Consult the EU experts' report that will set the new rules for minors on social media

The supposed “new European regulation” on minors and social networks is still not in formal legislative processing in the EU. As of July 13, 2026, the European Commission has not registered any specific draft regulation or directive on minimum age or prohibition of social networks for minors; it is in a preparatory political and technical phase. What does exist is: an already active framework (the DSA), guidelines and a European age verification application, and a non-binding resolution from the European Parliament calling for a common “digital age”. In other words, the debate is politically very advanced, but the ordinary legislative procedure (Commission–Parliament–Council) has not yet started.

What the European Commission is doing today

According to the official note on the final meeting of the Special Panel on online child safety, on July 13, 2026, the co-chairs of this panel deliver to Ursula von der Leyen a recommendations report to “further strengthen the EU framework for the protection of minors online”. This report is precisely the input that should help decide whether the Commission presents a legislative proposal before the end of the year. No further information is available in the consulted sources about the specific content of the report or a fixed schedule to register a legal text.

The Commission is mainly using the Digital Services Act (DSA) as a basis:

• It has published a draft of specific guidelines on online child protection, subject to public consultation, as reported by the Representation in Spain in this note, and the European Data Protection Board itself analyzes that draft in its commentary.
• In July 2025, it formally presented the guidelines and a prototype age verification application under the DSA, according to the joint Commission press release at this link and the Basque Government summary at [link].
• It is activating proceedings against platforms that do not protect minors (for example, Meta/Instagram and Facebook) under the DSA, as explained in this note and in investigations on pornographic content in another press release.

Additionally, it is working on a European age verification application, described as “ready for Member States to customize and implement” in the same note from the Special Panel on online child safety (here). Democrata has followed this front in pieces such as “Goodbye to lying about age on the internet” and in the analysis of the offensive against Instagram in this news about infinite scroll.

What the European Parliament has done

The Parliament is not processing a specific law on minors and networks, but it has approved political resolutions that guide the Commission. The most relevant is the report from the Internal Market and Consumer Protection Committee on online child safety, covered by Democrata in “The European Parliament wants to restrict access of minors under 16 to social networks”.

In parallel, the official note from the European Parliament “New EU measures needed to make online services safer for minors” details that the Eurochamber proposes:

• A digital minimum age of 16 years to access social networks, video platforms, or AI apps on one’s own, never below 13 years.
• Age assurance systems that preserve privacy, without exempting platforms from designing “safe by design” services.
• Restrict addictive design practices and strengthen executive responsibility.

But these texts are non-binding resolutions: they serve as a political mandate to the Commission, they do not themselves initiate the ordinary legislative procedure. Other reports, such as that of the Spanish EPP Group in [link], emphasize this guiding character.

Why there is not yet a “European law on minors and social networks”

The key is that, for now, Brussels has chosen to fully exploit the existing framework (DSA, Audiovisual Services Directive, “Better Internet for Kids” strategy) and soft law measures (guidelines, applications, expert panels) before making the leap to a uniform prohibition or minimum age.

Media such as the newspaper Ara, in this report, highlight precisely that in 2025 the Commission presented “recommendations” and guidelines but avoided proposing a binding digital age of majority at the European level.

In parallel, several States (including Spain and France) are promoting their own national laws, and some governments – including Spain – have requested mandatory age verification at the EU level, as the Ministry for Digital Transformation reports in this note. Democrata details Spain’s role in pieces such as this information about Sánchez and the digital age of majority and the monitoring of the expert panel in this article.

Therefore, as of July 13, 2026, the “future European regulation” is in a phase of agenda setting and option design: expert report, guidelines under the DSA, and political pressure from Parliament. The strict legislative phase (registration of the Commission’s proposal and opening of negotiations with Parliament and Council) has not yet begun.

Ursula von der Leyen, as President of the European Commission, does not have a “personal” power to enact laws on digital protection of minors, but she does lead the body that holds the monopoly on legislative initiative in the EU and that applies the Digital Services Act (DSA). Her specific competences include setting the political agenda, ordering her services to prepare normative and technical proposals, creating and supervising expert groups, and leading the response against major platforms when minors are affected. Under her mandate, child protection has become one of the central pillars of the European digital agenda.

