Article 28, paragraph 1, of Regulation (EU) 2022/2065 (Digital Services Act or DSA) obliges providers of online platforms accessible to minors to take appropriate and proportionate measures to ensure a high level of privacy, security, and protection of minors on their services.
In August 2025, the European Commission issued Guidelines to describe the measures that should be adopted by providers of online platforms accessible to minors in order to ensure a high level of privacy, security and protection of minors online, in accordance with the aforementioned Article 28.
THE RECIPIENTS
The obligation set forth in this provision is addressed to online platform providers whose services are accessible to minors.
Recital 71 of the DSA further clarifies that «an online platform may be considered accessible to minors where its general terms and conditions allow minors to use the service, where the service is intended for or is predominantly used by minors, or where the provider is otherwise aware that some of the recipients of its service are minors”.
AGE VERIFICATION’
The most common age assessment methods currently available and applied by online platforms fall into three broad categories: self-declaration, age estimation, and age verification.
- the self-declaration (or Self-Declaration), which refers to the set of processes in which a user enters a date or selects a box on a form, even online, to declare that he or she is above or below a certain age, without providing any other evidence;
- the age estimate (or Age Estimation), which refers to methods that establish that a user is likely to be of a certain age, falls within an age range, or is above or below a certain age;
- age verification (or Age Verification), which refers to those systems that rely on hard (physical) identifiers and/or verified identification sources, which provide a high degree of certainty in determining a user's age.
The Commission clarifies that an online platform provider cannot simply state in its terms and conditions that its service is prohibited to minors in order to claim that minors do not actually access it and thus exempt itself from the scope of Article 28, paragraph 1, of Regulation (EU) 2022/2065.
In this context, the Commission emphasizes that the difference between age estimation and age verification lies primarily in the different levels of accuracy, believing that self-declaration is not an appropriate tool to ensure an adequate level of privacy, security, and protection of minors, as required by the legislation.
THE OBLIGATIONS
- Predicting settings default particularly protective in the accounts of minors
- Automatically setting children's accounts to private mode
- Restrictions on certain features in accounts of minors
- Provision of appropriate and sufficiently understandable interfaces for minors
- Limitations on the use of recommendation systems in relation to minors
- Limitations on minors' exposure to advertising content
- Provision of tools for appointed guardians that ensure parental controls that respect the rights and autonomy of minors
- Adapting moderation policies and reporting channels to make them child-friendly
- Provision of the ability for minors to block or deactivate any user
- Mandatory to allow blocking of unwanted users, prevent forced addition to groups, and prohibit screenshots or downloads of content posted by minors
- Provision of easily accessible support tools to enable minors to get assistance
- Monitoring obligations
Content edited by Avv. Silvia Mondini, Attorney. Francesca Milani, Dr. Beatrice Vignati
