Talk to usTry the demo

Protecting Minors Under the Digital Services Act: What Article 28 and the Commission Guidelines Ask of a Platform

Regulation and standards

For: Product owner, trust and safety lead or counsel at an online platform that minors can reach in the European Union

Article 28 of the Digital Services Act read in full: who it covers, what the Commission guidelines say about age verification and estimation, and the first enforcement step.

For information; not legal advice.

If your service lets people post, share or publish content, and teenagers can open an account, one article of the Digital Services Act is written for you. Article 28 is four short paragraphs, and the Commission has since published a long set of guidelines on how to apply the first of them. This article reads the text of the Article, the recital that explains it, the way the Commission and two Spanish authorities describe the guidelines, and the Commission's first enforcement step on age verification, and it ends with a checklist for a product team.

It complements the broader article on age assurance and age verification, which compares the EU, the United Kingdom, Australia and France. This one stays inside the Digital Services Act and follows the duty from its legal text to its enforcement.

Who the Article applies to

The Article speaks to "providers of online platforms accessible to minors". Three terms in that phrase decide whether you are covered.

Online platform. The Regulation defines an online platform as a hosting service that, at the request of a recipient of the service, stores and disseminates information to the public. The definition carves out a feature that is a minor and purely ancillary part of another service, if it cannot be used without that service for objective and technical reasons and its integration is not a way round the Regulation. A pure messaging tool, a company website without user content and a shop without public posts are therefore a different question from a social network, a video-sharing service or a marketplace with public reviews.

Accessible to minors. The recital that explains Article 28 gives three tests. A platform can be considered accessible to minors when its terms and conditions permit minors to use the service, when the service is directed at or predominantly used by minors, or where the provider is otherwise aware that some recipients are minors, for example because it already processes personal data of recipients revealing their age for other purposes. The first test matters most in practice: a platform that sets a minimum age in its terms has said that minors above that age may use it.

Not a micro or small enterprise. Article 19 excludes the whole section of additional rules for online platforms, which includes Article 28, for providers that qualify as micro or small enterprises under the Commission's recommendation on the definition of such enterprises. The only provision of that section that still applies to them is Article 24(3). The exclusion continues for 12 months after a provider loses the status, and it never applies to a very large online platform. The Commission's page on the guidelines repeats the scope: they apply to all online platforms accessible to minors, with the exception of micro and small enterprises.

The four paragraphs, one by one

Paragraph 1: the duty. Providers of online platforms accessible to minors shall put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security of minors on their service. Two words carry the weight. "Proportionate" ties the measures to the risk the service poses, which is why the guidelines are built around a risk review. "High level" is a result: the text does not list measures, so the Commission's guidelines are the nearest thing to a list.

Paragraph 2: no profiling advertisements. Providers shall not present advertisements on their interface based on profiling, as defined in the General Data Protection Regulation, using personal data of the recipient when they are aware with reasonable certainty that the recipient is a minor. This is a ban and not an obligation to take care. The test is awareness "with reasonable certainty", which means that a platform that runs age estimation or verification and learns that a user is a minor can no longer treat that user as an adult for advertising purposes.

Paragraph 3: no extra data. Compliance with the obligations of the Article shall not oblige providers to process additional personal data in order to assess whether the recipient is a minor. The recital explains it with the data minimisation principle of the General Data Protection Regulation: the prohibition on profiling advertisements should not lead a provider to maintain, acquire or process more personal data than it already has to assess whether a user is a minor. It adds that the obligation should not incentivise providers to collect the age of recipients before they use the service. Paragraph 3 does not forbid a check. It says that compliance does not oblige a provider to process additional data to assess whether a recipient is a minor, so that no general duty to collect an identity document or to count ages follows from the Article. Whether a particular check is allowed is then a question of necessity, proportionality and safeguards under data protection law. The joint post of the two Spanish authorities puts the warning in those terms: a platform that starts collecting identity documents or scanning faces without the necessary justification of proportionality, considering the risks its service poses to minors, and without appropriate privacy safeguards, runs the risk of violating the rights of all its users and Article 28(3). That is the tension every age gate has to resolve: the duty to protect minors needs a justified, proportionate and safeguarded check, and it is not a licence to ask everyone for documents.

Paragraph 4: the guidelines. The Commission, after consulting the European Board for Digital Services, may issue guidelines to assist providers in the application of paragraph 1. Note that the power covers paragraph 1 only. The ban in paragraph 2 and the data limit in paragraph 3 are in the text itself.

