Brussels turns the screws on teen social media: what the Commission is actually proposing

On 13 July 2026, the European Commission confirmed it will table a proposal later this year that would tighten the rules on how minors in the EU can use social media. The package, previewed by European Commission President Ursula von der Leyen, contemplates outright bans for the youngest users, phased access for older teenagers, mandatory age-assurance on the platforms themselves, and new liability exposure for companies that fail to comply. Reporting published the same day sketches the contours but not the binding text; that text is not yet on the table.

The move is best read as Brussels escalating a regulatory fight it has been losing on the timeline. The Digital Services Act, in force across the bloc since 2024, already obliges the largest platforms to assess systemic risks to minors and to put "appropriate" mitigations in place. The 2025 guidelines from the European Board for Digital Services narrowed what "appropriate" means, with a tilt toward default protections: profile and messaging defaults closed, algorithmic feeds down-ranked for minors, advertising categorisation tightened. None of that has been enough to satisfy either Europe's parents' associations or, increasingly, its own Commissioners. The political question is no longer whether Brussels can regulate the platforms; it is how much further it is willing to go to make the rule stick.

What the Commission is signalling

The package, as previewed, has three moving parts. The first is an outright ban on social media access for the youngest children, with the exact age threshold to be set in the legislative text. The second is a phased-access model for older teenagers, in which younger teens would gain access to a more limited set of features than older ones, the design of which the Commission is still working through. The third is a duty on platforms to implement age-assurance mechanisms, in some form, and to accept civil liability when they fail. A formal Commission proposal is to follow the summer, in time for the autumn legislative cycle.

The logic is straightforward. Default-open registration has become a structural feature of the Western consumer-internet business. Replacing it with default-closed access for minors would, in theory, push the cost of compliance onto the platforms that monetise attention, rather than onto the parents and schools that pick up the downstream harm. The platforms have argued, with some justification, that accurate age verification at scale is unsolved. Brussels appears to have concluded that the absence of a perfect technical answer is not, on its own, a reason to wait.

The pattern across Europe

The Commission is not drafting in a vacuum. France adopted a law in 2024 requiring under-15s to obtain parental consent before creating a social media account; the Constitutional Council struck the most contested provisions a year later, but the consent requirement itself survived. Spain, Italy and Greece have moved in similar directions, with varying mechanics. Australia passed a world-first law in late 2024 imposing a hard floor of 16 on most major platforms. The US state-level picture is the inverse: a federal Kids Online Safety Act failed to advance in 2024, and the loudest recent moves are in the courts, with state attorneys general filing enforcement actions against the largest platforms under existing consumer-protection statutes.

This is the reference set the Commission is now drawing on, and it is the answer to a question the platforms have been asking for the better part of two years: which jurisdiction would be the first to move from the systemic-risk vocabulary of the DSA toward hard-edged, age-based access controls. The Commission's signal, on 13 July, is that the answer is going to be the EU.

What is genuinely contested

The package is a Commission proposal, not a law. The European Parliament and the Council will negotiate, amend, water down, or sharpen. The contested points are predictable. The age-assurance obligation is the obvious fight: technical methods differ on accuracy, on privacy, and on cost, and the Commission's own data-protection authorities have been ambivalent about biometric age-estimation. The civil-liability pillar raises its own set of issues, including the question of whether liability attaches per user, per breach, or per platform-policy failure, and whether the liability is administrative, civil, or both.

There is also a deeper question Brussels has not yet answered in public. The Digital Services Act treats the largest platforms as systemic gatekeepers, and routes enforcement through the Commission itself. Adding a parallel youth-protection regime with its own enforcement track risks either duplicating that architecture or competing with it. Officials who have followed the early DSA enforcement record, including the ongoing proceedings on minors' safety, will recognise the tension. The most likely outcome, if the legislative process runs to form, is a hybrid: a child-specific statutory floor that sits under the DSA's risk-mitigation framework, with a referral path back to the Commission for the largest cases.

The stakes, for the platforms and for the rest of us

For the platforms, the arithmetic is unwelcome but legible. The under-16 cohort is a meaningful, but not dominant, share of European daily-active users. The bigger exposure is the precedent: an EU rule that hard-bans a category of user, on safety grounds, with civil liability, and age-assurance obligations that, once deployed, are hard to retract. Other jurisdictions, including several US states, are watching.

For parents, teachers, and child-safety researchers, the package is the first credible attempt to translate two years of clinical and journalistic evidence about harm to teenage girls, in particular, into binding rules on the platforms themselves rather than on the children. The evidence base, drawn heavily from work commissioned by EU institutions and the UK regulator Ofcom, has converged faster than the legislative process.

For the rest of the policy world, the move reopens an older question. The Western regulatory project on Big Tech has, until now, been built on the language of process: transparency reports, risk assessments, mitigation duties, audits. The Commission, in previewing this package, is signalling that the next phase will be built on the language of outcomes: did the platform keep a child out, and if not, what does it owe. That shift is bigger than the teen question. It is a draft of the next decade of platform governance, and the platforms know it.

The Commission's proposal is expected in the autumn. This publication will update with the text and the early readings of the obligation thresholds once it lands.

Desk note: Monexus treats this as a platform-governance story first, a youth-protection story second. The wire framing of the day has run on parental anxiety; the more durable read is that Brussels is using the child-safety file to push the regulatory frame from procedural to substantive.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

• https://t.me/theverge_news/22049
• https://t.me/pirat_nation/11830
• https://commission.europa.eu/topics/digital-services-act_en
• https://digital-strategy.ec.europa.eu/en/library/guidelines-protection-minors-online-under-digital-services-act