The internet spent years pretending its age limit was a birthday field and a button.
If you were born on January 1, 1900, apparently every website simply admired your longevity and carried on. Platforms could say children were not allowed, children could say they were adults, and everybody got to avoid the uncomfortable question of what enforcement would actually require.
That era may be ending.
According to a European Commission document reported by Reuters on September 14, the European Union is preparing a sweeping Kids Act that would restrict access to social media, video-sharing platforms, AI chatbots and online games for children under 15. The proposal is expected to be presented on September 17, and its details could still change before then.
The reported model is tiered. Children aged 13 and 14 could get limited, parent-controlled introductory accounts. Younger children would be restricted to tightly controlled child-friendly services, while platforms would be expected to avoid addictive design, improve reporting and parental controls, and verify ages when accounts are created. Game platforms would check age before downloads.
There is a straightforward appeal here. Asking technology companies to stop treating childhood attention as an open-pit mine is hardly radical. Infinite feeds, aggressive recommendations and AI companions were not designed after a quiet afternoon spent considering developmental psychology. They were designed to keep people engaged.
But an enforceable age limit introduces a second question: how does a website know that you are old enough?
A velvet rope for the whole internet
Age gates sound as though they apply to children. In practice, they usually require sorting everybody.
A platform cannot reliably identify its under-15 users without distinguishing them from its 15-, 25- and 65-year-old users. Depending on the system, that might involve identification documents, facial age estimation, a mobile carrier, a payment method or a digital credential. The policy is aimed at minors; the checkpoint is encountered by adults too.
That does not automatically make age verification a surveillance machine. The European Commission has already developed what it calls a privacy-preserving “mini wallet.” Its current technical approach is intended to prove only that a person is above a threshold—such as 13 or 18—without handing a platform their name, birth date or other personal details. The system became feature-ready in April 2026 and is designed to connect with future EU digital identity wallets.
On paper, that is the right instinct. A bartender needs to know whether you are old enough, not where you went to school or which videos you watched last Thursday.
The European Commission’s formal age-verification recommendation also calls for selective disclosure and says age-related information should not become another way to identify, locate, profile or track people. It explicitly discusses zero-knowledge proofs: a method of confirming a fact without disclosing the underlying personal data.
The harder part is not describing a good system. It is ensuring that every platform, proof provider and government keeps it good.
The Electronic Frontier Foundation takes the much darker view. Its age-gating resource hub argues that many systems rely on sensitive documents, biometrics or behavioural analysis, creating new opportunities for breaches, exclusion and surveillance. That criticism is not a verdict on the EU’s specific mini-wallet design, but it identifies the stakes if privacy promises erode during implementation.
A simple proof can still become a durable habit. Once the internet grows comfortable asking for age credentials at one door, lawmakers and companies may find reasons to ask at many more. A tool designed to reveal almost nothing could be surrounded by systems that record plenty.
Safety is more than a locked door
There is also a danger in treating access itself as the problem.
Young people use online spaces for entertainment, certainly, but also for friendship, education, identity and help they may not find nearby. The EU Agency for Fundamental Rights describes that tension directly: social platforms can expose children to exploitation, bullying, violent content and addictive design, while also supporting connection, information and self-expression.
The better parts of the reported Kids Act appear to understand this. Removing compulsive design, limiting unwanted contact, improving moderation and giving young users usable reporting tools target how platforms behave. Those protections could make the internet healthier without pretending that a fifteenth birthday turns someone into a fully patched adult.
Age limits are blunter. They may keep some children away from some harmful experiences. They may also send others toward smaller services with weaker moderation, encourage a lively market for borrowed credentials, or exclude young people whose families cannot or will not create supervised accounts. Enforcement will shape the result as much as the number printed in the law.
None of this is an argument for preserving the current shrug. Platforms have had decades to prove that a checkbox and vague parental responsibility were enough. Their products now follow children into bedrooms, classrooms and sleepless nights, with algorithms constantly learning which emotional button earns another minute.
Government has a legitimate reason to intervene. The question is whether it can regulate the machine instead of merely inspecting the passenger.
The Kids Act is still a proposal reported from a draft, not a finished law. It will require negotiation with EU member states and the European Parliament, and Reuters notes that the process could take many months. That debate should be treated as product design for public life: threat models, failure cases, accessibility and privacy guarantees included.
Europe may be about to put a bouncer at the internet’s door. The real test is not whether the bouncer can spot a child. It is whether the rest of us can pass without leaving a photocopy of ourselves behind.
