Guidelines on the Protection of Minors under the Digital Services Act
European Union · Guideline · European Commission
Our summary
The European Commission released non-binding guidance to help online platforms create safer environments for children and adolescents by addressing risks such as grooming, exploitation, harmful content, and cyberbullying. The recommendations cover account privacy settings, content recommendation systems, blocking tools, age verification methods, and restrictions on manipulative commercial and design practices. These guidelines serve as a benchmark for evaluating whether platforms comply with Digital Services Act requirements and may guide national enforcement authorities.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
31 sections
Jump to a chapter
1 Introduction
Online platforms offer minors access to educational resources and social opportunities, but consensus exists that their privacy, safety and security are often inadequate due to risks including illegal and harmful content, cyberbullying, sexual exploitation, trafficking, radicalisation, consumer risks, overuse, and impacts from artificial intelligence systems. These guidelines aim to help platform providers adopt measures to mitigate these risks and assist national regulators in interpreting Article 28 of the Digital Services Regulation.
2 Scope of the guidelines
These guidelines explain how online platforms accessible to minors must implement privacy, safety and security measures under the Digital Services Act; a platform is accessible if its terms permit minors to use it, if it targets or is heavily frequented by minors, or if the provider knows minors use it, and cannot avoid this scope by merely prohibiting minors unless it effectively enforces that prohibition. Platforms must be aware minors are recipients when they process age data during registration, when they appeal to or offer services known to minors, when promoted to minors, or when research identifies minors as recipients; this obligation does not apply to micro or small enterprises unless designated as very large platforms by the Commission. These guidelines complement other Union and national legislation protecting minors online and are used by the Commission as a benchmark for assessing compliance with Article 28, though adoption does not automatically ensure compliance; only the Court of Justice can authoritatively interpret Article 28, and providers may apply other measures complying with Union law, national guidance or technical standards if deemed appropriate and proportionate.
3 Structure
The guidelines establish general principles for minors' protection in Sections 4 and set out main measures in Sections 5 to 8: risk assessment, service design, reporting and user support, and governance.
4 General principles
Platform providers must ensure measures to protect minors' privacy, safety and security are proportionate and appropriate based on risks specific to their service, impact on children's rights, and applicable standards; treat the best interests of the child as a primary consideration; prevent discrimination; and respect all children's rights. Providers should embed these protections into platform design from the outset and design services to suit minors' developmental, cognitive and emotional needs with age-appropriate designs that respect their rights and account for their evolving capacities.
5 Risk review
Platform providers should conduct a review identifying risks to minors by examining likelihood of minor access, actual or potential impacts on privacy and safety based on platform features and user dynamics, existing mitigating measures, any additional measures needed, and how measures affect children's and other users' rights; this review must treat the child's wellbeing and interests as a fundamental priority, incorporate perspectives from children themselves, guardians and relevant experts, and include metrics to monitor effectiveness. Providers should use current scientific and academic sources and apply the precautionary principle when reasonable evidence suggests a feature poses risks to children. Providers must conduct reviews at least annually or when making significant platform changes, make outcomes available to supervisory authorities and publicly without sensitive details, and may use existing child rights impact assessment tools from organizations like UNICEF or CEN-CENELEC.
6 Service design
7 sections
This section covers service design measures including age assurance, registration, account settings, interface design, recommender systems and search features, commercial practices, and content moderation.
6.1 Age assurance
This section addresses age assurance measures, including when to implement them, which methods to use, and how to assess their appropriateness and proportionality.
6.1.1 Introduction and terminology
6.1.2 Determining whether to put in place access restrictions supported by age assurance measures
6.1.3 Determining which age assurance methods to use
6.1.4 Assessing the appropriateness and proportionality of any age assurance method
6.2 Registration
Providers may use registration or authentication to implement age assurance when necessary. Where registration is not required, providers must configure unregistered users' settings to ensure highest privacy, safety and security levels. When registration is offered, providers must explain its benefits and risks, ensure the process is accessible and understandable to minors, include age assurance measures, avoid encouraging underage access, allow easy logout and account deletion, highlight safety features and risks during registration, and limit requests for unnecessary personal information while seeking parental consent where required.
