treats them differently. Record where the audience size assumptions for youth-skewed categories come from, so they can be revisited when a final text lands.

Age signals and data

Check how age reaches the client's own systems: a date of birth at sign-up, a declared age in a loyalty app, or nothing at all. A brand that runs a community, a game or a chatbot that minors can use may be in scope itself, not only as an advertiser, since online games, AI companions and chatbots are named. Build first-party data from people who chose to hear from the brand, with age collected honestly, rather than lookalikes seeded from teenage engagement.

Creative and influencer plans

Creator programmes aimed at teenagers depend on the same recommender behaviour the proposal targets. Brief creators on the assumption that reach among minors comes from followers rather than discovery. Favour creators with a verifiably adult audience for anything age-restricted, and keep content for younger audiences to formats that would still work inside a guardian-controlled account.

Measurement

Set a baseline now: reach, frequency and cost by age band on each platform for EU campaigns, so a change in delivery after the rules apply can be told apart from seasonality. Note where a platform reports conversions from younger users through modelled data, because age assurance can shift what a platform is able to report as well as who it can reach.

What to watch in Parliament and Council

• Whether the age thresholds survive, especially the line at 15 and the treatment of 13 to 14-year-olds.
• Whether the duty to disable accounts whose age cannot be established stays in the text, and how long platforms get to apply it.
• How profiling-based recommender feeds and implicit engagement signals are defined, since that decides how far organic reach among minors changes.
• Whether small providers stay in scope. As drafted, small and micro enterprises are not exempt, and only the compliance plan and audit are reserved for the largest platforms, which matters for gaming and chatbot clients.
• The application date, which decides when this moves from planning to delivery.

The EU is not alone. On 10 September 2026 California's governor signed 13 child online-safety bills, including limits on addictive features and algorithmic feeds for under-16s and rules on age verification signals in software applications. Brands with audiences on both sides of the Atlantic should expect age assurance and feed rules to become a normal line in the paid social plan, whichever text is final first.