A proposed law meant to protect children online is, by the account of at least one detailed legal analysis, so riddled with drafting faults that it risks doing the opposite of what it promises. The European Commission unveiled its draft EU Kids Act in September 2026, aiming to impose new design and safety obligations on digital services used by minors, including social media platforms. The intention is defensible. The text, according to a newly published paper dissecting its provisions, is not.
The criticisms go well beyond stylistic nitpicking. The paper argues that recitals - the explanatory passages meant to guide interpretation - directly contradict the binding articles that follow them, leaving courts, regulators, and companies without a coherent reading of what the law actually requires. Scope definitions borrowed wholesale from other EU legislation, never designed with children's services in mind, appear to pull unrelated products into the regulation's net: book-recommendation sites, music streaming platforms, even fitness trackers. For readers trying to understand how such rules might reshape everyday digital life, the situation echoes debates already familiar to anyone following online privacy policy, where tools such as VPNs from providers like this provider are often swept into regulatory conversations despite serving entirely different purposes than the platforms lawmakers originally had in mind.
Where the Architecture Falls Apart
At the center of the proposal sits an infrastructure for age assurance and parental responsibility attestation - mechanisms meant to verify who is a child and who may act on a child's behalf online. The analysis finds this framework strikingly thin when measured against the reality of modern family life. Blended families, shared custody arrangements, children in care, and households where parental authority is contested or unclear are simply not accounted for. A law meant to protect vulnerable children appears, in practice, to assume a tidy nuclear-family model that no longer represents a large share of European households.
Design obligations fare no better. Provisions aimed at curbing manipulative or addictive interface patterns are written broadly enough, the paper argues, to be plausibly read as banning entire categories of technology outright - voice assistants among them. That is almost certainly not the Commission's intent, but intent is not what courts and compliance departments work from. They work from text. And when the text can be read to prohibit ordinary household devices, the law has failed a basic test of legislative craftsmanship.
Why Drafting Quality Is Not a Technicality
It is tempting to treat these as lawyerly quibbles, separate from the substantive question of whether children need stronger online protections. That separation does not hold. Ambiguous scope and contradictory provisions create genuine legal uncertainty for every company operating in the EU market, large or small, and that uncertainty translates into either overcautious compliance - stripping features and restricting access well beyond what child safety requires - or outright noncompliance by firms unable to determine what the law covers. Neither outcome serves children, parents, or the broader goal of a safer internet.
The paper's conclusion is blunt: the Commission should withdraw the proposal rather than attempt to patch it clause by clause. Digital rights legislation of this scale, touching millions of households and an enormous range of services, needs a text that regulators can enforce consistently and companies can actually follow. A policy direction can be sound while its legislative execution is not - and on the evidence presented, the EU Kids Act currently fails the second test, whatever one concludes about the first.