The EU Kids Act Explained: What It Means for Kids, Games and Private Servers

• 17 Sept proposal adopted
• 26 Nov feedback closes
• 15 age for your own social media account
• 6% maximum fine, of global turnover

If you play games online in the EU, a proposal published in September could change how you sign in, who can talk to you, and which games get made for your part of the world at all. It’s called the EU KIDS Act. The European Commission adopted it on 17 September 2026, and it’s open for public feedback until 26 November.

I’ve spent the last few days with the Commission’s own press release and Q&A, then lost an evening to the public feedback page. I came out of it with mixed feelings. The protections for kids in games are genuinely good, which makes it even more frustrating that the age-checking rules are drafted loosely enough to set off alarm bells across gaming right now. Here’s what’s actually in it.

What the EU KIDS Act Proposes

Its full name is Keeping Internet Digital Spaces Accountable and Trustworthy, and its official reference is COM(2026)681. It’s a proposal for a regulation, which means it would apply directly across all EU countries once agreed, rather than each country writing its own version.

The headline is a social media “delay”. Under the Commission’s plan, children under 13 couldn’t use social media at all. Between 13 and 15, they could only use a “mini account” set up and managed by a parent or guardian, with limited features and a one-hour daily limit. From 15, they could run their own account. If that sounds familiar, it’s the same worry behind Commodore’s new flip phone that can’t open social media, just tackled with a law instead of a handset.

To make that work, social media and video-sharing platforms would have to verify age whenever someone opens a new account, using an EU-certified method. Ticking a box or typing a birthday wouldn’t count. The Commission points to its own age verification app, which it says doesn’t keep identity documents or biometric data, and every EU country would have to offer at least one free way to verify age, including for people who don’t have a digital ID. For existing accounts, platforms would have six months to identify and switch off accounts under 15, as well as any accounts whose age they can’t establish.

The proposal also reaches well beyond social media. The Commission calls this wider net “Social Media+”, which includes video-sharing platforms, online games, app stores, operating systems, and artificial intelligence (AI) companions and chatbots. AI chatbots and companions would have to be off by default for kids and couldn’t be designed to make children emotionally dependent on them. Platforms would also have to prove their services are safe, rather than regulators having to prove they aren’t, with the biggest companies submitting compliance plans for independent audits. Fines could reach 6% of a company’s worldwide annual turnover.

What It Means for Games

This is the part I care about most, and it’s also where the text gets messy. Games don’t get a minimum age like social media does. Instead, the proposal says games have to provide a high level of privacy, safety, and security for minors, even if you can play without an account, and that they do so by treating every player as a minor until they can show otherwise. If a game has features kids aren’t allowed near, it needs proper age assurance to unlock them for adults.

The protections for kids are mostly sensible. Strangers wouldn’t be able to contact minors out of the blue or add them to group chats without consent, and microphone, camera, geolocation and contact syncing would be off by default. Mechanics built to keep kids playing compulsively, like punishing you for logging off, would be restricted, and push notifications would be off by default and blocked during sleep and school hours. App stores would have to apply age ratings (hello, PEGI, the Pan European Game Information ratings) and actually enforce them. Platforms that let players create and upload their own games would also need to give creators the tools to follow the rules.

The trouble is in the drafting. One clause states that access to online games for under-13s should be enabled only through specific parental tools. Policy analysts writing for the games industry have pointed out that this is vague enough that it could mean every online game has to check whether each player is under 13. That’s how “keep kids safe in games” could quietly become “everyone verifies their age to play anything online”, and it’s a fair thing to be worried about.

Interestingly, loot boxes only appear in the rules for social media and video-sharing platforms. The Commission has said its separate Digital Fairness Act is due later this year, so that fight probably isn’t over.

Why Gamers Are Angry

The reaction across gaming has been loud. Videos about the proposal from creators with huge followings have pulled in millions of views, some with titles claiming the EU is trying to destroy gaming. Ross Scott, who founded the Stop Killing Games campaign, has called it the most draconian proposal he’s seen regarding games and consumers, and argues it would require personal ID to play online, make private game servers illegal, and push the cost of releasing online games in Europe out of reach for smaller studios.

Some of that anger is earned. The ID worry stems from the “treat everyone as a minor” approach and that vague under-13 clause. The cost worry is real for small teams, because the obligations are written with platforms the size of Roblox in mind. The claim that private servers would be outright banned is harder to pin down in the text itself, though the definitions it hinges on are genuinely unclear, and the people who’d lose the most if they’re read broadly are preservationists running servers for games their publishers abandoned.

Private Servers Aren’t All Cosy Clubhouses

This is where I part ways with some of the loudest voices. A lot of people have been saying private servers aren’t a problem for kids’ safety. Maybe for them they aren’t. If your corner of the internet is a Discord full of adults running a server for a twenty-year-old shooter, that’s a lovely place to be. But it isn’t true across the board, and Roblox is the proof.

Roblox is facing an avalanche of lawsuits over child safety. Los Angeles County sued in February 2026, calling the platform a breeding ground for predators, and a string of US states have filed their own cases, from Louisiana in 2025 to Arkansas in June this year, which accused Roblox and Discord of acting as a “two-stage predatory pipeline”. More than 170 lawsuits from families have now been consolidated in a single federal case. Families allege predators used chat, friend requests and private servers to reach children and then pulled them into less-watched spaces. Roblox disputes many of these claims, and since January 2026, it has required facial age checks or ID to use chat.

Private spaces with thin moderation and lots of kids are exactly where the worst people go. Pretending otherwise doesn’t protect anyone. So I don’t think the answer is “private servers are fine, leave them alone”. The answer is rules that distinguish between a children’s platform full of invite-only rooms and a volunteer keeping a dead game alive for its adult fans.

Where I Land

Protecting children has to come first. There are vile people who go looking for kids in the places kids gather to play, and they’re very good at using exactly the features this proposal switches off by default, like a friend request from a stranger or an invite into a private group. They’re the reason the rest of us end up with ID checks and parental dashboards. This is why we can’t have nice things.

So I want the protections against unsolicited contact to survive, and I want the limits on compulsive design to survive too, because those mechanics hit neurodivergent kids especially hard.

I also want the proposal fixed before it becomes law. Asking every adult to verify their age to play anything online is a huge privacy ask, even with a privacy-preserving app, and it creates new barriers for disabled and neurodivergent adults who already find ID processes exhausting or inaccessible. The under-13 clause needs to say clearly what it means. Small studios need obligations they can realistically meet. And community-run servers need a path that’s proportionate to the risk they actually pose, rather than being treated as if they were a multinational platform.

To come to a genuinely useful conclusion, people who care about games and people who care about kids (which is most of us, wearing both hats) need to tell the Commission specifically what to keep and what to change.

How to Have Your Say

The Commission’s feedback period is open until midnight Brussels time on 26 November 2026, and more than 1,100 responses had already come in when I checked. Of the 100 most recent, 91 were from EU citizens; more than half mentioned games, and 22 specifically mentioned private servers. Gamers are clearly showing up.

If you want to add your voice, it helps to be specific. Name the part you’re worried about, such as age checks for online games, the under-13 clause or community servers, and say what you’d change. Say what you support, too. Feedback that only says “scrap it” is easy to set aside, while feedback that says “keep the contact protections, fix this definition” is much harder to ignore. You can give feedback on the EU KIDS Act here.

This is a proposal. The European Parliament and the Council of the European Union still have to negotiate it, a process that usually takes between eight months and two years, and the text will change along the way, so get your feedback in while you can.

Stay unruly.