The KIDS Act Shows Child Safety Does Not Require More Tracking

By Andrew Frost Moroz

The EU’s proposed KIDS Act shows that age assurance can protect children without turning every user into a richer data profile.

Europe is moving quickly to make the internet safer for children. The UK has tightened age-assurance rules, and the European Commission’s proposed KIDS Act would introduce common age rules and safety-by-design requirements across the EU.

The lesson for businesses is straightforward. If a service only needs to know whether someone meets an age threshold, it should prove that fact without building a broader identity profile.

Building privacy-first technology has made one thing clear to me. Child safety does not have to come at the expense of privacy.

Age verification without identity verification

Age assurance can easily turn into unnecessary data collection. A company needs to know whether a user is old enough, so it asks for an identity document or other sensitive information. Once collected, that data has to be protected and managed.

Most services, in practice, do not need to know who someone is. They need to know whether that person is above or below a particular age threshold. That’s all.

The EU is already moving towards that model. Its age-verification approach lets users prove that they meet an age requirement without sharing other personal information. The Commission’s KIDS Act explainer says certified tools should tell platforms only whether a user is above or below the relevant age. It also says the proposal requires zero-knowledge proof technology that cannot identify, locate or track the user.

If a service only needs confirmation that someone is over 15 or over 18, it should not automatically receive their name, address, document details or behavioural history. Keeping the verification limited to that one fact is the whole point of data minimisation.

Where should age verification happen?

A company can handle age verification directly or rely on an external verification layer that confirms only whether the user meets the age requirement. The choice affects both operations and privacy.

Businesses should ask:

• What engineering and maintenance work will this require?
• What happens when verification fails?
• Who stores the sensitive information used to establish age?
• Can the service receive only the result it needs instead of the underlying identity data?

If every website creates its own process for collecting identity documents or biometric information, more databases containing sensitive information will be created. Each becomes another system that has to be secured and another potential point of exposure.

The UK experience also shows that implementation can change user behaviour. After stronger age-assurance requirements became mandatory, daily VPN use rose from around 650,000 to more than 1.4 million at its peak. The UK government explicitly notes that the evidence does not suggest the increase was driven by children trying to bypass age checks.

The more important lesson is why people look for workarounds in the first place. Many users are unwilling to hand over an ID or facial scan to a website they do not trust simply to prove their age. If verification feels unnecessarily invasive, users may look for ways around it. Businesses therefore need to think about trust as part of the architecture itself. The less personal information a service asks users to surrender, the less reason it gives them to avoid the process.

The risk for privacy-first companies

Large platforms may already have enough information from account history and existing user data to estimate someone’s age. Privacy-first services often collect far less, which can mean adding a separate age-assurance step. Regulation should not make extensive profiling the easiest route to compliance.

This concern has already surfaced in the debate around the proposal. CCIA Europe, whose members include major technology companies, has warned that the KIDS Act could create additional privacy risks and overlap with existing EU rules.

The proposal itself takes an important position on profiling. For minors, its safety-by-design rules would limit profiling-based recommendations and require safer defaults across services used by children. For the largest platforms, it also reverses the burden of proof, requiring them to demonstrate that they can meet the law’s safety-by-design obligations before coming into contact with children.

That principle could go further. If companies have to demonstrate that a service is safe for children, they should also be able to explain why each category of personal data they collect is necessary in the first place.

If reducing tracking makes a service safer for a 13-year-old, businesses should ask how much tracking is genuinely necessary once that same user becomes an adult. The same principle should extend across the rest of the product, with regulation making data minimisation easier to preserve as users move through different age groups.

What should businesses build now?

The proposed KIDS Act points towards a broader safety-by-design model. It would shape how services recommend content to minors and how AI chatbots handle previous conversations. The Commission’s KIDS Act explainer says AI chatbots accessible to children under 13 would not be allowed to carry previous conversations into new ones by default.

That rule deserves attention beyond the age gate. If limiting conversational memory reduces privacy risks for children, companies should examine how much of that information they need to retain for adults as well.

Businesses preparing for this environment should keep age verification separate from the rest of the user profile wherever possible.

The design principle is simple. Verify only what the service needs and keep everything else out of the verification process.

There is a security benefit as well. Information a company never collects cannot later be exposed from its systems.

The KIDS Act remains a proposal and may change as it moves through the European Parliament and Council. But its approach already points towards a useful standard for businesses. Child safety should lead to better verification architecture, not broader surveillance.

The goal should be to prove the one fact a service needs without turning that proof into another reason to gather more information about every user. Privacy by design should not expire when a user turns 18. The standard we set for children should raise the bar for everyone.

About the Author

Andrew Frost Moroz is the founder of Aloha Browser, a privacy-first browser with more than 320 million downloads and 10 million MAU, and AlohaJet, a browser built for AI agents. Moroz built mobile apps and worked at Condé Nast Publishing, which shaped his strong conviction that privacy is a human right. He founded Aloha in 2015 on the principle of never collecting, storing, selling, or monetizing user data.