The European Commission's proposed EU KIDS Act seeks stronger online safety protections for children engaging with digital services like gaming and social media. However, the requirement for age verification could lead to widespread collection and retention of sensitive identity information, posing significant privacy risks for young users.
- EU KIDS Act restricts social media accounts for under-15s and tightens gaming platform rules
- Age verification may require processing sensitive data like government IDs and biometrics
- Security breaches risk rises with third-party providers handling personal identity data
What happened
The European Commission has proposed the EU KIDS Act to strengthen protections for children on digital platforms, including social media, online gaming, and AI chatbots. This legislation introduces stricter requirements for age verification and privacy safeguards aimed at preventing underage access to inappropriate content and services. It particularly targets services popular with young gamers, limiting independent accounts for children under 15 and mandating enhanced privacy and safety measures.
However, the Act also brings forward practical challenges in implementing age verification. While the EU encourages privacy-preserving solutions that confirm users’ ages without excessive data collection, some verification methods may still necessitate gathering sensitive information such as government-issued IDs or biometric data. These requirements could expose young users to risks associated with data breaches, especially when third-party providers are involved in the process.
Why it matters
Collecting and processing personal data like names, birthdates, photos, and biometric identifiers creates heightened vulnerability for young users if that information is mishandled or compromised. A notable example occurred in October 2025 when Discord experienced a security breach exposing government-issued ID photos of approximately 70,000 users handled by a third-party customer support provider. This incident underscored the risks of outsourcing sensitive data processing and the difficulties in safeguarding children's privacy across digital platforms.
European regulators acknowledge these risks and emphasize principles such as data minimization and proportionality in age verification procedures. Yet, implementing these principles consistently across a diverse gaming ecosystem—ranging from large multinational platforms to smaller developers with limited resources—remains an ongoing challenge. The security implications extend beyond the original platform when multiple services rely on the same verification providers.
What to watch next
The European Commission has developed a privacy-preserving age verification framework intended to enable users to demonstrate their age without exposing unnecessary personal data. How effectively this framework is adopted and enforced across gaming and social media platforms will be critical. Stakeholders should monitor whether providers maintain strict data security, limit data retention, and refrain from repurposing collected information beyond age verification.
Further scrutiny is needed on the role of third-party verification providers, as these entities represent a potential single point of failure affecting multiple platforms if compromised. Regulators, platform operators, and users alike will need to balance increased child protection measures with robust privacy safeguards to prevent unintended harms arising from the EU KIDS Act’s implementation.