CHILD SAFETY ONLINE: BEYOND AGE LIMITS TOWARDS AGE-APPROPRIATE DIGITAL DESIGN

Digital technologies have become an integral part of children’s lives from an increasingly young age. Minors navigate the digital environment to learn, play, communicate and interact, benefiting from the significant opportunities it offers. At the same time, their growing technological familiarity does not eliminate the particular vulnerabilities associated with childhood and adolescence. As children’s cognitive, emotional and social capacities continue to develop, their participation in digital environments requires appropriate safeguards against content, features and practices that may adversely affect their development and well-being. The challenge, however, is not simply to shield children from the digital world, but to enable them to participate in it safely and progressively autonomously. 

It is against this background that the European Commission’s Special Panel on Child Safety Online published its final report, including a series of recommendations for an EU-wide approach to protecting and empowering minors in the digital environment. Its recommendations range from precautionary age restrictions for certain digital services to privacy-preserving age assurance, safety by design, digital literacy, and greater participation of children in shaping the services and policies that affect them. The report also raises important legal questions: how should age restrictions interact with the GDPR? What does “age-appropriate” design mean in practice? And how can children be protected without unnecessarily limiting their autonomy and rights? 

These questions are also highly relevant to the LET’S CARE project, in which TIMELEX acts as legal and ethical partner. The project provides a concrete example of age-appropriate digital design outside the social media context, through tools developed to support children’s education and well-being.

A new European approach to child safety online 

The final report, Child Safety Online: Protecting and Empowering Minors in a Digital World, was published on 13 July 2026. Its recommendations are those of the Co-Chairs themselves, drawing on the work of the Special Panel and a wider consultation process, and are intended to inform future EU action on child safety online. 

Although much of the public’s attention is likely to focus on the proposed minimum age for access to certain social media and other digital services, the report takes a considerably broader approach. Its starting point is developmental: children and adolescents face different risks, have different needs, and gradually acquire greater capacity for autonomous decision-making. The report expressly calls for a “developmentally sensitive approach” to child safety online and distinguishes between different stages from early childhood through adolescence. The report therefore considers not only whether minors should be able to access particular services, but also how digital environments themselves should be designed differently, when their users are children and adolescents. 

From a minimum age to “evolving autonomous use” 

The report recommends a harmonised EU-wide access restriction for children under 13 years of age to what the report calls “social media+”. This term covers social media and other digital services available to minors, that contain age-inappropriate or risky features or content, such as social media platforms, app stores, certain AI systems including AI companions, video games and video-sharing platforms. 

The recommendation should therefore not be understood as a general restriction on children's access to digital technologies or online services. Rather, until providers demonstrate that their services are safe by design, the report recommends restricted access to social media+ services for children under 13 years of age. 

From 13 years old onwards, however, the report envisages what it calls “evolving autonomous use” of social media and other digital services. For adolescents aged 13 to 15 years of age in particular, this entails a transition from supervised towards increasingly autonomous use, recognising children’s developing autonomy offline and online. 

Member States can adopt additional precautionary restrictions for adolescents above 13 years of age. However, the report does not present age restrictions as a substitute for safer services. On the contrary, social media and other digital service providers retain primary responsibility for the safety of their services, with restrictions operating as a precautionary response until services are demonstrated to be safe by design. 

In this respect, the report proposes a significant allocation of responsibility: the burden of demonstrating that services are safe should rest primarily with providers, rather than with regulators, parents or children. As the report itself observes, a 3-year-old and a 16-year-old are both minors, but naturally have different needs, affecting also their ability to understand information, assess consequences and exercise their rights. An age-appropriate regulatory framework must therefore somehow reconcile protection with progressively increasing autonomy. 

Recent developments in France illustrate this challenge. In July 2026, the French Parliament adopted legislation providing, as a general rule, that minors under 15 years of age could not access online social-networking services. The prohibition was broad, although certain services, such as online encyclopedias or some open-source educational platforms, were excluded. 