1. Political direction and priority setting

Von der Leyen uses the Commission’s authority to define the course of digital policy, placing child protection at the forefront. According to the newspaper Democrata, in her State of the Union speech she marked the protection of minors in digital environments as one of the priorities of her second term, particularly promoting a European age verification solution and a regulatory offensive based on the DSA, the Digital Markets Act, and future rules such as the so-called “Digital Fairness Act” (analysis on the verification app; Europe turns towards controlling technological power).

Institutionally, Democrata recalls that the Commission maintains the monopoly on legislative initiative in the EU, which the European Parliament is trying to temper (debate on legislative initiative). As President, Von der Leyen directs that power: she sets the work program, decides which legal proposals are prioritized and under what approach they are developed, including on minors and social networks.

2. Promotion of legal and strategic initiatives

Her role is seen in concrete decisions:

• Mandate for DSA guidelines on minors: The Commission has published a draft of guidelines for online child protection under Article 28 of the DSA, subject to public consultation until June 2025 (DSA guidelines draft). These guidelines direct how platforms should act to ensure a high level of privacy, security, and child protection; the political decision to develop and adopt them emanates from the College of Commissioners which she presides over.
• Plans to toughen the regulatory framework: Democrata’s analyses highlight that Von der Leyen has advocated going beyond mere market regulation and entering the sphere of the very definition of childhood in the digital environment, opening the debate on delaying the age of access to social networks and banning addictive designs aimed at minors (analysis article).

3. Creation and supervision of expert groups

Another key competence is to establish advisory structures. The Commission created, by decision of the President, a Special Panel on online child safety that must deliver recommendations to Von der Leyen on how to adjust regulation and public policies. According to the Commission’s official note (special panel on child safety) and Democrata’s coverage (information on report reception), that group presents its final report on July 13, 2026, with proposals that she must convert — if she deems appropriate — into legislative initiatives or implementing acts.

4. Promotion of technical tools: age verification

Operationally, Von der Leyen has ordered the development of a European age verification solution that can be used throughout the single market. Democrata details that the application is “technically ready”, will be open source, and will allow proving majority age without revealing other personal data (report on the European app). A joint Commission press release presents the prototype as part of the package for a safer online space for children (age verification press release).

The President uses her authority to invite Member States to integrate this solution into their national systems and future digital identity wallets, seeking to avoid 27 incompatible models. In a specific speech on AI and children, she insists that “there are no more excuses” because age verification technology is available and meets the highest privacy standards (speech at the AI and Children Summit).

5. Coordination, representation, and enforcement of the DSA

Von der Leyen also exercises representation and political coordination competences. She participates in leaders’ summits — such as the one convened by Emmanuel Macron on vetoing social networks for minors — where the Commission sits alongside heads of State and Government to harmonize national approaches (European alliance promoted by Macron).

Regarding DSA enforcement, the President sets the political line of a regulatory offensive that includes formal proceedings against TikTok, Meta, or Snapchat and, more recently, an ultimatum to Instagram to modify the “infinite scroll” due to the risks it poses to minors (ultimatum to Instagram; action plan against online harassment; regulatory pressure on TikTok). The political instruction is clear: to use the Commission’s competences to the fullest to demand risk assessments, design changes, and, if necessary, sanctions from platforms.

6. Limits of her competences

All these powers are conditioned by the limits of the Treaties: the President does not alone set the legal minimum age to use social networks — a competence that, as Democrata and the Commission itself recall, lies with Member States and their data protection and minors’ laws — nor can she impose additional obligations on “very large platforms” beyond what is provided in the DSA, because that requires a formal legislative procedure involving Parliament and Council (analysis on minimum age; explanation on competences and DSA).

In summary, her specific competences in digital protection of minors are of leadership, promotion, and execution: she decides that this is a priority axis of the European digital strategy, commissions normative and technical proposals, coordinates experts and Member States, and directs strict enforcement of the DSA against major platforms, but always within the collegiate framework of the Commission and subject to the legislative co-decision of Parliament and Council.

Future and recent European regulations do not require digital platforms to provide a classic “scientific proof” of safety as if they were medicines, but they do obligate them to demonstrate with documented risk assessments, exhaustive technical documentation, and robustness tests that their services and algorithms are safe for consumers, minors, and workers. This is articulated mainly through the Digital Services Act (DSA), the European Artificial Intelligence Regulation, and the new product safety and cyber resilience regulations. The Commission is beginning to fine and correct platforms precisely for not meeting that evidence standard, as shown by the cases of Temu, Shein, X, or TikTok. In practice, “scientifically demonstrating” means being able to show, before regulators and judges, serious risk analyses, verifiable technical tests, and records supporting that the service design minimizes foreseeable harms.

