EU KIDS ACT's proposed new online child protection rules signal legal reforms in Spain

The European Commission in a move to tighten child safety standards across the EU's digital markets, including Spain, proposes to impose specific product requirements for child protection on social networks, video platforms, software application stores, online games, operating systems, artificial intelligence (AI) companions and chatbots accessible to minors.

The proposed EU KIDS ACT, officially the EU Keeping Internet Digital Spaces Accountable and Trustworthy regulation, was put forward on 17 September and remains open for a nine-week consultation period until 3 December.

Age bands would change how accounts are created

The account restrictions apply to online social networking services and video-sharing platform services where the service poses a risk to the privacy, safety or security of minors below 15. This covers services that enable real-time content transmission (for example, live video broadcasts), contact with users outside pre-existing connections (for example, direct messages from strangers), profiling-based recommendations or suggestions from outside the user's subscriptions (for example, algorithmically curated feeds), or deploys features designed to encourage uninterrupted use (for example, autoplay, infinite scroll or re-engagement notifications).

On services meeting those conditions, access would depend on three age bands. Users aged 15 and above could hold independent accounts on services that should be safe for them. For 13- and 14-year-olds, a guardian could set up a limited account while retaining control, with parental tools permanently activated, parental approval of contacts and daily usage capped at one hour. Providers would also need to implement a mechanism to verify that the authorising adult holds parental responsibility, in addition to verifying the child's age.

Children under 13 could not hold accounts on those services. However, video-sharing platforms specifically designed for children under 13 could exceptionally permit controlled access through the guardian's own account, subject to strict requirements and a daily usage cap, with the guardian retaining the right to revoke access.

These age-based account restrictions would be distinct from the wider safety-by-design protections applying to all under-18s regardless of whether they hold an account.

In practice, the effective implementation of these age bands would depend on the deployment of robust age-verification systems capable of reliably distinguishing between the three tiers. Without sufficiently accurate and scalable verification mechanisms, the account restrictions risk remaining largely unenforceable.

Age assurance would carry implementation duties

Age assurance covers methods of establishing age or an age range. For the account restrictions, the proposal would require verification through the certified EU framework, using zero-knowledge proof technology that returns only a binary signal without identifying, locating or profiling the user. Other safeguards could rely on alternative methods meeting prescribed standards of reliability, proportionality, privacy and non-discrimination.

Affected providers would need to review existing accounts within six months after application and disable those where age requirements are not met or age cannot be established. Where providers already hold an age estimation based on multiple signals, fresh verification would not automatically be required.

At a practical level, each member state would be required to offer at least one free means of age verification. The Commission's proposed EU age verification app is presented as a bridge solution pending full deployment of the EU Digital Identity Wallet, with recommended national availability by end-2026. The regulatory framework governs how these systems must be designed, including the European Data Protection Board and Spanish Data Protection Authority (AEPD) requirements. Operating-system providers would also have duties to share existing age signals with user consent.

Safety by design would require product changes

For social networking and video-sharing services, the proposal would address how children experience the product. Autoplay and continuous feeds would need to be designed to allow effective breaks. Along the same lines, notifications designed to pull children back, and penalties for failing to engage regularly with the service, would be restricted. Time-management tools would also have to protect school time and core sleeping hours.

These design constraints extend to recommender systems, which would have to prioritise children's explicit choices and disable recommendations based on implicit engagement signals by default. They could not use personal data obtained outside the service. Children would need the ability to reset their preferences and select a feed free of profiling.

Protective defaults would switch off geolocation, tracking and push notifications. On the contact side, safeguards would require pre-approval of direct contact and limit the visibility of children's information. Transaction rules, in turn, would demand clarity about purchases and the real monetary value of virtual currency, together with safeguards against excessive or impulsive spending. The general safety-by-design obligation would also cover relevant services accessed without an account. Separately, for AI companions and general conversational chatbots, reuse of a child's previous conversations would be off by default unless necessary for safety. Providers would need safeguards against emotional dependency, pre-launch testing and ongoing monitoring. Embedded chatbots should not be activated automatically or promoted to minors.

Existing EU obligations would continue to apply

The proposal would specify and complement the Digital Services Act (DSA) and the AI Act. Article 28 DSA already requires proportionate safeguards on platforms accessible to minors, but the EU KIDS ACT would prescribe concrete measures and cover additional services. The July 2025 DSA guidelines address comparable safeguards but are non-binding. 

The General Data Protection Regulation (GDPR) would continue to govern the processing used to implement those measures. Article 6(5) of the proposal preserves parallel operation with article 8 GDPR, but that coexistence may create practical mismatches: a 15-year-old might qualify for an independent account yet still need parental authorisation for consent-based processing in a member state whose threshold is set at 16, or at 14 in the case of Spain.

The proposed verification duties would rest on their own legal footing and would not authorise unrestricted identity collection. Existing bans on profiling-based advertising to known minors and on exploitation of age-related vulnerabilities under the AI Act would remain in force.

Spain's lapsed bill leaves the next steps open

Spain keeps its 14-year threshold for consent-based processing under the Spanish Data Protection Act. The Spanish General Audiovisual Communication Act already requires covered video-sharing platforms to protect minors through age verification and parental controls, with the National Markets and Competition Commission, or CNMC, and the AEPD retaining their respective supervisory roles.

The Draft Organic Law on the protection of minors in digital environments, introduced in 2025, proposed raising the data-consent threshold to 16, requiring manufacturers of covered connected devices to provide parental controls activated by default, banning minors from accessing defined loot-box mechanisms, and introducing further audiovisual safeguards and enforcement reforms. That bill lapsed on 6 October 2026 following the dissolution of Parliament. A fresh government bill or parliamentary proposal could revive the measures.

Any revived Spanish measures would need reassessment against the final EU KIDS ACT, particularly where account-access ages diverge from the European framework.

Osborne Clarke comment

If the proposal is adopted in its current form, the key practical step will be mapping obligations to each service and its specific user journey. Among other things, businesses should distinguish between account eligibility, permission to process personal data and access to restricted content, since a single age threshold or parental consent screen will not necessarily address all three.

The draft envisages general application six months after entry into force, with compliance plans and audits for very large platforms applying from entry into force.