On September 17, the European Commission released a draft of the so‑called EU KIDS Act – an acronym for Keeping Internet Digital Spaces Accountable and Trustworthy. While the most contentious provisions target social networks and video‑sharing services – for example, a complete ban for users under 13 and tighter limits for those under 15 – the text also contains a substantial set of rules that affect online games, AI companions, chat bots, app stores and operating systems. This article focuses on the parts of the draft that are directly relevant to the gaming sector. If the legislation is eventually adopted, it will apply to every online game that is offered to consumers within the EU.
The definition of "online game" is deliberately wide and could encompass everything from user‑generated‑content platforms such as Roblox to the multiplayer component of a traditionally single‑player, disc‑based title. Only games that are sold purely on physical media and have no online functionality would be clearly exempt.
A grey area exists for titles that are not officially marketed in the EU but still attract European players through foreign storefronts, such as US‑based platforms. However, the act does carve out an exemption for services that are primarily educational and are operated by schools or similar organisations, as well as for certain non‑profit services. One of the core obligations for online‑game providers is to ensure that their products do not actively encourage excessive use by minors.
Under the KIDS Act, "minors" are defined as anyone younger than 18. Consequently, mechanisms that reward players for logging in daily, or that penalise them for taking a break – for instance, the loss of a bonus after a period of inactivity – are likely to be prohibited for under‑18 users. While a technically compliant workaround might be imagined, the draft makes clear that such practices are viewed unfavourably regardless of how they are implemented.
These concerns echo recent debates around age‑rating systems such as PEGI and USK, but the KIDS Act takes a more black‑and‑white stance. The regulation reaches beyond obvious loyalty schemes and targets any feature that effectively punishes a player for not returning at set intervals. In a persistent‑world game, even the simple fact that the virtual world continues to evolve while a player is offline can be interpreted as a pressure tactic, even if no explicit bonus system exists.
Designers will therefore need to shift their thinking from "Should we reward daily play?" to "Does the overall design of the game pull minors back on a regular schedule?" – a far more nuanced and difficult line to draw. Another significant provision concerns communication between minors and other users. To meet the new requirements, game providers will generally need to implement parental‑control tools and reliable age‑verification mechanisms.
The obligations for games are less stringent than those placed on social networks, which must employ a dedicated EU‑wide age‑verification solution. Games, by contrast, may rely on proportionate methods such as age estimation, provided these methods are accurate, respect privacy and are non‑discriminatory. Simple self‑declaration will never be sufficient.
When a game is distributed through an app store, part of the verification burden can be shifted upstream, because the store already checks the user's age and can, with the player's consent, pass that information to the game. The draft also proposes a "Code of Conduct" for age‑rating and online‑game practices, aiming to transform the largely voluntary PEGI framework into a legally binding regime. This raises questions about the interaction with national youth‑protection laws. Germany, for example, has a well‑established set of rules at both the state and federal levels, overseen by public regulators and complemented by the USK self‑regulatory system, which is backed by national legislation.
The KIDS Act appears to leave little room for the USK to continue regulating the specific interaction risks (excessive use and open communication) that the EU draft addresses, even though German law currently assigns those responsibilities to the USK. Ultimately, a debate may emerge over whether competence lies with the EU or with individual member states – a classic tension between harmonisation and national sovereignty.
Monetisation transparency is another area where the draft touches on long‑standing industry concerns. Recital 40 states that minors should receive clear information about the real monetary value of virtual‑currency transactions and be protected from variable‑reward systems – a reference to loot boxes and similar mechanisms. However, the operative part of the legislation limits these economic‑transaction rules to social networks, video‑sharing platforms, AI companions and generic chatbots, not to online games.
This inconsistency could be a drafting oversight or an intentional decision to handle game‑related transparency through the proposed Code of Conduct instead of direct regulation. The KIDS Act also introduces new rules for "general conversational chatbots" and, crucially for the gaming world, "AI companions." Such systems must avoid design elements that foster emotional dependencies and must not, by default, reuse personal data from prior interactions with minors unless it is needed for safety. When AI companions are embedded in games that are delivered via a social‑networking service or video‑sharing platform, they must not be auto‑activated, must not be prominently displayed, and must include an opt‑out option that minors can access at any time.
Not every AI feature used in a game will fall under the definition of an AI companion. The key test is whether the system simulates or facilitates a social, emotional, or interpersonal relationship with the user. For instance, large‑language‑model‑driven non‑player characters (NPCs) that converse with the fictional player avatar rather than directly with the human player may be exempt, because the relationship is with the in‑game character, not the real person.
Yet the definition also covers systems that merely enable such a relationship, potentially widening the scope. Finally, providers must supply robust content‑control tools that let minors manage and give feedback on the material they encounter, with effects that are both immediate and lasting.
Interaction controls must also be offered, allowing young users to adjust how they communicate, create content and engage with others within the service. All safety features, informational prompts and controls mandated by the KIDS Act must be easy to find and presented in language that minors can understand. Enforcement will fall under the existing EU Digital Services Act regime for most services, while AI companions and chatbots will be overseen by the AI Act. Non‑compliant operators could face fines of up to 6 % of their global annual turnover.
Each EU member state will need to designate a regulator to supervise compliance for online games. The KIDS Act is intended to be a directly applicable regulation across all EU countries, but the current text is still a draft and must be approved by both the European Parliament and the member states. Historically, the gap between a first draft and final adoption spans one to two years, yet the Commission appears to be pushing for a faster timetable.
Given the global focus on regulating social media, it is unlikely that the KIDS Act will disappear; it may even be fast‑tracked. Game developers therefore need to start assessing the impact now. The central question is whether to rely on age‑verification and restrict certain features for minors, or to design games in a way that all features are universally accessible, even if that means some functionalities are effectively unavailable to younger players. Dr.
Andreas Lober, a partner at ADVANT Beiten, advises leading game companies on youth‑protection and consumer law, and he acknowledges the contributions of his colleagues Lennart Kriebel and Fabian Eckstein in shaping this analysis.