Regulating Ahead of the Evidence — An Empirical Assessment of the EU Kids Act

Policy Analysis | Digital Regulation and Evidence. An empirical assessment of the EU Kids Act: causal inference, enforcement feasibility and the institutional cost of precaution.

Abstract

The European Commission's draft Kids Act, presented in September 2026, would prohibit independent social media accounts below the age of fifteen and mandate age verification across the single market. This paper evaluates the proposal not as a question of political preference but as a causal hypothesis. The legislation rests on an inferential chain of five propositions, each of which must hold for the intervention to deliver the outcome claimed for it. Drawing on multiverse analyses of adolescent well-being, the Australian natural experiment of December 2025, and independent biometric evaluations conducted by the US National Institute of Standards and Technology, the paper finds that the chain is weakest at precisely the points where the political debate has been most confident. It concludes that the Kids Act is better understood as an exercise in institutional precaution than as an evidence-led intervention, and that the resulting verification infrastructure imposes costs on the adult population that have not been estimated by any party to the debate.

1. The Proposal and the Analytical Question

On 16 September 2026, in her State of the Union address, Commission President Ursula von der Leyen announced a legislative package subsequently published as the Kids Act. Its architecture is tiered. Independent social media accounts would be prohibited below the age of fifteen; children aged thirteen to fifteen would be confined to parent-administered accounts with restricted functionality and a daily limit of one hour; users between fifteen and eighteen would remain subject to mandatory safe-design obligations. The instrument extends beyond social networks to video-sharing services, online games and conversational AI systems, prohibits specified engagement-maximising design patterns, and reverses the burden of proof so that providers must demonstrate the safety of their services rather than regulators demonstrate their harm.

Public commentary has concentrated almost exclusively on whether the objective is desirable. That question is not seriously contested: virtually no one argues that thirteen-year-olds benefit from unlimited exposure to engagement-optimised feeds. The more consequential question, and the one systematically absent from the debate, is whether the chosen instrument will produce the intended effect, and at what cost to parties who are not its intended targets.

This paper treats the Kids Act as a testable proposition rather than a moral stance. Any regulatory intervention of this type presupposes a chain of causal claims. If any single link fails, the intervention does not merely underperform; it delivers the full compliance cost while producing none of the projected benefit. The chain is set out in Figure 1 and Table 1 and examined in turn in Sections 2 to 5.

Figure 1: The inferential chain on which the Kids Act depends, with the strength of supporting empirical evidence for each link (author's rating, 0-100). Ratings reflect the author's synthesis of the literature discussed in Sections 2-5 and are intended as a structured summary, not a formal meta-analytic result.

• L1: Exposure causes measurable harm — contested; small effect sizes
• L2: Statutory age limit reduces exposure — Australian data: null to weak
• L3: Age can be verified reliably — improving, but error bands wide
• L4: No substantial displacement effects — migration to unregulated services
• L5: Net welfare gain exceeds side-effects — not yet estimated by anyone

Table 1: The inferential chain, stated explicitly

Sources: Orben and Przybylski (2019) and subsequent commentary; Barnes et al., BMJ (June 2026); NIST Face Analysis Technology Evaluation (2024-2026).

2. Link 1: The Magnitude of the Underlying Harm

The scientific literature on adolescent social media use is frequently invoked in political debate and rarely characterised accurately. Its central methodological difficulty is that exposure is self-reported, outcomes are self-reported, and the two are plausibly reciprocal: distressed adolescents may use more social media precisely because they are distressed. Establishing direction of causation therefore requires either longitudinal within-person designs or exogenous variation, and both remain scarce.

The most influential attempt to quantify the association is the multiverse analysis conducted by Orben and Przybylski, which estimated the relationship across tens of thousands of defensible model specifications rather than selecting one. The reported associations were consistently negative but very small — on the order of a few hundredths of a standard deviation. A subsequent Bayesian reanalysis of the same cohort data reported strong evidence favouring the null model over a substantial association, while also confirming considerable heterogeneity across specifications. Experience-sampling work has found that the direction of effect differs from adolescent to adolescent: in one real-time study, a plurality reported feeling better after passive use, a minority reported feeling worse, and a large group reported no change at all.

