A 12-year-old in Burgas who opens a TikTok account today with a made-up birth date may soon hit a real obstacle before they can even sign up: proving they really are the age they claim. That is the heart of a new EU rule the European Commission unveiled on 17 September 2026, which still has to pass through the European Parliament and EU member states before it becomes law.

The idea is not new. France, Greece, Denmark, Spain, Austria, Belgium, Italy, Germany, Poland and the Netherlands already have their own national rules for children on social media. The Commission says that is exactly why the EU needs one common set of rules instead of dozens of different laws. The rule is known as the KIDS Act. For the first time, it sets a common age ladder across the EU, tied to a shared European app for checking a user's age, which is already being tested in seven countries.

Three age bands: under 13, 13-14, and 15 and up

The draft splits teenagers into three groups. Under 13: no social media, full stop. Between 13 and 15: access only through a "mini profile" set up by a parent, with a limited list of contacts and a cap of one hour a day on the app. From their 15th birthday onward: their own profile, but only if the platform can show it is "safe by design" for that age.

Commission president Ursula von der Leyen explained the thinking behind it: the burden of proof now shifts. It is no longer up to the parent and the child to protect themselves from an app's risky design. The platform has to prove its service is safe before it lets a teenager on.

What exactly is the "mini profile" for 13 to 14-year-olds

In practice, a mini profile works like an account with parental controls switched on by default. A parent sets it up and can see who the child is chatting with, and the app itself stops working after one hour a day. The list of people the child can talk to is limited to peers only, not adults who message them out of the blue.

How they plan to check ages without collecting personal data

This is probably the most interesting and most technical part. The Commission is betting on its own EU-wide app to verify age, already running as a pilot in Italy, France, Spain, Denmark, Greece, Cyprus and Ireland. Here is how it works: a person proves their age once, using an electronic ID card, passport or banking app, and after that their device only ever sends out a short confirmation, "over 15" or "over 18", with no name, no birth date, nothing that would let a site recognise them the next time they log in. The technology is called "zero-knowledge proof": a way to prove something without ever handing over the data behind it. The platform never sees the child's ID card, only a yes or a no. The Commission expects the app to be available across the whole EU by the end of 2026. Big platforms such as Meta, Google and TikTok will have to check the age of every new account, and later of existing ones too.

Which app tricks have to go

Beyond the age limits, the rule reaches straight into the design of the apps themselves. It bans endless scroll (the feed that keeps loading new clips as you swipe, with no end), recommendation algorithms that pull teenagers into a stream of ever more extreme content, night-time notifications, rewards for logging in every day, and contact from strangers without an invite. AI chatbots and virtual "friends" will no longer be switched on by default for children. A child will have to turn them on themselves, so they do not end up emotionally attached to a bot, the Commission says. Companies that break the rules risk a fine of up to 6% of their worldwide annual revenue. For a company like Meta or TikTok, that runs into billions of euros.

Where things get more complicated

So far it all sounds neat, but there are cracks. First, France itself, one of the countries pushing hardest for this, has already had its own national age-limit law blocked by a court. The Commission still has to convince member state governments and the European Parliament to agree on one text, which could take a while. Second, digital rights groups are not convinced. European Digital Rights warns the rule puts off the problem instead of fixing it. The real cause, the group says, is not the child's age but the platforms' business model itself, built to hold attention at any cost, and that does not go away just because the profile is "mini". The Electronic Frontier Foundation points to another risk: to prove they are over the age limit, everyone, not just children, will have to go through a check, and that raises a barrier that hits hardest people without documents, migrants, and those without a smartphone. The children's network Eurochild says "protective" steps need to go hand in hand with steps that keep children included. Otherwise a teenager in an isolated village, or a child with a disability for whom going online is often their only link to other kids their age, ends up doubly cut off. And third, no age limit is foolproof: plenty of children already lie about their age when they sign up, and the more tech-savvy teenagers are unlikely to have much trouble getting round the new system either.

What this means for parents in Burgas

For now, nothing changes right away. This is a proposal, not a law, and it still has to go through the usual slow round of talks between the Council of the EU and the European Parliament, so there is no date yet for when the rules will actually apply. But the direction is clear, and parents may as well start thinking about it now. For 13 to 14-year-olds, a parent will most likely have to set up and keep an eye on the account themselves, something many families in Burgas, like everywhere else, already do on their own initiative. The difference is that from now on it will be built into the apps' own rules. For older teenagers, over 15, little will change in practice in how they log on to social media, but the apps they spend hours on every day will have to strip out some of the tricks that currently keep them staring at the screen for longer. Whether Europe lands on a final text next year or the talks drag on remains to be seen, but the message to the big platforms has already gone out: the burden of proof has shifted, and from now on it is up to them to show their service is safe for children, not up to parents to chase down the settings after the fact.