1. Digital Services Act: systemic risk and technical evidence

The DSA, fully applicable since February 2024, imposes reinforced obligations on “very large online platforms” (VLOPs). They must carry out, at least once a year, a formal systemic risk assessment linked to their algorithmic design: dissemination of illegal content and products, impact on fundamental rights, public health, minors, or civic discourse, and adopt effective mitigation measures. Democrata details how Brussels sanctioned Temu with 200 million for a “generic” assessment that did not provide specific, individualized, and documented evidence about the risks of its own services nor “verifiable technical evidence” about unsafe products sold on the platform, which is considered a serious breach of the DSA (Temu and DSA and the Commission’s official note at Temu fine).

Other proceedings opened against TikTok, Meta, or Shein reinforce this pattern: the Commission demands risk assessments based on the platform’s own data, access to data for independent researchers, and age verification and child protection mechanisms, as covered by several Democrata pieces (TikTok case, Shein case, tech companies showdown, minors on the internet). The Commission itself, in its e-commerce Q&A, emphasizes that marketplaces designated as VLOPs must assess and mitigate risks related to dangerous or non-compliant goods, as well as cooperate with market surveillance authorities (e-commerce Q&A).

2. European Artificial Intelligence Regulation: documentation and robustness testing

The new European AI Law introduces the most “scientific” safety standard for high-risk systems and general-purpose models integrated into platforms. According to the summary from the Spanish Electronic Administration Portal, high-risk systems must meet “strict” requirements, including:

• Risk reduction systems and prior risk assessment for health, safety, and fundamental rights.
• High-quality datasets, with bias control.
• Activity logging to ensure traceability.
• Detailed documentation on architecture, purpose, and data.
• Human oversight and high levels of robustness, accuracy, and cybersecurity.

All this obliges platforms deploying high-risk AI to carry out systematic technical tests before and during operation, something the official note presents as a risk-based and product safety approach (entry into force of the AI Law). Democrata also explains how the “Digital Omnibus” package and the future AI Office centralize AI supervision integrated into large platforms (new AI law and Digital Omnibus).

3. Product safety and cyber resilience

In parallel, the General Product Safety Regulation and the Cyber Resilience Act modernize product safety (also when sold via platforms). The Commission’s Communication on e-commerce clarifies that all products sold online or offline must be safe and that marketplaces have specific safety obligations in this framework (Safety Gate).

The Cyber Resilience Act, according to the Spanish institutional summary, introduces new responsibilities for hardware and software manufacturers, including the obligation to provide updates that fix vulnerabilities and transparency about cyber risks throughout the product lifecycle (Cyber Resilience Act and Cyber Resilience Regulation). The CNMC has requested, in line with this approach, to scale the new product safety requirements according to the size of SMEs and platforms and emphasizes that these must actively engage in removing unsafe products and ensuring seller traceability (CNMC and product safety and CNMC note at [link]).

4. What does “scientifically demonstrating” safety mean in practice?

In this ecosystem, a digital platform will be required, de facto, three blocks of evidence:

• Rigorous and specific risk assessments on their own systems (not generic sector ones), with data, methodological analysis, and mitigation plans, as the Commission insists in the Temu case and in investigations of X, TikTok, or Instagram (X and Grok, ultimatum to Instagram).
• Complete technical documentation of AI systems and data flows, required by the AI Law for high-risk systems and reinforced by future Commission transparency guidelines and AESIA (consultation on transparency and high risk, Spanish AI sandbox).
• Robustness tests and trials (technical tests, simulations, internal and external audits) that allow certifying accuracy, resilience against attacks, and absence of predictable serious failures, consistent with the robustness and cybersecurity requirements of the AI Law and Cyber Resilience.

If that evidence is insufficient, generic, or unverifiable, precedents show that the EU is already willing to initiate formal procedures and impose multimillion-euro sanctions, in addition to demanding deep redesigns of interfaces, algorithms, or age verification systems, as covered by numerous Democrata reports (supervision gaps in Spain, child protection, Grok, European cybersecurity and AI plan, TikTok and regulatory pressure, regulatory priorities 2026).