The debate around the proposed EU KIDS Act has largely centred on restricting children's access to social media platforms. Yet the regulation's reach is considerably wider. Companies operating online discussion groups, video games, or AI chatbots could find themselves subject to new legal duties, even when their services are not explicitly aimed at minors.
The draft legislation, still under negotiation in Brussels, would introduce age limits, more robust age verification, and requirements to embed child safety into the design of digital products. For business leaders across the EU, the question is no longer whether change is coming, but what exactly will be expected of them—and how to comply without alienating the users their services are built for.
When does a chatbot become a companion?
The proposal specifically targets AI companions, defined as services that offer ongoing, personalised interaction simulating or encouraging a social, emotional, or interpersonal relationship. This definition could extend well beyond products marketed as virtual friends. A customer service bot that remembers a user's name and past queries, and offers reassurance, might not automatically qualify as an AI companion—but it illustrates the fine line between helpful personalisation and relationship-building.
Proposed safeguards include preventing features likely to foster emotional dependency, alongside testing and monitoring obligations. But how should providers assess dependency? A routine reassurance might be harmless for one user, yet deeply significant for an isolated teenager. Stripping all personality from chatbots is not a realistic solution. Businesses need clear, workable standards that distinguish supportive interaction from harmful attachment.
The KIDS Act would complement existing EU rules, including the Digital Services Act's protections for minors and the AI Act's risk-based framework. It would also intersect with audiovisual media regulations and consumer protection law. Companies will need to navigate these overlapping requirements as a coherent whole, rather than treating each as a separate compliance exercise.
Age verification raises its own data protection concerns. Providers must decide what personal information is genuinely necessary, whether they have a lawful basis to process it, and how long they retain or share it. Protecting children should not mean collecting excessive data on every user. Moreover, automated decisions that significantly affect access to a service may trigger additional safeguards under the GDPR. There is no blanket prohibition on automated decisions involving minors, but their heightened protections demand careful consideration. Any access restrictions must also respect children's rights to freedom of expression and access to information.
What will digital services providers need to change?
An adult-focused community, such as a parenting forum, cannot assume it is exempt simply because its intended audience is grown-ups. Smaller businesses should not presume they fall outside the rules either. Depending on the service, compliance could require changes to registration processes, content access, default settings, and interface design.
The proposal distinguishes between age verification and other forms of age assurance. Verification would require a certified third-party solution, while other methods might suffice if they meet legal standards. Simply asking users to declare their age would not be enough.
Addictive design presents another challenge. More time spent on a service could indicate harmful engagement, but it could equally reflect genuine usefulness or enjoyment. Providers need clear risk indicators and proportionate testing expectations, rather than an obligation to predict how every child might respond.
For business leaders, preparation should begin with mapping potentially affected features, assessing children's access, and identifying where product design and data protection requirements intersect. This should involve legal, product, and technology teams—not just compliance specialists. Early planning can help avoid rushed changes that disrupt services or user relationships.
Even if the legal uncertainties are resolved, effectiveness remains a separate question. Saying no to a teenager does not mean the restriction will be respected. Getting a law that is legally workable is part one. Part two is making sure it delivers meaningful protection in practice.