What the guidelines are, and are not

The Commission published its guidelines on the protection of minors under the Digital Services Act on 14 July 2025. The official Communication carries the reference C/2025/5519 and is dated 10 October 2025 in the Official Journal. Its title says what it covers: measures to ensure a high level of privacy, safety and security for minors online, pursuant to Article 28(4) of Regulation (EU) 2022/2065.

The Commission describes them as a non-exhaustive list of proportionate and appropriate measures. It also states how they will be used: the Commission will use the guidelines to assess compliance with Article 28(1), they will serve as a reference point for checking whether platforms that allow minors meet the standards, and they may inform national regulators in enforcement. Following them is voluntary and does not automatically guarantee compliance. The practical reading is that a platform can choose a different measure, but it then carries the burden of showing that the measure is as effective.

The Commission lists the process behind the text: a call for evidence, stakeholder workshops in October 2024 and June 2025, a targeted public consultation, engagement with children and young people, and meetings of the European Board for Digital Services.

Measures beyond the age gate

Age assurance gets the attention, but the guidelines are wider, and a platform that builds only a gate has addressed a fraction of them. According to the Commission's summary, the key recommendations include these.

  • Set minors' accounts to private by default, so that personal information and content are hidden from people the minor is not connected with.
  • Modify recommender systems to lower the risk that children meet harmful content or get stuck in rabbit holes, including by prioritising explicit signals from children over behavioural signals.
  • Let children block and mute any user, and make sure they cannot be added to groups without their explicit consent.
  • Prohibit accounts from downloading or taking screenshots of content posted by minors.
  • Disable by default features that contribute to excessive use, such as communication streaks, ephemeral content, read receipts, autoplay and push notifications, and put safeguards around chatbots integrated into platforms.
  • Make sure children's lack of commercial literacy is not exploited, including through manipulative practices, certain virtual currencies and loot boxes.
  • Improve moderation and reporting tools, require prompt feedback, and set minimum requirements for parental control tools.

The joint post of the Spanish markets regulator and data protection authority adds the operational areas that the guidelines cover: risk reviews, service design, user reporting, feedback and complaints, and internal governance. It also notes that the Commission encourages platforms to apply the measures to all users, not only to minors. The text of the guidelines is more exact than either summary on two of these points. On governance, paragraph 84 says providers should assign a dedicated person or team to minors' privacy, safety and security, with enough resources and authority to have direct access to the senior management body, and that this person or team should be a central point of contact for regulators, users and trusted flaggers. On the risk review, paragraph 21 says it should be carried out at least annually or whenever significant changes are made to the design of the platform, and paragraph 22 names existing tools for child rights impact assessments, among them templates from UNICEF, the Dutch Ministry of the Interior and Kingdom Relations and the European standardisation body CEN-CENELEC.

Age assurance in the guidelines

The part of the guidelines on age assurance is Section 6.1, and the rest of this part reads its numbered paragraphs. Paragraph 29 starts from three families: self-declaration, age estimation and age verification. Self-declaration relies on the individual to supply an age or confirm an age range, typically by clicking a button. Age estimation establishes that a user is likely to be of a certain age, to fall within a range, or to be over or under a certain age. Age verification relies on physical identifiers or verified sources of identification that provide a high degree of certainty. Paragraph 30 names the difference: verification provides certainty about the age, estimation provides an approximation, and the accuracy of estimation may vary and improve as technology progresses.

Decide first whether to restrict

Paragraph 31 says a provider should first assess whether an access restriction supported by age assurance is appropriate and proportionate, or whether a high level of protection can be reached with less far-reaching measures, and that age assurance cannot substitute for the measures recommended elsewhere in the guidelines. Paragraph 32 adds that the Commission considers providers should make the result of that assessment publicly available on the online interface of the service, whether it concludes that a restriction is needed or not. Paragraph 34 asks providers that find a restriction necessary to give information about the solutions they identified and their adequacy, with an overview of the performance metrics used, such as false positive and false negative rates, and accuracy and recall rates. Paragraph 33 warns against a shortcut: a lower accuracy of an estimation method does not automatically mean a lower impact on rights, because less accurate solutions may process more personal data and may keep out some children who could otherwise enter.

When verification, when estimation

The Commission's summary gives the short version. Age verification methods are recommended to restrict access to adult content such as pornography and gambling, or when national rules set a minimum age to access certain services, such as defined categories of social media services. Age estimation is recommended in other cases, such as when terms and conditions set a minimum age below 18 because of identified risks to minors.

The guidelines give the conditions in more detail. Paragraph 37 lists four circumstances in which the Commission considers access restrictions supported by age verification appropriate and proportionate.

