Following consultation, the European Commission has published guidance on protecting children online under the Digital Services Act. Alongside the guidance, it has also issued a prototype of an age verification app.

The guidelines adopt a risk-based approach, like the DSA, recognising that online platforms may pose different types of risks to minors, depending on their nature, size, purpose and user base. 

Amongst other things, it includes recommendations on:

Modifying the platforms’ recommender systems to reduce the risk of children encountering harmful content or getting stuck in rabbit holes of specific content, including by empowering children to be more in control of their feeds.

Empowering children to be able to block and mute any user and ensuring they can’t be added to groups without their explicit consent. This could help to prevent cyberbullying.

Ensuring that children’s lack of commercial literacy is not exploited and that they are not exposed to commercial practices that may be manipulative, lead to unwanted spending or addictive behaviours, including certain virtual currencies or paid loot-boxes.

Introducing measures to improve moderation and reporting tools, requiring prompt feedback, and minimum requirements for parental control tools.

The verification app will be tested and further customised in collaboration with member states, online platforms and end-users. The guidance outlines when and how platforms should check the age of their users. It recommends age verification for adult content platforms and other platforms that pose high risks to the safety of minors. It specifies that age assurance methods should be accurate, reliable, robust, non-intrusive and non-discriminatory.

Ofcom UK has opened an enforcement programme to monitor whether providers are complying with their children’s risk assessment and record-keeping duties under the Online Safety Act 2023. The EU’s guidance differs from the very detailed guidance provided by Ofcom. All user-to-user and search services were required to carry out, and keep a written record of, a children’s access assessment by 16 April 2025 and where a service is likely to be accessed by children, those services must also carry out a children’s risk assessment by 24 July 2025 which requires providers to assess the risks of their service and associated content being harmful to children. Ofcom’s rules for protecting children come into force on 25 July 2025.

Link: https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-protection-minors