Age assurance: EU Plan Bars Under-13s, Tests Kids' Privacy

Nearly eight in ten European kids between ten and fifteen have already slipped past the age limits on their apps. Most of them didn't hack anything. They just typed in a fake birthday.

If you've got a kid with a phone, this story is

If you've got a kid with a phone, this story is about your family. And if you've ever tapped "I'm over eighteen" on a website, it's about you too. Europe wants that little checkbox gone. On 09/17/2026, the European Commission formally proposed something called the KIDS Act. According to Biometric Update, it pushes mandatory age checks across social media, app stores, video games, and A.I. services. Kids under thirteen would be barred from having accounts at all. Older teens would get tiered access, with more features unlocking as they get older. App stores would have to check age before a download. Underneath, the real question isn't whether to check ages. It's this. How do you prove someone's age without learning who they are?

Start with that fake birthday. For years, the whole system ran on the honor code. A ten-year-old picks a year from a dropdown menu, and the app believes it. With almost eight in ten kids getting around it, lawmakers decided the honor code is finished. That forces every platform toward something stronger. So what counts as stronger?

The E.U. has a first choice. It's called the European Digital Identity Wallet. That's a government-backed app that holds verified details about you on your own phone. The idea is that it confirms one fact, old enough, or not, without handing over your name or your face. Under the E.U.'s design, platforms wouldn't store your biometrics or copies of your I.D. Regulators call that the strongest privacy protection available. For the rest of us, it means your kid's passport photo wouldn't end up sitting on a gaming company's server.

The catch is timing

The catch is timing. According to industry critics, those wallets don't exist at scale yet. Most people don't have one. A privacy shield nobody owns doesn't protect anybody.

That leaves platforms staring at a faster, cheaper option. Facial age estimation. You look into your camera, and software guesses how old you are from your face. No I.D. required. Regulators, though, have explicitly warned against processing identity documents and Fingerprint Scanner Gel Fingers Fool It 70 Of The Time data. If a company does scan faces, the guidance points to strict limits. No identifying the person. Deleting the image quickly. Keeping the processing on the device itself, and encrypting everything. All of that's technically possible. It's also expensive and hard to run well. For a parent, that means the selfie your teenager takes to open a game could be handled carefully, or not, depending on who built the game.

And who builds the game matters a lot. A giant platform can afford several verification systems running side by side. A three-person game studio can't. Analysts expect smaller developers to pick whatever's easiest and hope they're not first in line for scrutiny. For compliance teams, the sharper risk is liability. Outsource the check to a third-party age service, and you've added a new company to your chain of responsibility. If that vendor mishandles a child's face scan, the question of who's accountable gets messy fast. Which means the safety of your child's data could depend on the size of the company behind the app.