On September 17, the EU Commission published a draft for the proposed EU KIDS Act – which stands for Keeping Internet Digital Spaces Accountable and Trustworthy. The most controversial stipulations only apply to social networks and video sharing platforms, and include a ban for under 13s and restrictions for under 15 year old kids. But other stipulations apply to online games, AI companions, chat bots, app stores, and operating systems, and in this article, we take a closer look at the games-specific parts of the draft.
If approved, the rules would apply to all online games sold in EU territories, and introduce significant restrictions to common online features – the definition is extremely broad and could be held to cover everything from Roblox to the multiplayer mode of a disc-based game. Only games sold on discs with no relevant online modes are clearly out of scope. A borderline case might be games that are not actively sold within the EU, but that still attract some European players: for example, games sold on US storefronts. However, services and systems that are “designed for primarily educational purposes, and operated by educational establishments or organisations, or on their behalf” are exempt, as well as certain not-for-profit services.
“Login bonuses or loss of benefits when not playing for a certain time will often be prohibited for minors”
Providers of online games shall, in particular, ensure that excessive use by minors is not encouraged. Minors under the KIDS Act are persons under the age of 18. This means that, for example, login bonuses or loss of benefits when not playing for a certain time will often be prohibited for minors. It’s possible that there might prove to be a compliant way to incorporate such features, but it’s clear that they are viewed unfavourably no matter what.
These criteria have recently been of increasing relevance for age ratings under the PEGI and USK systems, but what the KIDS Act proposes is less nuanced and might pose difficult questions for persistent worlds. The difficulty is that the rule reaches beyond obvious loyalty mechanics. It targets anything that penalises a player for not returning at set intervals – and in a persistent world, the mere fact that the world keeps moving on can already operate as that kind of penalty, even where no bonus system exists. For designers, this shifts the question from “do we reward daily play?” to “does the game, taken as a whole, pull minors back on a schedule?” – a far harder line to draw.
Online protection
The draft act also states that contact between minors and other users must be restricted. In order to fulfil the new obligations, parental controls and age assurance solutions must generally be implemented by providers of online games (it might be that this is not required for titles that do not contain any of the features which would be problematic for kids), but the requirements are less strict than for social networks. In practice, that lighter touch means games are spared the hardest requirement: whereas social networks and video-sharing platforms must rely on a dedicated EU age verification solution, games can draw on age estimation and other proportionate methods, provided they are accurate, privacy-preserving, and not discriminatory. Self-declaration alone, however, is never enough. And where a game is distributed through an app store, part of the work is done upstream – the store already assesses the user’s age, and that signal can, with consent, be passed down to the game itself.
“Contact between minors and other users must be restricted”
There is also a provision on Codes of Conduct on age rating and online games. The aim seems to be to build on the existing PEGI framework, which is voluntary in most countries, and turn it into something legally binding. This also raises the question of what happens if an EU member state has binding youth protection rules under national law: that is, where PEGI is compulsory.
The question is particularly relevant in Germany, which has a dedicated set of rules at the state and federal levels, public regulators, as well as the USK, the industry’s self-regulatory system, which is backed by national law. The KIDS Act does not seem to leave much room for the USK to regulate the interaction risks dealt with in the KIDS Act (excessive usage and open communication), even though German law assigns these to the USK. In the end, there might be a discussion over whether the EU or the member states are competent to regulate these matters. Traditionally, youth protection was a matter for the member states, but the EU has an increasing appetite to harmonise this field.
Virtual currency and lootboxes: Regulated or not?
The KIDS Act also re-packages an old foe of the games industry. Recital 40 of the proposed act reads: “Minors playing online games should benefit from transparency as to the real monetary value of transactions carried out through virtual currencies and protection from exposure to variable reward systems.” The latter seems to refer to lootboxes, while the former refers to the discussions which are at the core of the BEUC Report and the CPC Key Principles.
Interestingly, the draft is contradictory on this point: for games, this appears only in the opening recitals (which explain the reasoning behind the law) and not in the operative text, where the economic transaction rules apply to social networks, video-sharing platforms, AI companions, and general conversational chatbots, but not to online games. This might have just been sloppy drafting, or it could be a deliberate choice to address monetisation transparency for games solely through the code-of-conduct mechanism. The most likely explanation is that there might have been some internal haggling at the EU Commission on this point.
In any event, discussions on this issue will certainly continue during the lawmaking process – in particular since this is an issue which was expected to be tackled by the EU Digital Fairness Act, the first draft of which is expected before the end of this year, and thus before the KIDS Act will be finally adopted.
AI shall not be a companion for minors
The KIDS Act newly regulates “general conversational chatbots” and, of particular interest to the games industry, “AI companions”. Such AI systems must, among other things, avoid design features and behaviours that simulate interpersonal relations that are likely to create emotional dependencies. They must also not, by default, use information or analysis from previous interactions with minors, except for safety reasons.
Additional strict rules apply to online games provided as part of a social networking service or video-sharing platform when they feature such AI systems: they must not be auto-activated or prominently displayed, and minors must not be encouraged to use them. An opt-out mechanism must be available at any time.
However, not all AI solutions used in games will qualify as an AI companion under the KIDS Act. A key criterion is that the system must simulate or facilitate a social, emotional, or interpersonal relationship with a user. This raises the question of whether LLM-powered NPCs whose interaction is directed at the fictional player character – rather than at the real user as a person – would fall within the definition. One could argue that they would not, as the relationship would be with the player character rather than with the user. That said, the definition also covers systems that merely facilitate such a relationship, which might cast the net more widely than it first appears.
“Providers of online games must offer content control tools”
Finally, providers of online games must offer content control tools enabling minors to manage and provide feedback on the content they are exposed to, with immediate and lasting effect. They must further implement interaction controls allowing minors to adjust how they interact, communicate, and create content within the service. All features, safety tools, and information required by the KIDS Act must be easily accessible and presented in a manner that minors can readily understand.
The existing EU Digital Services Act enforcement regime will apply to providers of most services, other than providers of AI companions and chatbots, which are instead subject to the AI Act’s regime. Providers that infringe could be subject to fines of up to 6% of their total worldwide annual turnover. For online games, the EU member states will each have to identify a regulator to supervise compliance.
Fast lane to adoption?
The KIDS Act is designed to be a regulation which will apply directly in the EU member states. The proposed text is not final: it must still be approved by the EU Parliament and the EU member states. Typically, the time between a first draft and the adoption of a final legal act in the EU is at least a year or two. But for the KIDS Act, it seems that the EU Commission is trying to push through the project quickly. Many observers were surprised that the Commission has already presented a fully fleshed out text, rather than starting with a high-level sketch.
Given that many countries worldwide see the regulation of social media as a priority, it is unlikely that the KIDS Act will go away – it may even be in the fast lane for adoption. And because some of its stipulations can be relevant for core gameplay and game design mechanics, the time to assess the impact is now.
The question for game designers is this: Should you rely on age assurance and restrict minors from accessing certain features? Or should you design the product in a way that everyone can use all of its features, even if this means that some features cannot be used?
Dr Andreas Lober is a partner with ADVANT Beiten and advises leading games companies, among others, on youth protection and consumer law. He thanks his colleagues Lennart Kriebel and Fabian Eckstein for their input on this feature.