However, in August 2026, the French Constitutional Council declared this general prohibition unconstitutional. While recognising the objective of protecting minors from risks associated with social networks, it considered the restriction on the freedom of expression and communication of minors under the age of 15 not sufficiently adapted, necessary and proportionate, because it applied across social-networking services without sufficiently differentiating, according to the risks associated with individual services. 

The decision illustrates a broader question underlying the Panel’s developmental model: even where the protection of minors constitutes a legitimate objective, can an undifferentiated age-based prohibition adequately balance that objective against children’s own rights and developing autonomy? 

Moreover, it demonstrates why the debate cannot stop at selecting the “right” minimum age. Proportionality may also depend on the risks associated with the service, the extent of the restriction imposed on children’s rights, and the availability of less restrictive safeguards. This developmental perspective is also relevant beyond access restrictions. Once a child is permitted to use a digital service, the question becomes whether the service itself, its interface, information, safeguards and modes of interaction, is appropriate to that child’s stage of development. 

Age assurance: necessary, but not sufficient 

A second major recommendation concerns age assurance. If access restrictions or age-differentiated safeguards are to work, a service must establish which safeguards apply to a user. But age assurance itself involves or may involve personal data processing and can therefore create new privacy risks. 

The report recognises the importance of ensuring that age-assurance solutions respect privacy and data protection requirements. However, mechanisms intended to protect children should not themselves require disproportionate collection of identity or other personal data. This raises an important data protection question. 

How much personal data should be processed in order to protect a child from data-related and other digital risks? 

An age-assurance system can conflict with key data protection principles such as data minimisation, purpose limitation and data protection by design, if it requires users to disclose significantly more information than is necessary to establish the relevant age threshold. 

Privacy-preserving age assurance, therefore, needs to be built into the solution from the outset rather than added as an afterthought.

The EU's emerging age-verification solution illustrates how this may work in practice. Rather than requiring users to disclose their identity or full date of birth to individual services, a privacy-preserving mechanism can confirm that a user meets the relevant age threshold while limiting the personal information disclosed to the service. Importantly, however, such a technical solution does not itself resolve the underlying regulatory question of which age thresholds and safeguards should apply. 

But even a perfect age-assurance solution would solve only part of the problem. Knowing that a user is 14 years of age tells a service which age category that user belongs to. It does not determine what the service should do differently as a result. 

What does “age-appropriate design” actually require? 

This leads to a more fundamental legal issue raised by the report. The report emphasises safety-by-design and age-appropriate safeguards as means of addressing risks arising from the architecture and functionality of digital services, including infinite scroll, autoplay, recommendation algorithms and persistent notifications. In this sense, age-appropriate design concerns not only what information is collected from children, but also how the architecture of a service shapes their behaviour and exposure to content. This shifts at least part of the regulatory focus from children’s behaviour towards the design choices made by service providers.

From a data protection perspective, however, age-appropriate design potentially goes considerably further. If a service knows that its users include children, questions arise throughout the data processing lifecycle. What personal data are genuinely necessary? How should privacy information be communicated so that children at different developmental stages can understand it? When is profiling justified? Which settings should be enabled by default? Who should have access to information generated about a child? When should parents exercise control, and when should the child increasingly exercise that control themselves? 

These questions engage existing GDPR concepts, including fairness, transparency, data minimisation, profiling, data protection impact assessments (DPIAs) and data protection by design and by default. 

This question also extends beyond the GDPR. Article 28 DSA requires online platforms accessible to minors to put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security of minors, reinforcing the move from formal age thresholds towards risk-based design obligations. 

An important question from a data protection perspective is consequently whether compliance should be understood merely as providing additional protection because the data subject is a child, or whether age-appropriate data protection requires something more dynamic: safeguards and mechanisms for exercising rights that themselves evolve as children develop. 

Protection, parental responsibility and the child's evolving autonomy 

The tension becomes particularly visible in the context of parental supervision. The report recognises an important shift in the respective roles of children, adolescents and their caregivers as minors grow older. During adolescence, minors become increasingly autonomous online while traditional forms of parental and educational supervision become less effective. The challenge is therefore how to protect adolescents during this transition towards autonomy, rather than how to prevent the transition itself. 

