Protecting minors online in the EU: hard rules for platforms, soft expectations for parents
As global policymakers rush to regulate online child safety, the focus remains on platform accountability, design, and age-verification solutions. Yet major gaps persist: technical bypasses, data privacy risks, and the missing element of shared parental responsibility.
Teenagers’ use of social media and digital services is a popular subject among politicians worldwide, including those in the European Union (EU). While some countries are currently considering bans up to age 16, others are considering more modest approaches with lower thresholds (pictured below). Meanwhile, a digitally advanced Estonia openly rejects the idea of an EU-wide minimum age for social media use, emphasizing the importance of digital literacy among minors, teachers, and parents, as well as stronger enforcement of existing legal frameworks, such as the Digital Services Act (DSA).
A few weeks ago, a special expert panel, led by Prof. Dr. Jörg M. Fegert and Dr. Maria Melchior, presented a report on child safety online, offering actionable recommendations. While the report is overall balanced and recognizes that not all minors under 18 should be treated the same, it leaves significant room for interpretation for EU policymakers, also echoing the Commission's focus on new platform obligations while relying largely on soft measures for parental involvement.
Current legal frameworks in action
The conversation on the matter is quite simplistic at a Member State level, focusing primarily on the minimum age of use for social media and other digital services. Additionally, some countries, like France, have recently banned smartphones in schools. While the topic is easy to communicate and yields significant political dividends, the technical details and institutional capacity needed to enforce such requirements are rarely part of the discussion.
The conversation on protecting minors online at the EU level is neither new nor ignored. Previously, the EU outlined numerous provisions across various laws meant to protect children online. The Digital Services Act (DSA), for example, is used to assess platforms’ design features that might be harmful, the General Data Protection Regulation (GDPR) outlines protections to safeguard children’s personal data and consent online, and the Audiovisual Media Services Directive (AVMSD) was recently expanded to cover new forms of audiovisual content and video-sharing platforms. The list continues with the Artificial Intelligence Act (AI Act), the Unfair Commercial Practices Directive (UCPD), the Consumer Rights Directive (CRD), the Unfair Contract Terms Directive (UCTD), the General Product Safety Regulation (GPSR), the Product Liability Directive (PLD), the Political Advertising Regulation (PAR), the widely criticised Chat Control 1.0 and proposals for Chat Control 2.0, along many more guidelines, cooperation mechanisms, strategies, political statements and digital literacy programs.
Much like other discussions surrounding online consumer protection, the current debate on protecting minors focuses on introducing new regulatory layers and mechanisms rather than better enforcing existing rules. To this end, the EU has launched its age-verification app, will likely soon propose an EU-wide minimum age for social media, along with additional platform obligations, and is advocating for ex-ante design requirements, such as banning infinite scrolling.
Complications: bypassing, data security & fragmentation among the Member States
The UK’s and Australia's negative experiences of teenagers bypassing local restrictions through various means, including VPN use or migration to fringe and less regulated platforms, have significantly complicated the political conversations. EU policymakers now have to consider real-world examples from abroad and outline precautionary measures to prevent a similar scenario from happening in Europe. So far, the effort hasn’t been successful: earlier this year, the EU Commission unveiled an age-verification app, however, it drew criticism for being unreliable, as AI agents could bypass it "within minutes".
Additionally, the EU must respect the European data protection and data minimization principles, especially given the increasing number of data leaks across both private digital platforms and public services.
Lastly, the fragmented approach to the minimum age of use among EU Member States may complicate efforts to reach an EU-wide agreement on the matter. Countries that have rushed to introduce their own versions of such laws will likely resist the expert panels’ recommendation to focus on restricting access for minors under 13 years old, citing the very same report stating that "countries may prefer to adopt a higher threshold than 13 years".
Building resilience: parents and caregivers' involvement
The report says that minors' safety online is primarily a responsibility of social media and digital services providers, putting parents and caregivers into a secondary role:
"Social media and other digital services providers retain primary responsibility for keeping minors safe on their services. In addition, parents and caregivers have important roles in supervising children’s and adolescents’ time online, and in guiding minors in addressing the risks they face in social media+ environments together."
It's true that the role of parental supervision decreases as the child develops, becomes more autonomous, and is increasingly influenced by peers. It's also true that sometimes parents don't have the means, time, or digital literacy to make use of existing parental control tools. However, the cultural change that the EU Commission and many local politicians envision will only be possible if regulatory and literacy measures are combined and accompanied by better parental involvement. Especially given that parents themselves are sometimes enablers of rule-bypassing and of giving their own children unrestricted access to the digital world.
There is very little data on European parents using existing parental control options, however, the survey from 2020 conducted by the EU Kids Online Network states that, on average, only 22% of European parents used existing parental control tools. Only the French and Maltese parents were somewhat more involved, while only 12% of Lithuanian parents and 14% of Czech parents used parental control mechanisms back in 2020.
The special expert panel takes a relatively soft approach to parental involvement, focusing on digital literacy, guidelines, and supportive tools. However, meaningful cultural change usually requires combining soft measures with hard obligations - not just for digital platforms, but for parents as well. While the EU maintains a comprehensive child protection framework enforced by local agencies, the current political conversations on minors online lack direct incentives or accountability mechanisms for parents. Without clearly defined parental responsibility to curb excessive screen time, cyberbullying, and online abuse towards other children, many parents may remain passive, relying entirely on local or EU-wide regulations rather than taking proactive ownership of their children’s digital well-being.