On 17 September, the European Commission released a draft of the EU KIDS Act – an acronym for Keeping Internet Digital Spaces Accountable and Trustworthy. While the most debated provisions target social networks and video‑sharing services – for instance, an outright ban for users under 13 and tighter controls for those under 15 – the proposal also contains a sizeable set of rules that affect online games, AI companions, chatbots, app stores and operating systems. This article focuses on the sections that are directly relevant to the gaming sector.
If the act eventually becomes law, it will apply to every online game that is made available within the EU. The definition of "online game" is deliberately wide, potentially covering everything from sandbox platforms such as Roblox to the multiplayer component of a traditionally single‑player, disc‑based title. Only games that are distributed solely on physical media and have no online functionality are clearly exempt.
A gray area exists for titles that are not sold directly in the EU but still attract European players – for example, games purchased from a US storefront that are nevertheless played by EU residents. However, services that are primarily educational and operated by schools or non‑profit organisations are excluded, as are certain charitable platforms. One of the core obligations for online‑game providers is to ensure that their products do not actively encourage excessive use by minors.
Under the KIDS Act, a "minor" is anyone under the age of 18. Consequently, mechanisms that reward players for logging in every day, or that penalise them for taking a break – such as loss of bonuses after a period of inactivity – are likely to be prohibited for under‑18 users.
While clever design workarounds might eventually be accepted, the draft makes clear that these practices are viewed unfavourably regardless of how they are implemented. These concerns echo recent discussions around age‑rating systems like PEGI and USK, but the KIDS Act takes a less nuanced approach.
In persistent‑world games, the very nature of a continuously evolving environment can act as a subtle pressure on players to return regularly, even without explicit reward structures. This shifts the design question from "Should we give daily bonuses?" to "Does the overall game architecture create a schedule that pulls minors back in?" – a far more complex judgment for developers. The draft also mandates tighter controls on communication between minors and other users.
To meet these requirements, game providers will generally need to implement parental‑control tools and age‑verification mechanisms. Unlike social networks, which must use a dedicated EU‑wide age‑verification system, games may rely on proportionate methods such as age estimation, provided they respect privacy, are non‑discriminatory and are reasonably accurate.
Simple self‑declaration will never be sufficient. When a game is delivered through an app store, part of the verification burden can be shifted upstream, because the store already assesses the user’s age and can, with the player’s consent, forward that information to the game. Another notable element is the proposed "Code of Conduct" for age‑rating and online games. The intention appears to be to transform the largely voluntary PEGI framework into a legally binding regime.
This raises questions about how the act will interact with national youth‑protection laws, especially in countries like Germany where the USK (the industry‑run rating body) operates under statutory backing. The KIDS Act seems to leave little room for the USK to regulate the very issues the act addresses – excessive play time and open communication – potentially sparking a jurisdictional debate between EU‑wide rules and member‑state competencies.
Monetisation transparency is also revisited. Recital 40 states that minors should have clear information about the real‑world value of virtual‑currency transactions and be shielded from variable‑reward systems, a clear reference to loot boxes.
However, this provision only appears in the recitals and not in the operative clauses for games; it is binding for social platforms, AI companions and chatbots but not explicitly for online games. This discrepancy could be a drafting oversight or a deliberate choice to handle game‑related monetisation transparency through the aforementioned Code of Conduct instead of direct regulation. The act introduces fresh rules for "general conversational chatbots" and, crucially for the gaming industry, "AI companions." These systems must avoid design elements that foster emotional dependency, and they may not, by default, reuse data from prior interactions with minors unless required for safety. If an AI companion is embedded in a game that is delivered via a social network or video‑sharing platform, it must not be auto‑activated, must not be prominently displayed, and minors must be able to opt out at any time.
Not every AI feature in a game will fall under the definition of an AI companion. The key test is whether the system simulates or facilitates a social, emotional, or interpersonal relationship with the user. Large‑language‑model‑driven non‑player characters (NPCs) that converse with the fictional player avatar, rather than directly with the real person, might be exempt. Yet the definition also covers tools that merely enable such relationships, potentially widening the scope.
Providers will also be required to give minors robust content‑control tools, allowing them to filter or give feedback on the material they encounter, with effects that are both immediate and lasting. Interaction controls must let young players adjust how they communicate, create content and engage with others.
All safety features, informational prompts and controls must be easily reachable and presented in language that minors can understand. Enforcement will fall under the existing EU Digital Services Act framework for most services, while AI companions and chatbots will be overseen by the AI Act. Non‑compliant operators could face fines of up to 6 % of their global annual turnover, and each member state will need to designate a regulator to supervise game‑related compliance.
The KIDS Act is intended as a directly applicable regulation, meaning it would take effect across all EU countries without the need for national transposition. The draft is still subject to approval by the European Parliament and the Council of Member States, a process that typically lasts one to two years. Nevertheless, the Commission appears eager to move quickly, having already released a detailed text rather than a high‑level outline.
Given the worldwide focus on regulating social media, it is unlikely that the KIDS Act will be abandoned; it may even be fast‑tracked. Because several of its provisions could reshape core gameplay mechanics, developers should start evaluating their impact now. The strategic question for designers is whether to rely on age‑verification and restrict certain features for minors, or to design games in a way that all features are universally accessible, accepting that some functionalities may simply be unavailable to younger players. Dr.
Andreas Lober, partner at ADVANT Beiten, advises leading game companies on youth‑protection and consumer law. He acknowledges contributions from colleagues Lennart Kriebel and Fabian Eckstein.