EU KIDS Act could ban login bonuses and restrict online game features for minors

On September 17, the EU Commission published a draft for the proposed EU KIDS Act, which stands for Keeping Internet Digital Spaces Accountable and Trustworthy. The regulation would apply to all online games sold in EU territories if approved, introducing significant restrictions to common features developers use today.

The scope is broad. Any game with online modes would be affected, from Roblox to multiplayer components on disc-based releases. Only games sold on discs with no online functionality fall clearly outside the rules. Educational games operated by schools or not-for-profit services are exempt.

Login bonuses and daily-return mechanics face particular scrutiny. The regulation defines minors as anyone under 18 and prohibits design features that encourage excessive use. "Login bonuses or loss of benefits when not playing for a certain time will often be prohibited for minors," according to the draft text. The problem extends beyond obvious loyalty systems. Any game mechanic that penalises players for not returning at set intervals would come under fire, including the mere passage of time in persistent worlds where the environment changes during a player's absence.

For game designers, this shifts the fundamental question from "do we reward daily play?" to "does the game, taken as a whole, pull minors back on a schedule?" The distinction matters because it targets systemic design rather than explicit reward systems.

Providers must implement age assurance and parental controls, though the requirements for games are lighter than for social networks and video-sharing platforms. Games can use age estimation and other proportionate methods instead of a dedicated EU verification solution, provided they are accurate, privacy-preserving, and non-discriminatory. Self-declaration alone is never sufficient. When games are distributed through app stores, the store's age assessment can be passed to the game with user consent.

Contact between minors and other users must be restricted, with providers offering interaction controls and content management tools that have immediate and lasting effect.

AI companions present another regulatory challenge. Systems designed to simulate social, emotional, or interpersonal relationships with minors would be prohibited from creating emotional dependencies. They cannot auto-activate or be prominently displayed by default, and minors must receive an opt-out mechanism at any time. The definition could extend to LLM-powered NPCs, though some systems might qualify as fictional interactions rather than personal relationships if designed carefully.

The draft also revisits lootboxes and virtual currency transparency. Recital 40 calls for minors to benefit from transparency about real monetary value in virtual transactions and protection from variable reward systems. However, this language appears only in the preamble, not the operative text. Economic transaction rules apply to social networks and chatbots but notably exclude online games, potentially delegating lootbox regulation to a separate code-of-conduct mechanism or leaving it for future legislation like the EU Digital Fairness Act.

The regulation attempts to build on the existing PEGI framework and make age-rating compliance legally binding across EU member states. This creates complications for countries with established national systems. Germany, for example, has its own youth protection rules enforced through the USK, a self-regulatory body backed by national law. The KIDS Act leaves little room for the USK to regulate interaction risks like excessive usage and open communication, traditionally handled by member states rather than the EU. Whether the EU or individual countries will have final authority on these matters remains unresolved.

Discussions on virtual currency and lootbox transparency will likely continue during the lawmaking process, particularly given expected overlap with the EU Digital Fairness Act.