6.3 Account settings
This section addresses default account settings and the availability of settings, features and functionalities.
6.3.1 Default settings
6.3.2 Availability of settings, features and functionalities
6.4 Online interface design and other tools
Online platforms serving minors should adopt age-appropriate interface design with features enabling minor control over service use, blocking persuasive design (such as infinite scroll, artificial notifications, reward systems), customizable time management tools, accessible reporting mechanisms, and non-auto-activated AI features with risk assessments and clear usage indicators. Platforms must display technical warnings in child-friendly language that AI interactions differ from human ones and may be inaccurate or misleading, and should not prominently display AI chatbots with user contacts or nudge minors toward use, which minors and guardians may opt out of. Platforms are prohibited from using AI features to influence minors toward commercial content or purchases.
6.5 Recommender systems and search features
Describes how recommender systems affect what content, contacts or conduct minors encounter online and can amplify risks to their safety and security. Notes that platforms must comply with existing transparency obligations under the Digital Services Act for all platforms, plus additional requirements for very large platforms, and should implement measures for testing and adapting recommender systems design for minors and giving users control.
6.5.1 Testing and adaptation of the design and functioning of recommender systems for minors
6.5.2 User control and empowerment
6.6 Commercial practices
Requires platforms serving minors to prevent exploitation through commercial practices by accounting for minors' limited commercial literacy, avoiding harmful advertising suitable to different age groups, limiting excessive commercial content volume and frequency, preventing AI systems from nudging minors for commercial purposes, using clearly visible child-friendly commercial declarations, blocking marketing of products harmful to minors' health or safety, and prohibiting disguised advertising by platforms or users. Requires platforms to prevent confusion about economic transactions through techniques like virtual currencies, prohibit in-app purchases that appear necessary for free services, price paid items in national currency, block loot boxes and gambling-like random outcome features, prevent manipulative design techniques driving impulsive spending, offer guardian tools or parental consent for financial commitments by young minors, and review transaction policies based on children's evolving capacity to understand money.
6.7 Moderation
Online platforms accessible to minors must define harmful content and behaviour in cooperation with young people and experts, establish and enforce moderation policies prioritising reports from minors and considering likelihood and severity of harm, impact on minors, vulnerabilities, and number affected, and assess effectiveness as technologies evolve. Platforms must staff 24/7 moderation teams with adequate training and on-call emergency coverage in official Member State languages, use technology to prevent recommendation of harmful content to minors, build safeguards into AI systems against generating or disseminating harmful content, cooperate with other platforms on cross-platform harm detection, and provide fraud reporting channels for financial transactions. General monitoring obligations do not apply and platforms should share moderation metrics.
7 Reporting, user support and tools for guardians
3 sections
This chapter covers user reporting, feedback and complaint mechanisms that enable minors to address platform features affecting their privacy, safety and security, user support measures, and tools designed for guardians to help protect minors.
7.1 User reporting, feedback and complaints
Platforms must provide visible, child-friendly, accessible reporting and feedback tools available to minors and all users to report harmful content, activities, accounts, suspected underage users, and uncomfortable recommendations, with effective complaint systems for age assessment challenges. Reports must be confidential and anonymous by default with optional attribution, allow written reasons beyond categories, be accessible to unregistered users and those with disabilities, and include urgent indicators for minor safety concerns. Platforms must prioritize reports on minor safety, provide timely confirmations and explanations of actions taken, and regularly review reports to identify safety issues, refine moderation practices, and document responses.
