A pocket guide to the EU Kids Act: What games companies need to know

• The proposed Kids Act specifically brings video games, video game platforms and online games into its scope.
• Games would need to provide a high level of privacy, safety and security for minors, including for users accessing games without an account.
• The proposal could affect mobile mechanics such as daily streaks, engagement rewards and re-engagement notifications.

Veronica Perez Lima is a policy advisor at Flux Digital Policy.

Last week the European Commission published its proposal for the EU Keeping Internet Digital Services Trustworthy & Accountable Act (hence, Kids Act) - legislation intended to regulate the design of and access to certain online services for minors across the EU.

It’s 99 pages long and pretty dense, so for those of you who (understandably) don’t fancy trying to wade through it, here’s the gist of what it says about games and what the impact could be on mobile in particular.

New legislation? Why?

The new draft legislation is a response to the increasing calls to keep kids safe in online spaces. Member States such as France, Italy, Norway and Greece have already been working on their own laws, while advocating for measures at the EU level. While obligations are very likely to change during the legislative process, the proposal sets the direction.

Are games in scope?  

The scope of the Act follows a “social media plus” scope, as recommended by an EU child safety panel (we wrote about it here). The Act specifically includes ‘video games’, ‘video game platforms’, and ‘online games’ (which is an overarching term for the first two).

Not every clause applies to games, but many of the clauses that do apply are scattered throughout the document. That’s important to note because although there is a specific ‘online games’ section (Article 15), that’s not the only bit you need to know about.

Are there blanket age restrictions?

Sort of.

Unlike social media and video-sharing platforms, games don’t have a default minimum age, but must provide a high level of privacy, safety and security for minors, even where the game can be accessed without an account. To do this, they must assume that all users are minors until they can properly prove otherwise.

If you want to use features that minors aren’t allowed to access (see below for more), then you’ll have to include age verification either to ‘unlock’ them for adults or to prohibit kids entirely. You can’t rely on T&Cs or self-reporting, but the “if your account is 18, you probably are” approach is ok in some circumstances. Otherwise, you’ll need to implement a suitable age assurance solution.

If your game doesn’t have any of the age-restricted features, then there’s a chance you may still need age verification. The video games section says that as part of safety-by-design, providers need to ensure that “access to [online games] for [under-13s] is only enabled and controlled by means of [specific parental tools].” The drafting is ambiguous, but it could mean that all games must check whether their users are under-13, so that they know whether to allow them access in their own right or whether to obtain parental approval.

In an area with far more certainty, the Act mandates age-ratings for online video games (actually, all ‘software applications’). App stores would be required to apply an age-rating system (hi, PEGI!) to applications, including games, and enforce those ratings by preventing minors from accessing or purchasing applications that are inappropriate for their age. There doesn’t seem to be a carve-out for parental approval of higher-rated games, and the criteria for appropriate age ratings systems covers both content (violence, swearing etc) and game features (monetisation, comms features).

Video game platforms that allow users to create and upload games, must provide the necessary tools to allow those creators to meet their obligations: the creator has a responsibility to comply, but the platform needs to make sure that creators can actually do so.

What features are age-restricted?

Ensuring high levels of privacy, safety, and security for minors, video games to prohibit or restrict access to certain features. Broadly, this includes:

Preventing unsolicited contact, prohibiting minors from being included in contact recommendations or added to group chats without explicit consent, as well as safeguarding minors from being redirected to external services. This is particularly relevant for titles featuring communication tools. Additionally, games must, by default, disable geolocation, camera, microphone access, contact synchronisation, and account recommendations.

Most significantly for mobile, the Act prohibits exposing kids to features that are “intended, or can reasonably be foreseen, to encourage compulsive or excessive use,” with a blanket prohibition on access to specific game mechanics. This includes the use of features that make it difficult for minors to stop playing and certain types of notification. Techniques that penalise disengagement (losing progress by being away) are covered, and some that reward engagement (daily streaks, engagement rewards, and re-engagement notifications) may also be affected. Also, push notifications must be off by default and designed not to interfere with sleep or school hours.

Ultimately, video game providers will need to assess both the impact of their design choices as well as the explicit prohibition of specific features. 

Although the explanatory introduction mentions loot boxes and virtual currencies in games, they’re only in the actual legislation for social media and video sharing platforms. This could indicate that the Digital Fairness Act will cover it (likely to a stricter degree than the Kids Act) or reflect that the requirement to have age ratings enforced will have the same effect. 

Finally, the proposal introduces specific requirements for games incorporating AI companions or general conversational chatbots. Where the functionality is presented as part of the online game, it must not be activated automatically or prominently presented to minors, and minors must not be encouraged to use it.

What’s next? 

The European Parliament and the Council of the EU will now review and negotiate the proposed text. While the Commission anticipates a swift legislative process, negotiations can take between 8 and 24 months, especially as disagreements about age restrictions are expected. Ultimately, though, the Act may change but is not going away.      

In parallel, the EC has announced that it is on track to publish the proposed Digital Fairness Act this Autumn (likely November), which will add another layer of obligations to online games, not just regarding minors but also adults.  

We recommend companies operating in the EU market to closely follow the development of the Kids Act and any further announcements, in particular potential changes regarding age assurance requirements, monetisation and engagement mechanisms, and communication features that would require significant changes to your services.