EU Kids Act Brings Sweeping New Rules for Video Games and Mobile Mechanics

The European Commission has published its proposal for the EU Keeping Internet Digital Services Trustworthy & Accountable Act, known as the Kids Act, introducing comprehensive regulations designed to protect minors in online spaces including video games. The 99-page legislation specifically brings video games, video game platforms and online games into its scope, marking a significant shift in how the gaming industry must approach design and access controls for younger players.

The Kids Act follows a "social media plus" framework recommended by an EU child safety panel. Unlike social media and video-sharing platforms, games don't have a blanket minimum age restriction. Instead, providers must assume all users are minors until they can verify otherwise and must maintain a high level of privacy, safety and security for minors, including those accessing games without an account.

Age verification becomes mandatory when games offer age-restricted features. The legislation permits self-reporting in some circumstances, such as account-based verification, but generally requires suitable age assurance solutions. Notably, the Act mandates age-ratings for online video games through systems like PEGI, with app stores required to enforce these ratings and prevent minors from accessing or purchasing inappropriate applications. The criteria for age ratings cover both content such as violence and profanity as well as game features including monetisation and communication functions.

The legislation introduces specific restrictions on game mechanics and features designed to encourage excessive play. Games must prohibit or restrict access to features that encourage compulsive use, including daily streaks, engagement rewards and re-engagement notifications. Techniques that penalise disengagement by causing players to lose progress when away are covered. Push notifications must be off by default and designed to avoid interfering with sleep or school hours.

Communication and data protection requirements add another layer of obligations. Games must prevent unsolicited contact, prohibit minors from being included in contact recommendations or added to group chats without explicit consent and safeguard minors from being redirected to external services. By default, games must disable geolocation, camera, microphone access, contact synchronisation and account recommendations. Games incorporating AI companions or conversational chatbots must not activate these features automatically or present them prominently to minors, and minors must not be encouraged to use them.

The proposal includes provisions for user-generated content platforms. Video game platforms that allow users to create and upload games must provide necessary tools to enable creators to meet their obligations, though creators bear responsibility for compliance.

Veronica Perez Lima, a policy advisor at Flux Digital Policy, noted that while many clauses apply to games, they are scattered throughout the document. The online games section appears in Article 15, but compliance requires reviewing multiple sections of the legislation.

The European Parliament and Council of the EU will now review and negotiate the proposed text. The European Commission anticipates a swift legislative process, though negotiations typically take between 8 and 24 months. Disagreements about age restrictions are expected to emerge during discussions.

In parallel, the European Commission announced it is on track to publish the proposed Digital Fairness Act this Autumn, likely in November. This legislation will introduce another layer of obligations for online games affecting both minors and adults, potentially addressing monetisation features such as loot boxes and virtual currencies more strictly than the Kids Act.

Companies operating in the EU market are advised to closely follow the development of both the Kids Act and the Digital Fairness Act, particularly regarding potential changes to age assurance requirements, engagement mechanisms and communication features that could require significant service modifications.