Much of the debate about the proposed EU KIDS Act centres on children’s access to social media, warns Lawyer Peter Caddock in an opinion piece for Euronews. However, in addition to the platforms in question, companies whose services are not aimed at children could also face new obligations.
Much of the debate about the proposed EU KIDS Act has focused on children’s access to social media. However, its implications reach well beyond these platforms. Businesses offering online discussion groups, video games or AI chatbots could also face new obligations, even if their services are not aimed at children.
ADVERTISEMENT
ADVERTISEMENT
The proposed act would introduce age restrictions, stronger age checks and requirements to build child protections into digital services. Its final form is still being negotiated, but it raises important questions for business leaders: what would need to change, and how can safeguards be effective without undermining the services customers value?
When does an AI chatbot become a companion?
The proposal covers AI companions and general conversational chatbots. An AI companion is defined around ongoing, personalised interaction that simulates or encourages a social, emotional or interpersonal relationship. This could extend beyond products marketed as virtual friends.
Consider a customer service chatbot that greets someone by name, remembers previous exchanges and offers reassurance. That does not automatically make it an AI companion, but it illustrates the need for a clear demarcation between helpful personalisation and relationship-building.
Proposed safeguards include preventing features likely to create emotional dependency, alongside testing and monitoring duties. But how should providers assess dependency? Reassurance that is routine for one user could be particularly significant for an isolated teenager. Making every chatbot impersonal is not necessarily the answer. Businesses therefore need clear standards that distinguish useful support from harmful attachment.
Overlap with existing EU regulation
The KIDS Act would build on the Digital Services Act's protections for minors, while extending obligations to services outside its scope. It would also sit alongside the AI Act, audiovisual media rules and consumer protection legislation. Businesses would need to assess these requirements together, rather than build separate compliance programmes for each.
Age checks also raise data protection questions. Providers must consider what personal information they need, whether they have a lawful basis to use it, and how much they retain or share. Protecting children should not mean collecting unnecessary information about all users.
Solely automated decisions that significantly affect access to a service may trigger additional GDPR safeguards. There is no blanket ban on automated decisions involving children, but their particular protections require careful consideration. Access restrictions must also respect children's freedom of expression and access to information.
What will digital services providers need to change?
An adult-focused community, such as a parenting forum, cannot necessarily rely on its intended audience to avoid duties towards children. Smaller businesses should not assume they are exempt either. Depending on the service, compliance could require changes to registration, content access, default settings and interface design.
The proposal distinguishes between different types of age assurance. Age verification would require a certified third-party solution; other forms of age assurance could use other methods that meet the legal requirements. Simply asking users to declare their age would not be sufficient.
Addictive design presents another challenge. More time spent on a service may indicate harmful engagement, but it could also reflect usefulness or enjoyment. Providers need clear risk indicators and proportionate testing expectations, rather than an obligation to predict how every child might respond.
For business leaders, preparation should start with mapping potentially affected features, assessing children's access and identifying where product design and data protection requirements intersect. This should involve legal, product and technology teams, not just compliance specialists. Early planning can help avoid rushed changes that disrupt services or user relationships.
Even if the legal uncertainties are resolved, effectiveness remains a separate question. Saying no to a teenager does not mean the restriction will be respected. Getting a law that is legally workable is part one. Part two is making sure it delivers meaningful protection in practice.
Peter Caddock is a Partner at international law firm Osborne Clarke, specialising in artificial intelligence (AI), privacy and data protection. An award-winning lawyer with more than 16 years’ experience, he advises clients across the EU and beyond on the legal and regulatory challenges associated with emerging technologies. With a background in software development, Peter Caddock brings a strong technical understanding to his legal practice.