Interaction with GDPR
Operators of in-scope services should note the separate requirements of the KIDS Act and the GDPR. While the KIDS Act introduces new age-based restrictions and requirements, the GDPR already provides for a minimum age at which children can consent to the processing of their personal data in relation to an information society service, which is a commercial service provided by electronic means at the individual request of the service recipient. The GDPR sets this minimum age at 16, but it gives member states the ability to set a lower age, provided that this is not lower than 13. Under the UK GDPR, the age is 13. GDPR compliance continues to be enforced by the national data protection authorities, with the maximum fine for processing without valid consent being €20 million or 4% of worldwide annual turnover.
Enforcement and penalties
The KIDS Act builds on the existing enforcement frameworks of the DSA and the EU AI Act. The enforcement framework will depend on the type of service.
- Online social-networking services, video-sharing platforms, video gaming platforms, and app stores will be supervised under existing DSA frameworks. The national digital services coordinators will be primarily responsible for enforcement, and the European Commission will directly supervise the most widely-used platforms, ie those designated as Very Large Online Platforms (VLOPs). VLOPs are subject to stricter requirements, including obligations to submit an audited compliance plan and pay an annual supervisory fee to the Commission. Fines under the DSA amount to 6% of worldwide annual turnover for VLOPs.
- AI companions and conversational chatbots will be supervised under the EU AI Act. The European Commission and the EU AI Office will act as supervisory authorities. Fines for non-compliance can reach up to 6% of worldwide annual turnover.
- Video games will be supervised by authorities designated by Member States which will also decide on the level of penalties.
What is the position in the UK, Australia and EU member states?
The KIDS Act’s approach of setting age-based bans contrasts with the current UK position under the Online Safety Act (OSA), which takes a duty-of-care, outcomes-focused approach intended to protect children from harmful content. However, the UK government has proposed a social media ban for under-16s plus restrictions on harmful functions such as stranger communication, and “romantic companion” chatbots.
Protection of children online, including through age verification and safety by design, has also been a key government and legislative priority in Australia. In December 2025, Australia became the first country to implement restrictions on social media for children, requiring providers of certain platforms to take “reasonable steps” to prevent Australians aged under 16 from having accounts. Guidance from Australia’s online safety regulator, the eSafety Commissioner, has clarified that "reasonable steps" include implementing robust age assurance measures that are reliable, privacy-preserving and proportionate. The eSafety Commissioner’s enforcement options include a civil penalty up to AUD$109.2 million (approximately €68.5 million or £57.4 million). Enforcement has been active, with the Commissioner investigating potential non-compliance by several large social media companies.
Further, the Australian Government has recently introduced a bill that would create a new wide-reaching “digital duty of care”. This duty would apply broadly to providers of online services in Australia, and would require those caught by the obligations to ensure, so far as is “reasonably practicable”, a “safe online environment”. Finally, in December 2026 the Office of the Australian Information Commissioner is due to finalise a mandatory Children’s Online Privacy Code that will apply to online services likely to be accessed by children, including social media, apps, games, educational tools and websites.
In addition, a number of EU member states have already proposed national legislation introducing comparable bans and restrictions. These may now be superseded by the proposed KIDS Act, particularly as the proposal expresses concern about the inconsistencies that multiple national laws would cause.
Status of the KIDS Act
The proposals for the KIDS Act and the new UK restrictions need to go through their respective legislative processes before they become law. Once the KIDS Act is finalised and published in the EU Official Journal, most obligations will come into force six months later. In addition, the European Commission is due to publish its proposal for a Digital Fairness Act, which will strengthen consumer protection law, including in the digital environment, by the end of 2026.
In the meantime, organisations should ensure that they comply with applicable legislation that is already in force, including the EU AI Act, DSA, GDPR/UK GDPR, the UK OSA as well as the Australian social media restrictions. They should also monitor the progress of the EU, UK and Australian proposals, identify whether their services are in-scope and prepare to comply with any applicable obligations.
You can access our Online Safety Act Gauge here, designed to help buisnesses quickly assess their obligations under the OSA.