This developmental perspective suggests that parental supervision should not be understood as a static form of control exercised until the age of majority. Instead, protection needs to evolve alongside the child's developing capacity for autonomous decision-making.

This poses further pressing questions. At what point should a child obtain greater control over their personal information? When should a parent access information concerning the child's online activities? Does parental authority imply access to all information concerning the child? And how should this change according to the child's age, maturity, the sensitivity of the information and the risks involved?

The GDPR provides specific guarantees for minors, either as a separate category of data subjects or as part of vulnerable data subjects in general (for more details see the relevant blogpost), but it does not provide a complete developmental model for answering all of these questions. 

The report's emphasis on “evolving autonomous use” therefore points towards an important principle: protection and autonomy should not necessarily be treated as opposites. Appropriate safeguards may gradually enable children to safely exercise greater autonomy.

This balance is also relevant to educational digital tools, including those developed in LET’S CARE, where age-appropriate design can combine adult support with children’s understanding, participation and developing autonomy. 

The educational context: a particularly important testing ground 

The above questions do not concern social media alone. The report considers schools, teachers, and educators to be important actors within the wider ecosystem for protecting and empowering minors online. It also emphasises the importance of age-appropriate digital education and media literacy. 

This is particularly relevant to the LET’S CARE project. LET’S CARE seeks to develop safe and caring educational environments across different educational stages and address educational underachievement, disengagement, and school dropout. Its research involves children across a broad age range including children from disadvantaged or vulnerable populations (e.g., Roma children and refugees ), who may provide potentially sensitive information and answer profiling-related questions. 

One of the project's outputs is the Safe Learning e-portfolio, a digital tool that uses questionnaires completed by students, teachers and families to explore students' affective and relational needs, socio-emotional security and risks of underachievement or early school dropout. The project involves the pilot implementation of the tool in schools in Spain. 

The tool supports teachers and counsellors in understanding students’ needs and developing personalised responses. Students complete online questionnaires concerning their family environment, emotional and social well-being, relationships with family members, peers and teachers, and educational and school experience. Their responses are then used to develop a Safe Learning profile helping professionals identify strengths and areas where additional support may be needed. The tool therefore illustrates an important dimension of the debate on child-centred digital design: children are not merely passive recipients of protection. Their own experiences and perceptions inform the design of appropriate educational support. 

The pilot also provides a concrete example of what age-appropriate implementation can mean. There are separate questionnaire versions for students aged 8–11 and those aged 12–18. Questions seeking sensitive information are therefore not mandatory and can be skipped. These safeguards reflect an age-appropriate approach, recognising that that minors should not be treated as a homogeneous category and should retain appropriate control over sensitive information. 

At the same time, the pilot explicitly evaluates the child’s own experience of using the tool. Students are asked whether they understand the questions, feel comfortable using the application, and find it easy to use. They are also invited to suggest improvements to the application. Usability, comprehensibility, and children’s own feedback therefore form part of the assessment of whether the tool is appropriate for its intended users. 

TIMELEX acts as the legal and ethical partner in LET’S CARE. Its role includes ensuring appropriate protection of children's personal data, providing adequate information when children consent or assent to participation, and considering the impact of data collection on children. TIMELEX leads the project's GDPR compliance work, including guidance on the processing of minors' data, information and consent requirements, applicable data protection rules, DPIAs where necessary and the continuous application of a data-protection-by-design approach as the project’s solutions are developed. 

The Special Panel's report therefore resonates with issues that arise in practice within LET’S CARE: what makes a digital tool involving children not only GDPR-compliant, but genuinely appropriate for children at different stages of development? 

The Safe Learning e-portfolio is not a social media service of the kind primarily targeted by the report's proposed access restrictions. Rather, it illustrates the broader question of what age-appropriate and child-centred design may mean where digital technologies serve legitimate and beneficial purposes while nevertheless processing children's personal data. 

