There is a special class of legislation that announces its own virtue so loudly that one is tempted, before examining a single clause, to ask what it hopes we won’t notice. The European Union’s proposed KIDS Act — a title chosen, one presumes, with the same cynical tenderness that once gave us the PATRIOT Act — belongs firmly to that class. Its full name, “Keeping Internet Digital Spaces Accountable and Trustworthy,” is an acrobatic feat of reverse-engineering: first find the acronym your focus groups approve of, then torture the English language until it gives in. And give in it does, though not in the way its authors intended.
Consider what this proposal actually does, stripped of the nursery wallpaper. It inverts the presumption of innocence — that antique, tiresome obstacle to good governance — and replaces it with something quite new: a presumption of childhood. Under the safety-by-design provisions, a provider of an online game, a social network, or indeed a mere app store must apply child-safe restrictions to every user, and — I quote the actual text — “shall only derogate from those requirements after they have established that the recipient of the service or the user of the system is an adult, by making use of age assurance.” Read that again, slowly. You are a minor until you prove otherwise. You are guilty until verified. And the verification, naturally, must run through instruments certified by the state itself, under the EU Age Verification Scheme, tethered — per the Commission’s own recitals — to the digital identity wallet that every member state is obliged to foist upon its citizens by the end of 2026.
This is not child protection. This is the census, wearing a nanny’s apron.
The Piety That Dares Not Be Questioned
Every expansion of state power requires a pretext immune to cross-examination, and in our era that pretext is The Child. One does not argue with a mother who fears for her child; one capitulates. The proponents of the KIDS Act know this better than anyone, and they have industrialised it: a specially convened panel of experts, a presidential speech, a G7 communiqué, a coalition of one hundred and forty organisations signing a joint statement within weeks of each other — a rolling wave of coordinated moral urgency that has the remarkable property of arriving simultaneously in Canberra, London, Paris, Madrid, and Brussels, as though each legislature had independently gazed upon the same suffering child and independently reached for the same surveillance apparatus.
The harms themselves are not fictitious. Sleep disruption is real. Grooming is real and monstrous. But notice the maneuver: because the harms are real, the remedy is placed beyond the reach of evidence. Nobody asks whether the remedy works. Which is convenient, because we have now tested it — and it does not.
Australia Ran the Experiment. Look at the Results.
Australia, eager to volunteer its citizens for the pilot study, banned social media for under-16s in December 2025, complete with age verification. In June 2026, the first rigorous assessment appeared in the BMJ. Its finding: three months in, there was little evidence the ban had substantially reduced adolescent social media use, because the age checks are trivially circumvented. Polling by the Molly Rose Foundation found that 61 percent of 12-to-15-year-olds who previously held accounts on the restricted platforms still had them. Roughly half the youthful user base of every major platform simply remained. Meanwhile the eSafety Commissioner’s own parent survey agreed with the heretics rather than the clergy.
The ban did succeed in one thing: platforms deleted some 4.7 million accounts belonging to young people who were either honest enough to comply or careless enough to be caught. The obedient and the careless, in other words. The rule-followers. The very children we are constantly told need protecting from the predatory and the sophisticated — both of who, incidentally, were unaffected.
Now watch closely what happened next, because it is the most instructive part. The Australian failure produced no recantation, no commission of inquiry into whether the instrument works at all. It produced demands for stronger age verification. This is the signature move of the bureaucratic faith: when the remedy fails, the diagnosis is never questioned, the dose is increased. As a CISO I have a professional term for systems whose failure mode is expansion. We call them ratchets. They turn one way and one way only.
Definitions Wide Enough to Swallow the World
Examine the Act’s craftsmanship and you find the honest part of the document, because the drafters did not trouble to hide their ambition. A “video game,” we read, is any information society service that involves interaction with a user interface to generate visual feedback “in a simulated environment for play or entertainment purposes.” You will observe that this captures, by my rough estimation, nearly everything a human being does with a screen for enjoyment. A “video gaming platform” is any DSA “online platform” involving games — which, given how the DSA defines platforms, sweeps in the hobbyist running a multiplayer server for a game its own publisher abandoned years ago, who now finds himself legally situated somewhere between Valve and Mark Zuckerberg.
