The EU Kids Act, announced yesterday, is already coming under fire for overreach and unintended effects.

Designed to keep children safe online, it runs the risk of regulating services that don’t need to be regulated and enabling surveillance at scale, observers say.

The basic principles are straightforward, and rely on a graduated approach. The proposal bans social media platforms altogether from offering services to children under the age of 13.

For those between 13 and 15, there would be parental control, allowing their guardians to set up ‘mini accounts’ that the children can access through the guardian’s own account.

This would allow them to access age-appropriate social media and video-sharing platforms, and would include safeguards, such as limited social contacts and limited screen time of up to one hour per day.

And, finally, over-15s would be able to set up their own accounts.

The Act would apply to all online services offering social media services, video sharing, online video games, AI companions and chatbots to users below the age of 18.

It would include a ban on addictive features and profiling-based recommender feeds, as well as infinite scroll without stopping points, reward tricks, push notifications during sleeping hours and unsolicited contact from strangers.

AI companions and chatbots must be turned off by default and banned from simulating interpersonal relationships in ways that create emotional dependency.

Profiles for minors must be private by default, with geolocation, camera and microphone access turned off; and there would need to be easy ways for minors to block and mute users, effective time-management tools, and safe recommender systems that kids can control, tune and reset. Providers would have to use age assurance tools.

“Today, our children are engaging with the most sophisticated technologies ever created. Technology that was never created with their wellbeing in mind,” said European Commission president Ursula von der Leyen.

“Our Kids Act is reversing the burden of proof - it is for platforms to show they are safe by design. And we put parents back in the driving seat, giving them the tools to help their children navigate a safer online world.”

However—as always with online regulation—there are concerns that the Act could have unintended effects.

“The proposed KIDS ACT regulates not only social media, but online video games, video-sharing platforms, and AI services. This broad scope has led to cross-category restrictions that don’t reflect how kids use the internet, such as one-hour time limits for online video games,” said Information Technology and Innovation Foundation (ITIF) head of European tech Patrick Grady.

“It also treats all social media sites the same, even if they have different features and functionalities. Meanwhile, entire categories of emerging tools like AI tutors are curbed too soon. And as the internet evolves, the lines between the proposed categories will blur.”

There are also large areas of potential difficulty in terms of privacy. Checking children’s ages means checking the ages of adults too, and the concept of ‘guardians’ means somehow verifying family relationships - a far cry from Europe’s usual principle of data minimization.

The Commission has some tricky questions to answer in terms of how it can ensure that the rules don’t create an infrastructure that enables age tracking, identity linkability, or surveillance at scale, said Daniel Friedlaender, senior vice president and head of the Computer & Communications Industry Association (CCIA Europe).

““If this system requires large amounts of sensitive information about children, adults, and family relationships, it will create serious risks for everyone. The Commission cannot treat these as mere implementation details when key technical, privacy, and security requirements are left to subsequent implementing and delegated acts,” he said.

“Collecting age information, identity credentials, and data linking children with parents or guardians at this scale would undoubtedly create an attractive target for cybercriminals.”

The legislative proposal has been submitted to the European Parliament and Council for examination and adoption - with the Commission saying that it’s ‘essential’ that it should be adopted swiftly.