Europe Wants Age Checks Without an Identity Database
Matthew Mbaka · September 19, 2026 · News
Europe’s latest plan for protecting children online starts with a difficult promise: prove a user’s age without turning every social platform into an identity database.
The European Commission proposed the KIDS Act on September 17. It is not law yet. It still needs to move through the EU legislative process, and its final wording could change.
If adopted as proposed, children under 13 could not hold social media accounts. Thirteen and 14 year olds could use parent-supervised accounts with limits, including a daily cap of no more than one hour and parental approval of contacts. Independent accounts would begin at 15.
The proposal also reaches beyond social media. It covers risky features in video services, games, app stores and AI chatbots used by minors.
The age check is supposed to reveal almost nothing
The Commission says platforms would not inspect passports or learn a user’s identity. Instead, a certified service would confirm the person’s age and send the platform a simple result.
In other words, the platform should learn that a person is above or below a threshold, not their name, birthday, address or document number.
The EU already has an open-source age-verification blueprint in testing. It separates the organization that verifies age from the service that receives the proof. Each proof is meant to be used once so it cannot become a tracking identifier across websites.
The KIDS Act goes further by requiring zero-knowledge proof technology and at least one free verification option in every member state, including for people who do not have a digital ID.
Those protections sound strong on paper. Implementation will decide whether they hold up. A privacy-preserving protocol can still sit inside a poorly secured app, and any system that checks age will attract attempts to bypass or abuse it.
The proposal is also about product design
The visible argument will be about age limits. The more ambitious part is what platforms would have to change for young users.
The Commission’s KIDS Act explainer says services could not use endless autoplay, streak penalties or unrelated notifications to pull minors back into an app. Behavioural personalization would be off by default, and children would need an option to use a feed without profiling.
Private messages from strangers would require approval. Minors would not appear in contact suggestions, and livestreaming would be off by default.
AI companions would face their own rules. They could not be designed to create emotional dependency, and they would need child-safety testing before release and monitoring afterward.
Large platforms would have to show how they meet the rules before reaching children. Independent audits would be paid for by the platforms, with the Commission able to object if an auditor is not sufficiently independent. Fines could reach six per cent of worldwide annual turnover.
What Canada should take from it
Canada does not automatically inherit these rules through closer ties with Europe. Mapletechie has already explained why proposed Canada-EU cooperation would not import European internet law.
Canada can still borrow the useful parts.
The first is data minimization. If a platform only needs to know whether someone is old enough, it should not receive a copy of that person’s identity document.
The second is separation. The organization checking age should not be able to build a list of every service a person visits, and the platform should not be able to trace a proof back to a government record.
The third is accountability for design. Blocking a false birthday does little if the product still pushes a child toward strangers, compulsive use or invasive profiling.
The KIDS Act will face political, technical and legal tests before it can take effect. Its most useful idea is already clear: age assurance does not have to mean handing more identity data to the companies being regulated.
Tags: EU KIDS Act, age verification, online safety, privacy, Canada