EU KIDS Act Raises a New Question: How Can We Verify a Child’s Age Without Revealing Their Identity?

On 17 September 2026, the European Commission presented the proposal for the EU KIDS Act, aimed at strengthening the protection of children and adolescents in the digital environment. Among other measures, the proposal introduces a common European approach to age restrictions and places greater responsibility on digital platforms. But alongside restricting access, an important technical and societal question emerges: how can a user’s age be reliably verified without requiring a child to disclose their identity to every online platform?

Europe Wants Common Rules for Protecting Children

On 17 September, the European Commission presented the proposal for the EU KIDS Act – EU Keeping Internet Digital Spaces Accountable and Trustworthy. Its purpose is to strengthen children’s online safety and establish more harmonised rules across the European Union.

The proposal provides for a gradual approach based on age. The European Commission refers to restrictions for children under the age of 13 and an EU-wide minimum age of 15 for independently opening an account on certain social media networks and platforms.

An important part of the proposal is also greater responsibility for digital service providers, which would be required to demonstrate that their services are age-appropriate and safe by design.

Slovenia has welcomed the common European approach. The national interministerial working group identified a gradual approach with an age threshold of 15 for independent access to social networks as an appropriate solution for the Slovenian context.

Further consultations with children and young people, parents, teachers, experts and civil society are also planned.

But How Will a Platform Know How Old a User Is?

If access to a particular digital service becomes dependent on age, a practical problem arises.

How does a platform determine whether a user is 12, 14, 15 or 18 years old?

One option is to ask the user to enter their date of birth. But a date can easily be entered incorrectly or falsely.

Another option is to verify an identity document or other identifying information.

That approach, however, raises another question:

Does a child really need to disclose their name, surname, full date of birth, photograph or even a copy of an identity document to a private online company simply to prove their age?

Perhaps there is another approach.

Verify Age, Not Identity

At Institute 1. april, within the research concept QEI Child Protection, we are exploring the principle that a digital service does not necessarily need to know a child’s identity when it only requires proof of a particular age category.

Instead of:

NAME: …
SURNAME: …
DATE OF BIRTH: …
ADDRESS: …

a service might, in a particular situation, need only a verifiable answer:

UNDER 13

or:

13–14

or:

15+

or:

18+

An online platform could therefore verify eligibility for access without necessarily receiving the user’s full identity.

“To prove age, an online platform does not necessarily need a child’s identity. It needs a reliable answer to whether the user meets the required age threshold.”
— Institute 1. april

Simply Asking “How Old Are You?” Is Not Enough

Today’s internet often relies on self-declaration.

A user enters a date of birth and the system accepts it.

But a child can claim to be an adult.

And an adult can claim to be a child.

This is precisely one of the questions we have already explored at Institute 1. april within the QEI Child Protection concept: an age category should be verifiable, not merely declared.

If European rules increasingly link access to certain services with the age of the user, the quality of age-verification mechanisms will become even more important.

Prove What Is Necessary Without Revealing Everything

This connects to a broader principle that we are exploring within QEI – Quantized Encrypted Identity:

prove the required attribute while disclosing as little personal data as possible.

If a website only needs an answer to the question:

“Is the user at least 15 years old?”

then it may not need an answer to the question:

“Who exactly is this person?”

The same principle could apply to adult-only content.

A service may only need proof:

18+ : YES

rather than necessarily requiring:

name + surname + address + full date of birth + document number.

This distinction between verifying an attribute and revealing an identity could become an important element of future child-protection systems.

Protecting Children Must Not Create an Infrastructure for Tracking Them

There is another side to age verification.

More verification can mean greater safety.

But a poorly designed system can also mean more data collection, greater centralisation and more opportunities to track children’s digital behaviour.

Privacy should therefore be incorporated into the architecture of such systems from the very beginning.

The objective should not be:

to know which child visits which website.

The objective should be:

to reliably verify whether a user meets the condition for access.

“Do not verify more than necessary. If a service needs age, verify age. If it does not need identity, do not request it.”
— Institute 1. april

Age Verification Alone Will Not Solve Every Problem

An age threshold is not a complete solution to children’s online safety.

Children may use devices belonging to other people. Access controls can potentially be circumvented. Fake accounts, identity misuse and many other forms of abuse remain possible.

Technology also cannot replace parents, schools, professionals, regulators, law-enforcement authorities or the responsibility of digital platforms.

However, more reliable and privacy-preserving age verification could represent one component of a broader protection system.

EU KIDS Act May Be the Beginning of a Wider Debate

The European Commission’s proposal moves the discussion beyond the question of whether children should receive stronger protection online towards another important question: how should such protection be implemented technically?

Slovenia, while supporting a common European approach, has also emphasised the responsibility of digital service providers and the need for products to be safe before they reach minors.

For Institute 1. april, this raises a particularly important research question:

Can future systems verify a child’s age and right of access without turning age verification into a new system for the mass collection of identities?

QEI Child Protection represents one of the research concepts through which we want to explore this question.

Not as a finished solution.

Not as part of the EU KIDS Act.

But as a possible technical approach that must be researched, tested and critically evaluated.

“Good child protection should not require a choice between safety and privacy. The challenge is to develop systems capable of verifying what is necessary without learning everything.”
— Institute 1. april

Note: The EU KIDS Act is a legislative proposal presented by the European Commission on 17 September 2026 and will be subject to the further legislative process. QEI – Quantized Encrypted Identity and QEI Child Protection are development and research concepts of Institute 1. april. QEI is not part of the EU KIDS Act, and this article does not claim that the European Commission or the Republic of Slovenia proposes the use of QEI. Any potential practical implementation of such an approach would require technical and security validation, legal assessment, privacy and data-protection impact assessments, as well as the involvement of experts in child protection, digital identity and cybersecurity.

Official sources:
European Commission – EU KIDS Act
Republic of Slovenia – response to the EU Kids Act