  • Certain products or services pose a high risk to minors that less restrictive measures cannot mitigate, with the examples of alcohol, tobacco or nicotine-related products, drugs, any type of pornographic content and access to gambling content.
  • Because of identified risks to minors, the terms and conditions require a user to be 18 or older, even where the law sets no formal age requirement.
  • The provider has identified other risks to privacy, safety or security, including content, conduct, consumer and contact risks, that less intrusive measures cannot mitigate as effectively as an access restriction supported by age verification.
  • Union or national law prescribes a minimum age to access certain products or services offered or displayed on the platform, including defined categories of social media services.

Paragraph 38 deals with estimation inside those four cases. Estimation can complement verification, or serve as a temporary alternative where verification measures that meet the effectiveness criteria are not yet readily available. The Commission states that this transitional period should not extend beyond the first review of the guidelines.

Paragraph 47 lists where estimation is appropriate and proportionate on its own. It attaches conditions: the estimation is provided by an independent third party or through systems independently audited for security and data protection, and it is done ex ante where that is needed for the measure to work. The first case is a service whose terms set a minimum age below 18 because of identified risks to minors. The second is a medium risk in the provider's risk review that less restrictive measures cannot mitigate, where the risk is not high enough for verification but not low enough for no restriction, or for a restriction supported only by self-declaration. Paragraph 52 states that self-declaration does not meet the requirements of robustness and accuracy, so the Commission does not consider it an appropriate age assurance method.

Two worked examples from the guidelines

The guidelines illustrate paragraph 47 with a poor practice that shows what accuracy means at a threshold. A social media provider sets a minimum age of 13 on the basis of medium risks and enforces it with an estimation model of its own that it claims predicts age with a margin of error of plus or minus 2 years. The guidelines conclude that, because of the margin, many minors below the age can enter and many who meet the age cannot, so the measure is not highly effective and does not ensure a high level of protection. A second poor practice in paragraph 48 concerns redress: when the estimation says the user is too young, a pop-up invites the user to try again with the same method, and the guidelines say this is neither appropriate nor proportionate because no other method and no way to challenge the result is offered. The same paragraph says a provider that finds restrictions necessary should offer more than one method, and carry it out where possible at account creation. The good practice in the guidelines is the opposite case: a betting platform that restricts its service to adults by law and relies on the EU age verification solution, which tells the provider only whether the user is at least 18, created by a trusted issuer from the national electronic identity of the user.

Gate the risky part, not the whole service

Paragraph 36 says that a platform with only some risky content, sections or functions should not age-restrict the service as a whole. It should assess which content, sections or functions carry risk and put access restrictions supported by age assurance around those, such as adult-restricted sections of a social media service or adult-restricted commercial communications and product placements by influencers, which should be open only to adults whose age has been verified. For a product team this is the most useful design instruction in the section, because it moves the age check from the front door to the specific feature that creates the risk.

Five criteria for the method

Paragraph 49 tells a provider to consider five features of any method before it decides: accuracy, reliability, robustness, non-intrusiveness and non-discrimination. Paragraph 50 draws the consequence: a measure that does not achieve these criteria cannot be deemed appropriate and proportionate. The text adds detail that a summary loses.

  1. Accuracy is assessed against appropriate, clear and publicly available metrics, and the provider should periodically review whether the accuracy still matches the state of the art.
  2. Reliability means the method is available continuously and works in real-world circumstances beyond ideal lab conditions, and the data it relies on must come from a reliable source; the guidelines say a self-signed proof of age would not be reliable.
  3. Robustness is how easy the method is to circumvent, assessed case by case and with regard to the age of the minors addressed, and a method that is easy for minors to circumvent is not considered effective.
  4. Non-intrusiveness means choosing the less intrusive method where two give the same level of assurance, processing only the age-related attributes strictly necessary, and in no circumstances storing or using the data for other purposes.
  5. Non-discrimination means the method is appropriate and available for all minors regardless of disability, language and the other personal backgrounds the text lists.

Paragraph 53 closes a loophole: when a third party carries out the age assurance, the provider must explain this to minors in an accessible and child-friendly way and remains responsible for ensuring the method is effective, including where it relies on solutions provided by operating systems or device operators.

These five map onto questions a buyer can ask a supplier; for accuracy of face-based estimation specifically, see the article on how age estimation accuracy is measured.

Tokens, the wallet and the blueprint

For the methods that remain, the guidelines promote tokenised, double-blind approaches. Paragraph 39 says age verification should be a separate process not connected with other data collection, and that it should not entitle providers to store personal data beyond information about the user's age group. Paragraph 41 says methods that rely on verified government-issued identification without giving the platform additional personal data may be effective if they are based on anonymised age tokens, issued after reliable verification and by an independent third party rather than by the platform. Paragraph 46 encourages double-blind methods: the platform receives only what is needed to confirm that the age threshold is met, and the verification provider does not learn which services the proof of age is used for. The Commission says that the European Digital Identity Wallets and, before they become available, the blueprint for age verification on which applications can be built will provide a compliance example and a reference standard for a device-based method. In March 2026 the Commission described its age verification app as being tested with Member States, online platforms and other third parties, and as fully interoperable with the future wallets.