Children as participants in design, not only subjects of protection 

The report's broader empowerment perspective treats children and adolescents not only as persons requiring protection, but also as rights-holders who should progressively acquire the capacity to navigate the digital environment safely. This reflects that children's rights apply online as they do offline and that safety measures must respect those rights and children's best interests. The report emphasizes age-appropriate alleys to exercise effectively the rights, such as helplines and complaint mechanisms. 

From a legal and ethical perspective, this raises questions about active participation in the design of digital environments and safeguards. For projects developing digital tools involving children, such as LET’S CARE, an age-appropriate-design approach may mean asking not only “How do we protect children when they use this technology?”, but also “How do we appropriately involve children in deciding what protection should look like?” 

The LET’S CARE pilot provides a concrete example of this participatory dimension. At the end of their interaction with the e-profile, students are asked to provide feedback about their experience of the application and suggest improvements to the digital tool. 

An emerging legal framework (and several unanswered questions) 

The Special Panel's recommendations do not operate in a legal vacuum. Child online safety sits at the intersection of the GDPR, Digital Services Act (DSA), audiovisual media and consumer-protection rules, as well as the broader EU framework governing digital technologies, and children's fundamental rights.

 The report stresses that digital technologies no longer fit neatly within a single regulatory category. It therefore calls for a holistic regulatory response drawing on several areas of EU law. In practice, this means that the respective supervisory authorities should intensify cooperation and information exchange. Given overlapping regulatory responsibilities and uneven resources across Member States, effective use of existing cooperation mechanisms may prove more workable than adding new procedures or responsibilities. Several questions will therefore require further analysis as the Commission considers how to translate the Co-Chairs' recommendations into policy and legislation:

• Age thresholds vs. evolving capacities: can fixed age categories adequately reflect the progressive development of children's autonomy? 
• Age assurance vs. data minimisation: how can age be reliably established without creating disproportionate data-processing risks? 
• Age-appropriate design: which concrete design choices are legally required by the GDPR, DSA and other EU rules, rather than merely recommended as good practice? 
• Profiling and personalisation: when can profiling intended to benefit a child nevertheless create unacceptable risks, particularly where sensitive information or vulnerability is involved? 
• Parents vs. children: how should parental supervision interact with children's privacy and their progressively developing ability to exercise their own rights? 
• Vulnerability: should age-appropriate design respond only to age, or also to individual vulnerability? 
• Accountability: what evidence should providers produce to demonstrate that their services are genuinely safe and age appropriate?

The report proposes an important shift in accountability: the burden of proof should be on the providers, rather than regulators, parents and children, to demonstrate that their services are safe by design. Whether, and in what legal form, this approach will be incorporated into future EU rules remains to be seen. 

From protecting children to designing for children 

From a data protection and children's-rights perspective, one of the most significant implications of the report is the need to look beyond the question of whether children should have access to particular services. The broader challenge is to create digital environments in which protection is embedded into design, while children progressively acquire the knowledge, agency and autonomy to participate in the digital world. 

This requires considering how the design of digital services reflects children’s vulnerability and developing autonomy, instead of just discussing individual compliance requirements. 

This is also illustrated in practice by LET’S CARE. Age-appropriate versions of digital tools comprehensible and voluntary interactions, safeguards around sensitive information, appropriate access controls, supported use, and opportunities for children to provide feedback all demonstrate how legal and ethical principles can inform concrete design choices. 

The challenge now is to translate the Special Panel’s vision of safe, age-appropriate and progressively autonomous digital participation into clear and workable legal requirements. 

Through its role as legal and ethical partner in LET’S CARE and other EU-funded projects, TIMELEX has gained practical experience in translating data protection, children’s rights and ethical requirements into safeguards for child-facing digital tools. If your organisation develops digital services involving children and needs guidance on age-appropriate design, data protection or related legal and ethical requirements, contact the TIMELEX team to discuss how we can support you.

LET’S CARE is funded by the European Union under grant agreement of the project 101059425. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union. Neither the European Union nor the granting authority can be held responsible for them.