This literature is genuinely contested. Twenge, Haidt and colleagues argue that aggregating heterogeneous technologies and demographic groups suppresses real effects, that associations are non-monotonic, and that harms are concentrated among adolescent girls. Their critique has methodological force, and a 2026 commentary extends it to several widely cited null-result papers. The honest summary is not that social media is harmless but that the average population-level effect is small, unevenly distributed, and disputed by competent researchers acting in good faith.

Figure 2: The magnitude of the association, placed in context. Approximate standardised associations as reported in large cohort analyses of adolescent well-being. Values are illustrative of relative magnitude rather than definitive point estimates.

Figure 2 situates the estimate. The association between screen or social media use and adolescent well-being is of a magnitude comparable to that of wearing spectacles, and is dwarfed by the association with adequate sleep. This comparison is not rhetorical sleight of hand: it is the standard method by which epidemiology communicates effect size to policymakers, and it is the reason the original authors concluded that the finding was too small to justify legislative action.

None of this disposes of the case for regulation. Small average effects can conceal severe harm in a vulnerable tail, and tail risk is a legitimate object of public policy. But it does establish an important constraint: an intervention justified by a small, contested average effect must itself be cheap, reversible and well targeted. The Kids Act is none of these things.

3. Link 2: Does a Statutory Age Limit Reduce Exposure?

This is the link on which the entire edifice rests, and it is the only one for which a natural experiment now exists. Australia's Social Media Minimum Age Act took effect on 10 December 2025, prohibiting under-sixteens from holding accounts on ten designated platforms and exposing non-compliant providers to penalties of up to 49.5 million Australian dollars. The European debate has repeatedly cited Australia as a precedent. It has been markedly less willing to cite the Australian results.

An observational study by Barnes and colleagues, published in the BMJ in June 2026, surveyed adolescents before implementation and three months afterwards. More than eighty-five per cent of under-sixteens were still using the restricted platforms, notwithstanding that roughly two-thirds reported encountering an age check. Use was unchanged among twelve- and thirteen-year-olds, fell among fourteen- and fifteen-year-olds, and rose among those aged sixteen and above. The eSafety Commissioner's own compliance data from March 2026 indicated that approximately seven in ten under-sixteens retained accounts on the major services. A working paper co-authored by Cass Sunstein and Angela Duckworth estimated compliance among fourteen- and fifteen-year-olds at roughly twenty-seven per cent.

Figure 3: Australia's under-16 ban — measured compliance, first two quarters. Share of under-16s still using restricted platforms according to the BMJ observational study (3 months), the eSafety Commissioner (March 2026), the Molly Rose Foundation briefing (April 2026) and the 'Why Bans Fail' working paper (14-15-year-olds), with estimates ranging from 70% to 85%. Estimates are not directly comparable across sources: samples, definitions of use and measurement windows differ. The convergence of the direction of findings is nonetheless notable.

The mechanism of failure is instructive and should temper any expectation that the European design will perform better. As Figure 4 shows, the dominant pathway was not sophisticated evasion. The majority of adolescents who continued to use restricted platforms simply retained accounts that providers had never identified or removed. Secondary pathways — borrowed accounts, false accounts, private browsing — required no technical expertise. VPN use, the scenario that dominated pre-implementation commentary, was reported by very few respondents.

Figure 4: How the restriction was circumvented in practice, by reported prevalence among under-16 respondents (in descending order): retained an existing account (never removed); used someone else's account; created a false account; used a private browser; used a VPN. Ranges reflect variation across age bands within the surveyed population. Categories are not mutually exclusive.

Three qualifications are warranted. Three months is a short observation window; enforcement intensity typically increases over time; and the outcome measured was usage rather than well-being, which is the outcome that ultimately matters. A policy could in principle reduce harm without reducing measured usage, for instance by altering the character of exposure. Nevertheless, the finding that the intervention did not move its own proximate variable is the single most important empirical data point available to European legislators, and it points in the opposite direction from the political consensus.

