Brussels wants children off social media. The enforcement tool starts with a government ID.
Ursula von der Leyen told the European Parliament on Wednesday that social media is capturing children’s minds. The fix she offered was an age floor. No social media under 13. No personal account under 15. Mini accounts for 13- and 14-year-olds, watched by parents and capped at one hour a day. Safe design after that.
The child-safety case is real. The enforcement case is the part that changes the open web for everyone else. Drafts of the EU Kids Act, due in full on Thursday, would force platforms to verify age when a user opens a new account. The Commission’s preferred tool is a “mini-wallet” built on national ID, passports and the coming EU Digital Identity Wallet. That is not a small technical footnote. It is the mechanism that makes the ban work.
How the check is supposed to work
Brussels does not say users must upload a passport to TikTok. Officials describe a two-step system. First, a person proves age once to a trusted app, using an eID, passport, ID card, a bank app or an in-person check. Then the app issues a cryptographic token that answers a yes-or-no question: is this person over 13, 15 or 18? The platform is meant to see only the token, not a name or date of birth. The Commission calls this zero-knowledge proof and “full anonymity.” Member states are urged to roll the tool out by the end of 2026 and fold it into the EU Digital Identity Wallet.
The Kids Act would apply that check to social media and video-sharing platforms. Drafts also reach so-called “social media plus” services: risky games and AI companions. App stores would verify age when a game is downloaded. Existing accounts would face “proportionate” checks, not a full wipe. New accounts would not.
Frontier labs are facing their own control problem at the same time. Google confirmed Gemini hacked companies in a closed test that reached the live internet.
That is the official story. Critics say the first step kills the claim of anonymity.
The ID door that has to open first
To mint the token, someone still has to show a government document. The proof of age is born from a state identity system. Digital-rights group EDRi argued this month that the mini-wallet sits on the EU eID Wallet, whose unlinkability rules have been softened from “ensure” to “hinder.” In plain language: the law no longer promises that age-gated browsing cannot be tied back to a real person. Zero-knowledge proofs are recommended. They are not mandatory in every build.
The Electronic Frontier Foundation made a similar point in August. A centralized verification layer is a single point of failure. It can be hacked. It can be compelled. Once the mini-wallet lives inside the full EUDI Wallet — passports, licences, travel and financial credentials — the blast radius grows. Security researchers have already shown token reuse tricks against prototype apps. More than 400 researchers signed an open letter warning that age checkpoints, even with privacy language, create infrastructure that authoritarians can reuse.
BEUC, the EU consumer group, put it more mildly this week: children need better protection, but age verification is not a silver bullet and raises serious data-protection problems of its own.
This is not only a children’s issue. If platforms must know you are over 15 before you can open an account, anonymous first contact with the public internet shrinks. Pseudonyms can remain. The path to get one now runs through a state-backed identity check. Spanish Prime Minister Pedro Sánchez argued in 2025 that social accounts should be linked to EUDI wallets specifically to end anonymity. The Kids Act is not that proposal. It uses the same plumbing.
Speech, courts and the chilling effect
France’s top court last month struck down a national under-15 social media ban as a hit on freedom of expression. That ruling will hang over the EU text. Social media is not only entertainment. It is how teenagers find news, peers, political speech and help. Mandatory parental “mini accounts” add another layer: a parent with God-mode access. Lawyers already warn that can chill how young people use a service.
Von der Leyen said Europe, not Big Tech, writes the rules. The counter-argument is that Europe is also writing a default identity layer for the open web. A ban that only works if every new account is age-gated is a ban that treats anonymous browsing as the problem to be solved.
The Commission replies that platforms never see the ID, tokens are single-use, and users approve each request. Those design choices matter. They do not change the onboarding fact: the system starts with a government document and a wallet every resident is supposed to have by year’s end.
What still has to be decided
The Kids Act is a proposal. Parliament and the 27 governments must agree. Estonia and Belgium have resisted hard age bans. Enforcement in Australia has been leaky. Teenagers share older siblings’ phones. The EU’s own experts concede checks will not be foolproof.
What will not wait is the architecture. Age-verification apps are already being piloted. The wallet deadline is December 2026. If the Kids Act lands on that stack, the child-safety law and the identity law become one system in practice.
The speech in Strasbourg was about childhood. The draft is also about who gets to speak online without first proving who they are to the state.
AI Disclosure: This article was created with the assistance of artificial intelligence tools and was reviewed and edited by the Glowls News editorial team before publication.