Europe protects children online. Who protects everyone else?
Protecting children online is vital, but Europe’s online safety legislation, the EU Kids Act, must not leave adults exposed to practices it considers unacceptable for the young.
Europe is preparing to put a protective digital ring fence around children. But the danger is that adults will be left unprotected, exposed to the same tricks that keep young people scrolling, spending and sharing more than they intend.
In her State of the Union speech on 16 September, European Commission President Ursula von der Leyen promised that “Europe has the power to act: It is we who decide our rules, not big tech”. The proposed EU Kids Act and forthcoming Digital Fairness Act (DFA) must be read together. Unless they tackle harmful design at its source, Europe will fall short of its ambition to put people before platforms.
The Kids Act proposal deserves credit: no single EU or member state legislation comprehensively protects and empowers children online. It would restrict social media access for children under 13, require parental accounts for 13- to 15-year-olds, and introduce safety-by-design and age checks for older teenagers. Crucially, it would also require high-risk providers to demonstrate that their services are safe for children, rather than forcing regulators to prove they are harmful.
But age should not become the boundary for protection. Adults face the same addictive features, manipulative prompts and recommendation systems. No user, however tech-savvy, can scrutinise every default setting or resist every nudge designed to capture their attention. Blocking a child from an app solves only one part of the problem, and leaves platforms’ design choices and business practices untouched. By framing these practices as a child-safety issue, the EU risks weakening the case for stronger protections for everyone.
The DFA must extend the Kids Act’s core principle to adults. Though it protects children on certain services, consumer law can protect everyone across all services. Safety by design and a reversed burden of proof should become the baseline for everyone. That means banning addictive features such as autoplay and infinite scroll. It also means tackling dark patterns, the deceptive designs that influence people to their disadvantage and manipulate our behaviours, like the cookie banner with a glowing “accept all” button or the false “only one room left” alert on a hotel booking site.
Age checks still have a role to play, provided privacy is protected. Europeans already verify their identity online every day. Banks are legally required to verify their customers’ identity; in Belgium, around 80% of adults use the itsme app to access government and banking services. The Commission’s age-verification app uses zero-knowledge proofs, allowing platforms to confirm that users meet an age threshold, without knowing who they are.
But technology that works is not the same as safe technology. The Commission must learn from France’s failed social media ban for under-15s, particularly the lack of safeguards governing the use of age-verification tools. The proposal must explain how these tools work in practice and ensure the highest standards of privacy, cybersecurity, and data protection. Ultimately, even the best-designed age-check app will not change the design choices that put users of all ages at risk.
The next test is whether Europe can keep pace with the business models it seeks to regulate. Platforms continually find new ways to capture attention and influence behaviour, so safeguards must evolve alongside them. The DFA should cover AI systems that detect signs of loneliness or distress and exploit these vulnerabilities to extend engagement or encourage spending. In the worst cases, AI companions have been linked to teenage suicides, but adults are equally vulnerable to emotional manipulation.
Finally, new rules achieve little if enforcement crawls at the pace of a courtroom while platforms change their products overnight. Regulators need the power to halt suspected practices that cause serious harm while investigations are still underway. The DFA should work alongside the Digital Services Act and General Data Protection Regulation (GDPR) and push national authorities to share information and conduct joint investigations. Otherwise, platforms can exploit the gaps between different regulatory regimes.
Europe has recognised that children need protecting online. Adults face many of the same tactics, yet the law leaves them largely to fend for themselves. The EU Kids Act is a good start, but the DFA must extend its protection to everyone. Europe will reclaim control of its digital future only when its rules are strong enough to constrain the platforms that shape it.
Myriam Iehl is Programme Assistant for the Europe’s Political Economy programme at the EPC.
The support the European Policy Centre receives for its ongoing operations, or specifically for its publications, does not constitute an endorsement of their contents, which reflect the views of the authors only. Supporters and partners cannot be held responsible for any use that may be made of the information contained therein.
