Games Without Frontiers: The EU KIDS Act Bans Loot Box Mechanics Everywhere Except Games

The leaked KIDS Act Regulation goes far beyond the leaked Communication that announced it. Its most consequential move sits beneath the proposed social media age limit: services would apply child-safety settings until they establish that a user is an adult through age assurance.

That choice turns age into part of the infrastructure of online participation. The Regulation combines it with guardian-controlled accounts for 13- to 15-year-olds, an attempted prohibition on screenshots of minors’ material, direct rules for emotional dependency in AI companions, and age checks for existing accounts. The Commission has moved from diagnosing harmful design to specifying how digital products should work.

Peter Gabriel called it Games Without Frontiers in 1980. The children in the song stood in for adults who had drawn the boundaries and preferred to keep the scoring to themselves. This Regulation draws a new boundary across the internet: between users treated as children by default and those whom a service accepts as adults.

This analysis concerns a leaked draft Regulation. Its article numbering, scope and wording may change before formal publication and during the legislative process. The assessment below concerns the leaked text as circulated.

Everyone begins behind the child settings

Article 8 requires social networks, video-sharing services, online games, AI companions, conversational chatbots and app stores to apply the Regulation’s child-safety design requirements by default. A provider may depart from those requirements after establishing that the user is an adult through age assurance.

The rule reaches users who never create an account. Article 32 extends the architecture to existing accounts, although providers may avoid a new check where they can establish with a high degree of confidence that the user is old enough. That exception raises its own question: which signals will produce confidence, and how much behavioural inference will be required to avoid formal verification?

The draft does not ignore privacy. Article 28 prohibits age-assurance systems from identifying, locating, tracking, targeting, advertising to or profiling users. It requires zero-knowledge proofs and limits storage to the age signal needed to avoid repeated checks. Article 29 nevertheless requires platforms implementing the under-15 rule to rely exclusively on a certified EU age-verification solution and an EU proof-of-age attestation.

Providers distinguishing adults from minors for these safety settings may use age-assurance methods other than the official EU solution, provided they satisfy the Regulation’s requirements on accuracy, privacy, non-discrimination and zero-knowledge proofs.

Those safeguards narrow the data exposed to a platform. They do not settle the architectural question raised by cryptographer Bart Preneel in the information labs social media ban repository: whether access to ordinary online settings should depend on participation in an age-assurance system. Privacy-preserving identification remains an access credential, even when the credential discloses only that its holder has crossed an age threshold.

Ages 13 to 15 become a parent governed internet

Article 6 prevents children below 15 from opening or using autonomous accounts on services that include livestreaming, contact with strangers, profiling-based recommendations, unsolicited recommendations or designs that encourage uninterrupted use. Children aged 13 to 15 could enter through an account created by a guardian.

The conditions are unusually prescriptive. Guardian tools must remain active. Guardians may set the daily limit, which cannot exceed one hour, pre-approve potential contacts and cap the number of contacts. The Regulation also instructs providers to respect minors’ agency and privacy and to ensure that parental controls do not restrict their rights disproportionately. Those principles will have to coexist with an account structure that places the decisive controls in adult hands.

A common age may prevent twenty-seven national regimes from fragmenting the internal market. Uniformity cannot determine where the line belongs or how much autonomy a 14-year-old should retain. The draft presents its administrative answer in detail while leaving the developmental and fundamental-rights balance open to argument.

Some rules ask code to control the physical world

Article 12 contains safeguards that are easy to understand and difficult to contest: private settings by default, protection of contact details, restrictions on strangers and livestreaming disabled by default. One requirement is different. Other users must not be able to download or take screenshots of a minor’s contact, location or account information, or of content uploaded or shared by the minor.

A service can remove its download button and block some device-level capture functions. It cannot prevent a second phone from photographing the screen. The provision therefore risks converting an outcome the legislator wants into an obligation no provider can guarantee. The eventual text will need to distinguish between reasonable technical measures and literal prevention. That distinction will decide whether the rule improves product design or produces permanent formal non-compliance.

