The EU Wants Under-15s Off Social Media And AI Chatbots

The European Commission is proposing to restrict under-15s from social media, video-sharing platforms, AI chatbots and online games, in the most sweeping child protection plan the bloc has attempted.

The measures form part of an EU Kids Act, presented on 17 September by Commission President Ursula von der Leyen and technology chief Henna Virkkunen. Von der Leyen trailed elements of it in her State of the Union address the previous day.

Access would be tiered by age. Under-3s would have none. Children aged 3 to 12 would be limited to child-friendly accounts under parental control. Those aged 13 and 14 could hold accounts only with parental consent and controls in place. From 15, users could open their own accounts, with services aimed at 15 to 18-year-olds expected to meet new safe-by-design standards.

Platforms would be required to verify the age of anyone opening an account, potentially through EU age-verification tools or approved national systems meeting privacy and security standards. They would also have to provide effective parental controls, straightforward routes for children to report harmful content, and measures against addictive design.

Companies covered by the legislation would pay a supervisory fee to help fund Commission enforcement.

Named services include Meta's Facebook and Instagram, TikTok, Google's YouTube and ChatGPT. For online games and AI chatbots and companions, the draft describes tailored commitments and a co-regulatory approach based partly on industry-led self-regulation.

The proposal is not yet law. It must be negotiated between member states and the European Parliament before adoption. Parliament passed a non-binding resolution in November 2025 calling for a harmonised minimum age of 16, supported by 483 votes.

The supervisory fee is the quiet structural change in this proposal.

Age limits generate the headlines, and most large platforms already claim a minimum sign-up age of 13. The Commission's evident view is that asking users to tick a box has not worked, which is why verification moves from self-declaration to documented checks. That is a meaningful shift, but it is a shift in degree.

Making covered companies pay a fee that funds the Commission's own enforcement is a shift in kind. Brussels has been criticised for years for writing digital rules faster than it can police them, because the online environment moves quicker than public administration can staff for. A levy on the supervised population removes the budget constraint from the equation and makes enforcement capacity scale with the size of the industry being enforced against.

It is also the provision the industry will fight hardest, precisely because it outlasts any particular rule. Age thresholds can be renegotiated. A funded regulator compounds.

The second thing worth noting is timing. This arrives three weeks after Meta agreed to pay up to $18 billion and impose a default two-hour daily cap on under-18s across Facebook and Instagram, settling claims from 47 US states. Brussels is proposing by statute what American attorneys general extracted through litigation, and it is proposing it on tighter terms.

The inclusion of AI chatbots is the part that will matter longest, and it arrives before anyone has agreed what the harm is.

Social media has a decade of accumulated evidence, litigation and internal research behind the case for restricting it. AI companions have almost none. They are new enough that the regulatory instinct here is precautionary rather than evidential, which is defensible but unusual for Brussels, and it is why the draft handles chatbots differently. Social platforms get binding age verification. Games and chatbots get tailored commitments and industry-led self-regulation.

That gap is where the lobbying will happen over the next eighteen months.

There is also an unresolved tension with the EU's own privacy tradition. Verifying that a user is over 15 means establishing identity for everybody, including adults, because a platform cannot confirm a negative without checking. Brussels is aware of this, which is why the draft leans on government-issued digital wallets rather than platform-run checks. Whether a system that requires state identity infrastructure to open a social media account sits comfortably alongside GDPR is a question the negotiation will have to answer.

For India the comparison is instructive and slightly deflating. The DPDP Act already prohibits behavioural tracking and targeted advertising directed at anyone under 18, with no parental consent exception and penalties reaching ₹200 crore. On substance that is stronger than what Brussels has drafted, because it attacks the business model rather than the clock.

What India lacks is the enforcement machinery. The EU is proposing that platforms fund the regulator that supervises them. India's Data Protection Board has no comparable funding mechanism and a compliance runway extending to 2027. The rule is better. The apparatus behind it is not.

For daily, sharp analysis of the biggest moves in the Indian business and startup ecosystem, follow StartupFox.