Sweet Dreams Are Made of This: Three Features That Put a Child on the Bottom Line
For some background music when reading this post, we encourage you to (re)discover the Eurythmics performing “Sweet Dreams (Are Made of This)”.
The previous post in this series, You Spin Me Round, took the three features built to keep a child scrolling: the feed that never ends, the video that plays itself, and the notification built for return. The proposed fix was to switch off the harmful pattern by default, with the possibility to switch on left to the older child or the parent. Those three features share a common goal: to keep a child present as long as possible. The three features we examine in this post have some overlap but focus on a different objective. They convert presence into money.
The streak and the reward loop, the profile built to sell, and the box you pay to open look like unrelated features. They are three ways of running the same child through the same till, each in a different currency. The streak charges in anxiety. The profile charges in data. The box charges in money, sometimes a child’s own. The streak will look familiar after the last post, since a mechanic that rewards daily return is also a mechanic that keeps a child scrolling. It does, however, more than hold a child in the loop. It penalises the child for stepping out of it, and that is what places it here, among the features that treat a child as something to monetise rather than someone to protect.
The streak penalises a child for leaving
A streak counts the days a child has kept something going, a daily message, a daily visit, an unbroken run, and it often shows that count where the child and the child’s friends can see it. The number means only one thing: stopping will destroy it. A streak is therefore not always perceived as a reward for using the service. It can be seen as a penalty scheduled for the first day the child does not. Some children feel compelled to return to protect the number, not because they want to be there, and a shared streak makes the design worse, because it turns a friend into a hostage and logging off into a small betrayal. For a child still learning that their worth is not a figure that resets at midnight, that is a heavy thing to carry, and it is engineered.
EU law already treats manipulative, engagement-driven design as a harm. The Digital Services Act (DSA) requires services accessible to minors to put in place a high level of privacy, safety and security by design, and the Commission’s guidelines on the protection of minors describe reward-based and pressure-based mechanics among the patterns a provider is expected to design out. An earlier draft of that guidance actually singled out streaks and communication-based rewards specifically.
EU law still lacks a binding rule that covers every service a child can open and says streaks may not be built for minors at all. Brazil wrote that rule. Its ECA Digital statute, in force since March 2026, bans time-based reward mechanics for minors outright. The repository’s contributors make the same argument from the feature end rather than the age end. Leanda Barrington-Leach, of 5Rights, frames the ban as only part of the question and points to this kind of exploitative design as what a genuine plan has to address.
The fix on the card is pretty straightforward. No streaks or time-based rewards that penalise absence or lean on social pressure. No version of this feature serves the child, so there is nothing to leave switched on by default. A drafter does not need to define a permissible streak. A drafter needs only to say that a mechanic whose entire function is to penalise a child for logging off has no place in a service built for children.
The profile turns a child into the product
Behind the feed sits a second product, and under this scenario, the child is not the customer but the product. Every action a child takes, each video watched to the end, each pause, each search, feeds a profile, and the profile is sold to advertisers who want to reach precisely that child in precisely that mood. The profile does not record what a child needs. It records what a child can be sold, and it grows more accurate the longer the child stays, which is one more reason the features in the last post exist, since engagement is also the raw material the profile is built from.
This is the one feature in the series where EU law has already written the rule. Article 28(2) of the DSA prohibits providers from presenting advertising to a minor based on profiling that uses the minor’s personal data. The General Data Protection Regulation (GDPR) treats children’s data as meriting specific protection, on the reasoning that children are less likely to be aware of the risks and of their own rights. The prohibition is not proposed, not recommended, not still in draft. It is in force across the Union today.
What is missing is not the rule but its effect. The rule does not need rewriting. It needs the resourcing and the will to make it bite. The joint statement to the President of the Commission signed by a coalition of children’s rights organisations, together with the work of Euroconsumers and 5Rights, presses that point: the profiling ban already on the books has to be enforced.
The card fix therefore simply says what the law already states. A minors instrument that restated the prohibition would place a second text over the same conduct and hand a provider room to argue about which one governs. The useful move is the opposite: leave the prohibition where it stands, and give the enforcer what it needs to apply it.
The loot box sells a child a gamble
The third feature charges the child directly. A loot box, a card pack, a randomised reward, is a sealed container a child pays to open, in real money or in a currency bought with real money, without knowing what is inside. The value is deliberately uncertain, and the near miss, the almost-got-it that lands just often enough to keep the child paying, is the mechanism a slot machine runs on. A child has fewer defences than an adult against that mechanism, and in many cases does not have the adult’s understanding that this is, in function, gambling. The feature takes a child’s pocket money, or a parent’s card (sometimes left logged in), and returns a manufactured thrill calibrated to demand the next payment.
EU law reaches this feature only in pieces. Gambling is largely a matter for national law, and some member states have acted at that level. Slovakia’s draft measures reach loot boxes directly, and as far back as 2018 Belgium’s Gaming Commission classified paid loot boxes as illegal gambling under its Gaming and Betting Act. What the EU has not done is write a single harmonised rule that closes the mechanic for minors regardless of the label a given platform chooses to give it.
The EU institutions are now reaching for that rule. The European Parliament’s Internal Market and Consumer Protection Committee (IMCO), in its October 2025 position on making online services safer for minors, called for action on loot boxes and gambling-like mechanics aimed at children. The Committee of the Regions (CoR), in its opinion on child-safe design, joined the call to restrict chance-based reward mechanics. Neither text is binding, and both point at the same gap: an unsuitable mechanic inside a game rated as suitable.
The card fix draws the line where the harm is. No chance-based reward mechanisms for minors: loot boxes, virtual slot mechanics, randomised rewards. As with the streak, there is nothing here to preserve behind a setting. A drafter does not have to decide how much gambling a fifteen-year-old may safely do inside a game. The honest figure is none, and the resemblance to gambling is not a metaphor a platform should be free to keep arguing with.
These three call for a line, not a default
The last post ended on a switch. Its three features had a legitimate version worth leaving available to the older teenager or the parent, so the drafting move was a safe default and a dial the household could turn. These three do not offer that. A streak built to penalise absence, a profile built to be sold, and a box built to be gambled have no honest child-facing setting to leave switched on. Regulating the feature here means drawing a line the feature may not cross when the user is a child.
That line points at the repository’s first principle, which is to prove it safe before it ships. The question a drafter should ask of each is whether it should have reached a child at all, not whether a regulator can catch it after the fact, and the party that has to answer is the one that built the feature and profits from it. A design that cannot survive that question is a design that should not ship.
A plan says children should not be monetised
Eurythmics sing that some of them want to use you and some want to be used by you, and over that bright synthesised march the line reads like a flat report on how the world divides. A platform built around these three features has already chosen its half of it. It wants to use the child, for the anxiety a streak generates, the data a profile sells, and the money a box extracts, and it has arranged the design so that being used feels, to the child, like keeping a friendship alive or winning a game. The sweetness is the point, but the dream is somebody else’s.
We spent the first half of this year asking whether a ban is a plan. The repository now sets out what a plan looks like, feature by feature, and these three are the ones a ban never touches, because a ban asks how old the user is and then walks away, leaving the till running.
Written by Caroline De Cock, LL.M., Head of Research