And what does this army of the newly regulated owe? Compliance mechanisms: reporting channels, age-assurance integrations, child-safe defaults, approved codes of conduct. For the community volunteer and the two-person studio, this is not a compliance burden; it is a sentence of extinction. The Electronic Frontier Foundation noted what the Commission chose not to: the proposal contains no exemption for small enterprises. The big platforms will hire forty lawyers and survive. The small ones will not, and their disappearance will be recorded, in the affected tone of the Commission’s impact assessment, as regrettable consolidation. There is a word for a regulatory regime that the giants can absorb and their competitors cannot, and it is not child safety. It is a moat, dug at public expense.
Even the internal industry response tells you who profits. Meta — and, one notes with some relish, the proprietors of Pornhub — lobbied for verification to be performed at the operating-system level. Apple and Google, no fools, demurred at discovering they had been volunteered as the identity desk of the internet. When the pornographers and the surveillance advertisers agree on where the checkpoint should go, the citizen may be forgiven for suspecting that his liberty is not the element being protected.
(Photo by Brett Sayles on Pexels.com)
The Wallet and the Lie of Anonymity
The Act’s defenders will tell you, with the glassy serenity of the professionally sincere, that the verification is “privacy-preserving.” One proves one’s age once to a trusted issuer and receives mere tokens; the platform learns only that you are over the threshold, never who you are. Splendid. Charming. Except that the European Digital Rights initiative (EDRi) examined the actual technical specifications, and the specifications do not say what the brochure says. The attestation providers are required merely to set timestamps with a precision that “shall limit the linkability information” — limit, not prevent. The unlinkability that the eIDAS law demanded be ensured is being softened, regulation by implementing act, into something more polite and less binding. And beneath it all, the credential is anchored — there is no evading this — to a government identity document, coupled to your person by biometrics. Somewhere, at the moment of issuance, the state binds a face to a credential and a credential to an individual. Everything afterwards depends on that binding being forgotten by every party forever, a category of promise with a known mortality rate. And, we might add, with no way for the person involved verifying any of it.
To be told that this is anonymous is to be told that the panopticon has excellent curtains. The inmate who cannot see the guard is assured the guard cannot see him either. Only the guard’s contract says otherwise, and the contract is being redrafted.
What Is Actually on Offer
Strip the KIDS Act to its honest arithmetic and you get the following bargain, which no citizen would sign if it were presented to them in plain, honest language:
We will require every man, woman, and child in Europe to route their digital life past an identity checkpoint — knowing that the checkpoints will be circumvented by every predator we promised to stop, knowing the guarantees of anonymity are dissolving even in the drafting, knowing the costs will crush small operators and entrench the incumbents — in exchange for a barrier that the only real-world test we possess has shown to be, at best, partially effective against children who were never the danger in the first place.
Here is the scandal hiding in the daylight: the Act’s good half needs none of this. Banning infinite scroll and autoplay-by-default for minors, restricting the engineered compulsion loops that platforms deploy against developing brains, preventing harmful content — these are design rules one imposes on the platforms, full stop. No wallet. No biometric anchoring. No universal checkpoint. They are effective precisely to the degree they require no identity infrastructure at all. There is no proven need for age verification. That the Commission bundled the design rules inseparably with the surveillance layer tells you which half was the point and which half was the garnish.
The age of the internet as a place where one may learn, read, and speak without first showing papers is ending, and it is ending not with a bang but with a lullaby. They are doing it For the Children — as they have done every other thing that could not survive being done in plain sight, with plain language, to adult faces.
The public consultation closes on 3 December 2026. The presumption of your adulthood is, for the moment, still yours to defend.