Very large platforms: the risk assessment route

The largest platforms have a second, independent route to the same subject. Providers of very large online platforms must assess systemic risks, and Article 34(1)(d) lists any actual or foreseeable negative effects in relation to the protection of public health and minors, among others. Article 35(1)(j) then names, among the mitigation measures, targeted measures to protect the rights of the child, including age verification and parental control tools, tools aimed at helping minors signal abuse or obtain support, as appropriate. For these providers, the question is therefore not only whether Article 28 is met, but whether the annual risk assessment identified minors as a risk and whether mitigation was effective.

Enforcement: the first age verification case

The Regulation leaves penalties to the Member States for the providers within their competence, and caps the maximum fine for a failure to comply with an obligation at 6% of the annual worldwide turnover of the provider in the preceding financial year. It caps fines for supplying incorrect, incomplete or misleading information, failing to reply and failing to submit to an inspection at 1% of annual income or worldwide turnover. The Commission's press release of 26 March 2026 confirms the same 6% ceiling for its own non-compliance decisions on very large platforms, and adds that it can impose periodic penalty payments.

That release shows how the guidelines are used. The Commission opened formal proceedings against four pornographic platforms on 27 May 2025 and, on 26 March 2026, preliminarily found them in breach for failing to protect minors from exposure to pornographic content. It said it used the 2025 guidelines as a benchmark for the obligation to ensure a high level of privacy, safety and security for minors, and that they identify age verification as a proportionate and effective measure against minors reaching adult content services. Its preliminary findings fall into two groups, and both are instructive for any platform.

  • On the risk assessment, the Commission found that the platforms did not diligently identify and assess the risks to minors, did not use objective and thorough methodologies, and emphasised business concerns such as reputational damage over the societal risks to minors.
  • On mitigation, it found that although the terms of service say the services are for adults only, all four platforms let minors in with a single click confirming they are over 18.

The Commission wrote that self-declaration is not an effective measure. It also considered that page blurring, content warnings and "Restricted to adults" labels, deployed by all four, do not effectively prevent minors from accessing harmful content, and that the platforms need to implement privacy preserving age verification measures. The release adds that the findings do not prejudge the final outcome, and that the platforms may reply in writing and take measures to remedy the breaches. In parallel, national Digital Services Coordinators are carrying out a coordinated action against non-compliant smaller pornographic platforms.

These are preliminary findings against specific providers and not a rule of general application. They are still the clearest published signal of what the Commission treats as insufficient: a click-through declaration, and cosmetic friction that a child can pass.

A checklist for a product team

  1. Decide whether you are an online platform within the definition, and whether the micro or small enterprise exclusion in Article 19 applies, or applied until recently and is still running out.
  2. Decide whether your service is accessible to minors under the three tests in the recital, starting with what your own terms and conditions permit.
  3. Write a risk review that treats minors' risks as societal risks, with a method you can show, and not as a reputational risk to the company.
  4. List the features that create risk and decide, feature by feature, which need verification, which can use estimation and which can rest on safe defaults.
  5. Score the chosen method on accuracy, reliability, robustness, non-intrusiveness and non-discrimination, and keep the evidence.
  6. Do not use a click-through declaration as a control in a high-risk or medium-risk case.
  7. Apply paragraph 3 of the Article: design the check so that it does not leave you holding more personal data than you needed, and prefer a token your platform receives over an identity document it stores.
  8. Switch off profiling advertisements for users you know with reasonable certainty to be minors.
  9. Work through the design measures, from private defaults to recommender changes and reporting tools, with the same care as the gate.
  10. Name an owner for the topic, and review the choices when the guidelines are reviewed.

Where this sits in a verification flow

The age check in NeuroVision KYC is part of a document-based verification session. The face match step compares the selfie with the portrait on the document in a one-to-one comparison, and includes foreign-face detection and an age check against the date of birth. The date of birth is read from the document and compared with the age window of your scenario. Whether such a check meets the criteria above for your service is a decision for your own risk review, and this article does not claim that it does. In the terms of the guidelines, it belongs to the verification family, because the age comes from a document.

To see the age check in your own scenario, contact the team.

Sources

All sources were fetched on 27 October 2026.

Ready to talk?

Tell us what you are building and we will help you plan the integration.

Talk to us