In the first part of this series, we looked at a broader shift taking place around the world: governments are moving from voluntary approaches to more defined rules around children’s access to digital services.
The European Union’s newly proposed KIDS Act takes that shift a step further.
It does not simply establish age limits for social media. It asks platforms to demonstrate that the services they provide are appropriate for children and safe by design.
That distinction matters. Because once governments move from “you should keep children safe” to “you must demonstrate that you are keeping children safe,” compliance becomes something that needs to be measured, documented and independently assessed.
The question is no longer simply whether a platform has safety measures. Can it prove they work?
From Policy to Proof
The EU KIDS Act proposes common age rules across the European Union, including no social media accounts for children under 13, parent-supervised access for 13- and 14-year-olds, and autonomous accounts from age 15. But age restrictions are only one part of the proposal.
The legislation also introduces safety-by-design requirements covering the digital services children use, including social media, video-sharing platforms, online games, AI chatbots and app stores.
These requirements address issues such as addictive design features, recommender systems, unwanted contact, privacy settings and parental controls. This creates a much more complex compliance question.
A platform could potentially say: “We have an age policy.”
But under the proposed framework, that would not necessarily be enough.
The bigger question becomes: “Can you demonstrate that your service actually operates in accordance with that policy and the requirements of the regulation?”
The Burden of Proof Is Changing
One of the most significant elements of the KIDS Act is its approach to the burden of proof. The European Commission describes the proposal as reversing the burden of proof. Providers of very large online platforms would have to demonstrate that their services meet the requirements rather than leaving regulators to establish that a service is unsafe.
For very large online platforms, defined by the Commission as those with at least 45 million active monthly users in the EU, the proposed framework would require a compliance plan before their services come into contact with children under the new regime.
Those plans would be independently audited at the platform’s expense, with the Commission able to object where an auditor’s independence is not assured.
That represents an important change in the relationship between platforms and regulators.
Instead of waiting for harm to occur and then asking what went wrong, regulators are moving toward a model where platforms are expected to demonstrate compliance proactively.
What Would a Platform Actually Have to Demonstrate?
The answer is broader than age verification. Under the proposal, platforms would need to address several interconnected areas of online safety.
- Age Assurance
Self-declared age would no longer be sufficient under the proposed rules for services subject to the age restrictions.
The Commission says platforms would need to verify the age of users creating accounts and check existing accounts once the rules take effect. The proposed approach is designed around privacy-preserving age verification, including certified third-party solutions that can establish whether someone is above or below a threshold without revealing their identity or exact age to the platform.
That creates an important distinction between knowing who someone is and knowing whether they meet an age requirement.
The Commission has already been developing an EU-wide approach to anonymous proof-of-age technologies, with Member States encouraged to make age verification available by the end of 2026.
- Safety by design
Age assurance is only one layer. The proposed Act would also require services to be designed with children’s safety in mind. That includes measures addressing addictive design, recommender systems, privacy settings, unwanted contact and parental controls.
This changes the compliance question again. A platform may be able to demonstrate that it knows a user’s age. But can it also demonstrate that the experience being provided to that user meets the required safety standards?
- Evidence and Documentation
This is where compliance becomes more than a policy statement. Large platforms would have to provide a detailed compliance plan explaining how they intend to meet the obligations of the Act, with independent auditors assessing that plan.
In other words, compliance increasingly requires an evidence trail.
- Policies need to connect to technical controls.
- Technical controls need to produce evidence.
- Evidence needs to be available for assessment.
- And assessments need to be capable of standing up to regulatory scrutiny.
Compliance Cannot Stop at the Policy Document
This is perhaps the most important shift for organizations operating digital services.
- A written policy can establish an intention.
- A technical control can establish an action.
But neither necessarily demonstrates an outcome. Consider age restrictions as a simple example. A platform could publish an under-13 policy. It could introduce an age-verification process, but regulators may ultimately need to understand whether those measures are actually being applied, whether existing accounts are being checked, whether underage accounts can be identified and reported, and whether the controls continue to operate as intended.
That is a very different compliance model from simply publishing a policy. It moves toward continuous, evidence-based compliance.
The Role of Independent Verification
The KIDS Act also highlights another important development: regulators are not necessarily expected to take every platform’s word for it.
For very large platforms, independent auditors would play a role in assessing compliance plans.
That creates another layer in the regulatory chain:
The more sophisticated digital regulation becomes, the more important each step becomes. And that raises an important question. What happens when the evidence doesn’t demonstrate compliance?
When Proof Isn’t Enough
A compliance framework ultimately has to answer what happens when an organization cannot demonstrate that it is meeting its obligations.
The KIDS Act proposes to use existing enforcement structures under the Digital Services Act and, for AI companions and chatbots, the AI Act. The European Commission would directly supervise very large online platforms and certain AI systems, while national authorities would have responsibilities for other services covered by the framework.
The proposed framework also includes expedited enforcement procedures, with the Commission targeting preliminary findings within 30 days and final decisions within 90 days for services it directly supervises. Fines could reach 6% of worldwide annual turnover.
This is where the conversation begins to move beyond compliance.
Because if a regulator can establish that a service is not meeting the requirements, the next question is no longer: “What does the platform say it is doing?”
It becomes: “What happens next?”
The next challenge; turning regulatory decisions into action This is where the broader regulatory story becomes particularly interesting.
- Governments can establish rules.
- Regulators can define requirements.
- Platforms can implement controls.
- Auditors can assess evidence.
But there is still a final step between a regulatory decision and its practical impact. That is enforcement. As more governments introduce rules governing digital services, that gap between regulation and enforcement could become increasingly important.
The KIDS Act is therefore not just a story about age restrictions or social media. It is part of a larger evolution in digital regulation: one where compliance must be demonstrable, evidence must be verifiable, and regulatory decisions increasingly need mechanisms for practical implementation.
What Does “Compliant” Look Like in Practice?
That may be one of the defining questions of the next phase of internet regulation.
It is relatively straightforward to write: “This service must comply.”
It is considerably more complicated to establish:
- What compliance looks like technically
- How compliance is measured
- How evidence is collected
- Who independently verifies it
- How regulators identify non-compliance
- What happens after a violation is established
- And how a regulatory decision ultimately becomes enforceable
The EU KIDS Act is beginning to put structure around many of these questions. But it also highlights the question that comes next.
Once a regulator determines that a digital service is not complying, how does that decision become a real-world digital outcome? That is where the conversation moves from proof to enforcement.
And that is the subject of the next part of this series.
This is Part 2 of our series exploring the evolving relationship between digital regulation, compliance and enforcement. In Part 3, we will look at what happens when a regulator determines that a platform is not complying, and how regulatory decisions can lead to practical enforcement.