7.2 User support measures
Platforms accessible to minors should provide child-friendly, clearly visible, immediately accessible support tools such as block and mute buttons to help minors report suspicious, illegal or inappropriate content, and should connect them with local Safer Internet Centres or child helplines. Support tools should limit use of AI and not be the main mechanism for interacting with minors. Platforms must display warning messages and links to support services when minors search for, upload, share or receive potentially illegal or harmful content, and refer minors to support lines immediately when they submit related reports.
7.3 Tools for guardians
Tools for guardians are software designed to help guardians oversee their minor's online activity and well-being while respecting the child's agency and privacy. These tools must complement, not replace, other safety measures required under the Digital Services Act, as they may fail in cases of split custody or absent guardians and their effectiveness depends on reliable verification of the consenting adult. Tools should be age-appropriate, grounded in communication and empowerment rather than control, and should be easy to activate without requiring account creation, work across devices, notify minors when activated, and allow changes only with the same authorisation level as initial activation.
8 Governance
4 sections
This section covers how platform governance contributes to protecting minors by ensuring their privacy, safety and security are prioritised and properly managed across the service, including subsections on general governance practices, terms and conditions, monitoring and evaluation, and transparency.
8.1 Governance (general)
Platforms accessible to minors should implement effective governance including internal policies on minors' privacy and safety; assigning responsibility to a dedicated person or team with resources and authority to access senior management and serve as contact for regulators and trusted flaggers. Platforms should foster child participation in design in safe and meaningful ways with feedback mechanisms; raise awareness of children's rights and risks; provide training to staff responsible for moderation and handling complaints; monitor compliance regularly; use state-of-the-art technological solutions; collect and report data on harms and risks to minors; and exchange good practices and technological solutions with other platforms, Digital Services Coordinators, trusted flaggers and civil society organisations.
8.2 Terms and conditions
Terms and conditions must comply with the Digital Services Act requirement to explain use conditions in clear, plain, intelligible, user-friendly language, and in ways minors can understand when primarily directed to or predominantly used by them. For platforms accessible to minors, terms should include information about account creation and deletion, community guidelines promoting safety, types of harmful content and behaviour, protection measures, and moderation tools and complaint processes; be easy to find and searchable; not unduly restrict minors' rights including freedom of expression; be upheld in practice; and have changes logged and published.
8.3 Monitoring and evaluation
Platform providers accessible to minors should regularly evaluate the effectiveness of their privacy, safety and security measures, including interface design, systems, tools and complaint mechanisms. They must consult with minors, guardians, experts and civil society on the design of these elements, including testing with minors from diverse backgrounds and abilities, and adjust their services based on consultation results and technical or policy changes.
8.4 Transparency
Platform providers accessible to minors must make easily accessible information available to minors on their platform about privacy, safety and security measures, including age assurance methods, recommender systems, complaint processes, integrated AI tools, registration, parental tools, content moderation, and reporting mechanisms. All information, warnings and communications must be child-friendly, age-appropriate, easy to understand, presented clearly and at relevant points, in official Member State languages, and engaging through graphics or videos, delivered gradually over time. Providers may disclose to the public information about measures and modifications they have adopted to fulfil their obligations under the Digital Services Act, to the degree feasible.
9 Review
Age verification systems must minimize risks to minors' privacy and data protection through appropriate methods collecting only necessary information, and self-declaration is unsuitable for high-level protection. Providers of AI systems must inform users they are communicating with AI, inform about commercial content clearly suited to the medium and audience, and avoid exploiting minors' vulnerabilities through misleading claims, scarcity tactics, or manipulative features; recommender systems should incorporate minors' feedback on discomfort. Complaint procedures cover age assessment and content removal, account suspension, and monetization restrictions, while video-sharing platforms must protect minors from harmful programmes by 19 December 2026, and platforms and providers should engage child helplines, provide training on children's rights, and address content, conduct, contact, consumer and cross-cutting risks including hateful content, grooming, cyberbullying, mental health harms, privacy breaches and addiction.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.