Does the EU KIDS Act apply to your game if you are outside Europe?

If you run a game or a user-generated content platform from the United States, the United Kingdom or Asia and it has players in Europe, the EU KIDS Act that the European Commission proposed on 17 September 2026 is likely to reach you. It is not the US KIDS Act, the Kids Internet and Digital Safety Act that the House of Representatives passed on 29 June 2026. The two share an acronym and a concern for children online, but they are separate laws with different tests, different regulators and different consequences for your product.

The European text arrived to a loud reaction from the industry. Tim Sweeney argued that it would be terrible for the next generation, because tools such as Roblox Studio and Fortnite Creative are how children now make things. Read against the official proposal, the picture is more precise and, for most studios, more practical: there is no ban on children playing, but there is a set of design obligations that apply to any online game offered in the EU.

What the EU KIDS Act is, and where it stands

The proposal, COM(2026) 681, is a draft regulation based on Article 114 TFEU. Once adopted, it will apply directly in every Member State without national implementing law. It covers social networks, video-sharing platforms, online games, AI companions and general conversational chatbots, and app stores. A minor is anyone under 18. Small and micro businesses are not exempt.

It is not yet law. The European Parliament and the Council now negotiate the final text under the ordinary legislative procedure. What already applies is Article 28 of the Digital Services Act, which requires online platforms accessible to minors to ensure a high level of privacy, safety and security, together with the Commission's guidelines on it. The KIDS Act turns much of that guidance into binding rules.

Why a company outside the EU is caught

The test is the market you serve, not where you are incorporated. The proposal follows the logic of the DSA and the AI Act. It requires providers of social networks, video-sharing platforms, online games and AI chatbots with no establishment in the Union to designate a legal representative in a Member State where they offer their service. If you have already appointed a representative under the DSA or the AI Act, you can extend that mandate rather than appoint a new one.

The age ban does not apply to games

The headline measure, a delay in access, applies only to social networks and video-sharing platforms with certain risky features. On those services, children under 15 cannot open an account of their own. A parent can open a limited account for a child aged 13 to 15, and there is no access below 13.

Online games are treated differently. Recital 12 brings into scope both games that let users share content with an indeterminate audience and games that do not. It also settles the hybrid case: where an online game has features of a video-sharing platform, it is treated as an online game. Only games sold and played exclusively on physical media, with no online component at all, fall outside.

A children's game with chat and player-made worlds is not banned for under-13s. It is regulated by design.

One boundary remains unsettled. The text resolves the overlap with video-sharing platforms, but it does not resolve the overlap with social networks with the same clarity. A game built around friend lists, groups and open chat will want to follow that point closely during the negotiations.

What every online game will have to do

Article 15 extends to online games three sets of rules written for social networks, and adds its own:

• No addictive design. Games may not be designed to encourage compulsive or excessive use by minors, and must offer time-management tools that protect sleep and school hours. The recitals define core sleep hours as at least eight consecutive hours between 22:00 and 08:00. They also rule out rewards for logging in at set intervals and penalties for not playing.
• Protective defaults. Features with foreseeable negative effects on a child's privacy or safety must be off by default or unavailable.
• Contact safeguards. Protection against contact with strangers, and measures to stop the game being used to lure children onto riskier services, for instance by restricting outbound links.
• Creation platforms. If players can build games on your platform, you must provide the technical and organisational means for those games to comply.

The rule with the widest reach sits in the general provisions. The design obligations also cover unregistered users, and a provider may relax them only once it has established, through compliant age assurance, that the user is an adult. In practice the default is to treat every player as a child.

Age assurance without hoarding data

Self-declaration will not do. Age verification is required for the access delay on social networks. For the design obligations that bind games, providers may use verification or other age assurance methods, such as estimation, provided they are accurate, reliable, robust, non-intrusive and non-discriminatory. Every Member State must offer at least one verification solution.

All of this sits alongside the GDPR, not above it. The recitals stress purpose limitation and data minimisation. For a company processing EU players' data from abroad, the age check is also a new processing activity that needs a lawful basis and, very often, an EU representative under Article 27 GDPR. Building that flow with genuine minimisation is part of EU data compliance for non-EU businesses.

The monetisation gap

The rules on money are where the text is weakest for games. Article 13 requires social networks and video-sharing platforms to flag every purchase as an economic transaction and not to expose minors to variable reward systems. Article 15 does not extend it to games. Recital 40 says minors in games should enjoy the same protection, including transparency on the real value of virtual currencies, but leaves it to industry codes of conduct.

That gap is unlikely to last. The proposal itself announces a Digital Fairness Act aligned with it, and the Commission has said it will table that proposal before the end of 2026. The options under discussion include real-money price display for virtual currencies and, for paid loot boxes, anything from parental consent to an outright ban. Individual Member States are also moving: Spain's draft law on minors in digital environments would prohibit minors' access to paid random reward mechanisms.

AI characters inside games

If your game includes a conversational assistant or an AI-driven character, it must not switch on automatically, minors must be able to opt out, and the design must not nudge them towards it. Extra safeguards apply where that chatbot operates alongside in-game purchases. These rules sit on top of the AI Act transparency obligations that already govern AI-generated content.

Enforcement and the Roblox precedent

The regulation creates no new regulator. It relies on the DSA and AI Act structures, and gives the Commission an accelerated procedure for services under its exclusive supervision: preliminary findings within 30 days and a final decision within 90.

Roblox shows how that supervision reaches a game. On 31 August 2026 the Commission designated it a very large online platform under the DSA, because users can create, publish and play games made by other users. It has until January 2027 to meet the enhanced obligations. Once the KIDS Act applies, it will also have to demonstrate within its DSA risk assessments that its design measures actually work.

Our view

Europe is not banning games for children, and the prohibition narrative misreads the text. What the proposal does is shift the burden onto design: sleep hours, contact settings, retention mechanics and, soon, monetisation. That is a more demanding standard than the United States is likely to adopt, and it will fall on studios of every size.

The real concern lies elsewhere. Age assurance at this scale risks becoming a general identification layer for anyone who wants to use the internet. That deserves as much scrutiny as the harms it seeks to prevent.

What to do now

Map every feature of your game against three regimes: safety by design (DSA and KIDS Act), data protection (GDPR) and consumer law (current EU consumer rules and the coming Digital Fairness Act). Review any mechanic that rewards daily logins or punishes absence. Design age assurance with minimisation from the start, and prepare your store for real-money price display. The negotiations will change the wording, but the direction is settled.

Frequently asked questions

Does the EU KIDS Act apply to a game studio with no office in Europe?

Yes, if the game is offered to players in the EU. Providers without an EU establishment will have to designate a legal representative in a Member State where they offer the service.

Will children under 13 be banned from online games?

Not under the proposal as drafted. The account ban applies to social networks and video-sharing platforms, and a game with video-sharing features is treated as an online game.

Is it the same law as the US KIDS Act?

No. The US KIDS Act (H.R. 7757) is a federal bill that passed the House of Representatives on 29 June 2026. The EU KIDS Act is a European Commission proposal for a regulation. Complying with one does not mean complying with the other.

Does it ban loot boxes?

Not directly for games. The ban on variable reward systems applies to social networks and video-sharing platforms, while for games the text relies on codes of conduct. The Digital Fairness Act and national laws may go further.

When will it apply?

Once the Parliament and the Council adopt the final text and the application date it sets arrives. Article 28 DSA already applies today.