The EU has left the door open to age-estimation by behavioural profiling, and the EU’s own data protection authorities have warned that this can be more intrusive than the verification it replaces, inferring age from a user’s activity at scale, with weaker accuracy for the children it is meant to
Michiel van Hulten
Last week the EU Commission’s Special Panel on Child Safety Online told Ursula von der Leyen that when it comes to protecting children online, “the burden of proof needs to be on providers, not regulators, parents and children”.
Three days earlier, the commission issued a preliminary finding that found the addictive design of Instagram and Facebook to be in breach of the EU’s Digital Services Act.
And according to a recent YouGov poll for Reset Tech, carried out across France, Germany, Italy, Poland and Spain, 75 percent of Europeans surveyed want platforms to prove their products are safe before children can use them at all.
It seems Europe is finally starting to get it right. There should be no more live-testing of dangerous social media products on kids.
For years, platforms have run the experiment and children have paid the price. That can change, but only if we establish a clear standard for platforms to meet: prove your product is safe before children can use it, or it comes off the market.
Right to reject blanket ban
The expert panel deserves credit for resisting the option of a blanket ban. It recognised that blanket bans put the burden on families rather than on the companies that design the risk, while leaving the underlying business model untouched.
Von der Leyen herself framed access as something to be earned gradually, not granted or denied at a single arbitrary line, and warned that childhood, once lost, cannot be recovered.
This is part of a larger trend: G7 leaders have already called for platforms to be safe-by-design and age-appropriate, and member states across Europe have been pushing for exactly this.
The European public agrees. In the YouGov poll, 68 percent of those surveyed back stripping out harmful design features such as infinite scroll and personalised, engagement-driven feeds before children are ever exposed to them, and at least 69 percent would support restricting minors’ access specifically to platforms that fail to meet legal safety requirements.
But a good diagnosis is not a cure, and this is where the panel’s report falls short.
To understand why, we only need to look at what happened to Meta.
The commission opened its case over addictive design (infinite scroll, autoplay, push notifications, recommender systems built to tip users into what regulators call “autopilot mode”) back in May 2024.
Gaps in the thinking
It has taken more than two years to reach a preliminary finding, and any fine, even at the maximum six percent of global turnover permitted under the DSA, will be issued long after the children affected have grown up.
The age-assurance piece has a similar gap. The panel is right to rule out biometric scans and ID checks as a universal gate.
But it leaves the door open to age estimation by behavioural profiling, and the EU’s own data protection authorities have warned that this can be more intrusive than the verification it replaces, inferring age from a user’s activity at scale, with weaker accuracy for the minors it is meant to protect.
Nor does the report say what happens to a child turned away from an unsafe platform with nowhere safe to go. Naming the standard is only half the job if dominant platforms can absorb the cost of non-compliance and families have no real alternative.
What Brussels should do
What the commission should do instead is build a nimble ex-ante certification regime based on clear, meaningful standards, in which a provider must ensure that addictive features are off by default (without the option to switch them back on), that children’s accounts are private and protective by default, that manipulative design is prohibited, and that there is a named, accountable party if something goes wrong, with crippling penalties for bad-faith behaviour, imposed swiftly, in order to create a meaningful deterrent.
We already have strict safety rules when it comes to physical products such as toys and food, and even for the tablets and smartphones on which these social media apps run, so why should the apps themselves be exempt?
Up-front certification removes the multi-year litigation cycle that let Meta’s case run for two years before a preliminary finding was issued.
And it should be paired with a viable route to alternatives, through AI-enabled interoperability, so that a platform judged unsafe for children is not simply a locked door, but a market children and parents can walk away from.
Right now, users are stuck on X, TikTok, Instagram and Facebook not because they trust them, but because that’s where everyone else is.
Interoperability breaks that trap: it means you could switch to a safer app and still reach the same people. It also means safety tools, like a filter that blocks harmful content or parental control apps, could be installed on top of social media platforms much in the way we install an antivirus programme on our laptop.
Built on top of new rules, this is the way to harness market forces to deliver the change consumers are calling for.
The commission now has both the evidence and the political cover to build this “safe social” standard: the panel’s findings, its own case against Meta, and polling showing three in four Europeans back a tougher line.
What is missing is, first, the mechanism that turns ‘prove it’s safe’ from a principle into an obligation platforms cannot outrun in court for years at a time; and second, the competitive threat generated by interoperability rules. Brussels now has the diagnosis.
The proposal von der Leyen is expected to present later this year will show whether it is willing to deliver the cure.
