Please find below the European Data Protection Supervisor’s (EDPS) latest press release, dated 13 November 2026, titled: EDPS supports EU KIDS Act aims and calls for safety by design for all users.
On 17 September 2026, the European Commission presented its proposal for the EU KIDS Act (‘EU Keeping Internet Digital Spaces Accountable and Trustworthy’). In its Opinion published on 12 November, the European Data Protection Supervisor (EDPS) strongly welcomes the proposal’s objectives of protecting children online and preventing regulatory fragmentation in the EU single market. At the same time, it invites the European Parliament and the Council, as co-legislators, to carefully consider which features of the services concerned require age assurance, and where ‘safety by design’ for all users would also be effective.
Under the Charter of Fundamental Rights of the European Union, children have a right to the protection and care necessary for their well-being. Several Member States are drafting national laws limiting minors’ access to certain online services, so an EU-level response is needed to avoid divergent rules.
The EDPS welcomes the proposal’s emphasis on safety by design and efforts to minimise the interference with fundamental rights, including the rights to privacy and data protection. It especially welcomes the requirements that age assurance and parental verification solutions may not be used to identify, locate, track, target, advertise to or profile users. It also welcomes that age assurance solutions should be based on state-of-the-art privacy-enhancing technologies including zero knowledge proof, which let people prove they meet an age threshold without revealing their age or identity.
Wojciech Wiewiórowski, Supervisor, said: “Protecting children online must be a priority and Europe needs a common approach. That approach should both be effective and minimise interference with fundamental rights to the greatest extent possible. I would like to see safety by design for everyone, with age assurance deployed only where it is really needed and proportionate, so that the safety of children is protected while fundamental rights are preserved.”
Protecting children should not necessarily mean locking them out of the digital environment and its potential benefits. The co-legislators should carefully consider where age assurance is really required and when risks for minors can be effectively addressed with safety by design measures that benefit all users, in combination with other measures such as additional reporting functionalities for minors, complementary tools for guardians and digital literacy initiatives.
The age limits set by the proposal would apply alongside the GDPR’s age of consent for the processing of personal data, which allows for differences between Member States. To avoid duplication of age assurance checks and maximise harmonisation in the EU single market, the EDPS recommends amending the GDPR so that a single age of consent applies to all information society services in the EU.
The EDPS stresses the need to take into account the maturity and availability of age assurance solutions that provide a high level of privacy and data protection. Age assurance and parental verification obligations under the proposal should only enter into application when the privacy-preserving solutions envisaged by the proposal are effectively available across the EU.
Age estimation should only be allowed where sufficient safeguards ensure that the privacy, safety and security of individuals are not weakened. Algorithmic age estimation and other intrusive practices should be expressly excluded.
To ensure effective supervision, the EDPS recommends establishing a legal basis for cooperation between the various competent authorities under the proposal, including for the exchange of confidential information obtained in the context of any audits and investigations.
Questions can be directed to press@edps.europa.eu.