AI companions and general chatbots receive their first relationship rules

The Communication appeared to send AI companions into an industry-led process. Article 14 of the Regulation changes that picture. It applies to AI companions and to general conversational chatbots capable of assisting users across multiple domains. Specialised customer-service, transactional, educational and similar task-specific systems are excluded.

Providers must avoid features and behaviours likely to create emotional dependency. They must also prevent compulsive or excessive use, introduce time limits and interruptions that protect school and sleep time, apply safe default settings and protect minors from transaction designs that encourage impulsive spending or expose them to variable rewards. Access for children below 13 must be controlled through guardian tools.

Memory receives its own rule. By default, a chatbot may not use information or analysis from a minor’s previous interactions in subsequent conversations, except where necessary for safety or to apply the chosen settings. When a companion or chatbot is embedded in a platform or game, it may not be activated automatically or displayed prominently. Minors may not be encouraged to use it and must be able to opt out at any time.

Providers must test for effects on health, safety, fundamental rights and physical, mental and emotional development before market entry. They must then monitor emerging harms and serious incidents, although micro and small enterprises are exempted from that post-market duty. These are direct legal obligations. An approved code may help demonstrate compliance; it does not replace the rules.

Enforcement would run through the AI Act framework, with fines of up to 6% of worldwide annual turnover for intentional or negligent infringements.

The twelve cards score ten out of twelve

SCORE  10 delivered   |   1 absent   |   1 deflected

The shift from three delivered cards in the leaked Communication to ten in the equally leaked Regulation is substantial. Autoplay is now covered. Engagement-based signals are disabled by default. Notifications, livestreaming and geolocation receive direct rules. AI companions move from commitments into binding obligations.

Card 7 remains missing. Profiling-based advertising to minors is already prohibited by the Digital Services Act, yet the Regulation adds no specific enforcement mechanism for that ban. The more revealing anomaly sits in card 11.

The loot box crosses the frontier into games

Article 13 prohibits social networks and video-sharing platforms from exposing minors to variable-reward systems, including purchases made with virtual currencies. Article 14 applies Article 13’s transaction safeguards to AI companions. Article 15, which governs online games, does not apply Article 13.

The mechanism is therefore prohibited around social media transactions and left outside the direct prohibition when it appears in the product most closely associated with it. Article 17 sends gaming monetisation practices into a code-of-conduct process built, where appropriate, on existing pan-European age-classification frameworks.

That drafting choice arrives with a paper trail. On the day the earlier Communication surfaced, Follow the Money and Die Zeit published an investigation into gaming-industry lobbying around the Digital Fairness Act. Of 186 Commission meetings on that file since January 2025, fewer than one in ten involved a non-commercial participant.

According to the investigation, Microsoft argued that parents could control in-game purchases through existing tools. Electronic Arts said that removing loot boxes would require it to rebuild its football title from the ground up. DG Connect’s deputy director-general discussed strengthening the industry’s own age-rating system while emphasising the importance of Europe’s growing games sector.

The meetings do not prove that lobbying produced Article 15. The drafting establishes the result: the Regulation is willing to prohibit the mechanism in one environment and negotiate its treatment in another. Industry can help determine how a rule works. Here, it retains influence over whether the rule reaches the centre of its revenue model.

The frontier is now proof of adulthood

The Regulation deserves credit for confronting product architecture. It recognises that children cannot carry the full burden of resisting systems designed to capture attention, spending and emotional reliance. It translates that recognition into stronger rules than the Communication promised.

Its defining frontier no longer separates feeds from games or platforms from companions. It separates users governed by child-safe defaults from users whom the system accepts as adults. Europe is deciding whether proof of age should become part of the basic architecture of online participation, how much control parents should exercise over adolescents, and which technical outcomes the law can realistically demand.

Children may benefit from the protections on either side of that frontier. Everyone will live with the infrastructure built to police it.

Written by Caroline De Cock, LL.M., Head of Research