It also produces a predictable dynamic. Confronted with non-compliance, governments do not generally abandon the instrument; they intensify it. The Australian Prime Minister announced in June 2026 that strengthening the legislation was a priority. Strengthening, in this context, means more rigorous identification — which is to say, less privacy for everyone. This is the ratchet that makes the design consequential well beyond its nominal subject matter.

4. Link 3: The Measurement Problem

A legal threshold is only as good as the measurement that enforces it. The Kids Act establishes two boundaries — at thirteen and at fifteen — separated by two years. Determining on which side of a two-year band a given user falls requires measurement precision that current technology does not reliably deliver.

The US National Institute of Standards and Technology evaluates facial age estimation algorithms against roughly eleven million operational photographs through its Face Analysis Technology Evaluation. Recent results show leading algorithms achieving a mean absolute error of approximately 1.25 to 1.55 years for subjects under eighteen, with error increasing for older cohorts. This represents substantial improvement: earlier evaluations reported errors of three to five years for teenage subjects, and independent analyses noted that fewer than a third of thirteen-year-olds were estimated within one year of their true age by any tested algorithm. Performance is also systematically uneven across demographic groups, with several vendors reporting weaker accuracy for adolescent female faces.

Figure 5: Measurement error against the precision the law requires — mean absolute error for ages 0-17 (leading algorithms), teen subjects (2024 evaluation), adults 18-30 and all ages (visa photo set), compared with the two legal boundaries set two years apart. Sources: NIST Face Analysis Technology Evaluation (Age Estimation and Verification), 2024-2026 releases, and vendor submissions to that programme.

The implication is structural rather than incidental. If mean absolute error is of the same order as the width of the legal band, then misclassification is not an edge case but a routine outcome. A regulatory design that cannot be enforced through estimation must fall back on documentary verification — government identity documents, bank credentials or state-issued digital wallets. That is the point at which a child-protection measure becomes an identity requirement for the adult population, since a platform cannot verify the age of the young without establishing the age of everyone.

Two consequences follow. The first is informational: a permanent, population-scale linkage between civil identity and online expression creates an asset whose value to future governments and to attackers is independent of the intentions of its designers. The second is economic: age assurance imposes fixed compliance costs and variable friction at the point of registration. Fixed costs are regressive with respect to firm size. Regulation drafted against large incumbents therefore tends, predictably, to consolidate their position — an outcome that has been documented repeatedly in the aftermath of the General Data Protection Regulation and that the Kids Act does nothing to avoid.

5. Links 4 and 5: Displacement and the Missing Cost-Benefit Analysis

Restricting access to a designated set of services does not reduce demand; it redistributes it. The Australian legislation exempted gaming platforms and several messaging services, and adolescent users migrated accordingly. The European draft is broader in scope, which mitigates the problem at the margin while creating a different one: the wider the perimeter, the greater the compliance burden on services that were never plausibly implicated in the harm being addressed.

The fifth link is the most striking, because it is simply absent. No published analysis estimates the aggregate welfare effect of the Kids Act: not the compliance cost to European firms, not the conversion loss from registration friction, not the value of the privacy forgone by the roughly three hundred and fifty million adult internet users who will be verified in order to exclude a much smaller number of minors, and not the counterfactual benefit foregone by adolescents whose access to information, community and support is curtailed. In a regulatory tradition that mandates impact assessment for far smaller interventions, this absence is itself a finding.

6. Institutional Analysis: Why the Proposal Is Politically Robust

The gap between the evidential position and the political trajectory requires explanation, and the explanation is institutional rather than conspiratorial.

6.1 Asymmetric Accountability

The costs of legislative inaction are vivid, individual and attributable; the costs of legislative overreach are diffuse, statistical and unattributable. A minister who declines to act and is subsequently confronted with a documented case of adolescent self-harm bears a severe and personal political cost. A minister who legislates and imposes several billion euros of dispersed compliance expenditure and a permanent verification layer bears none. Rational actors facing that payoff structure will over-regulate, and will do so sincerely.

6.2 The Absence of an Organised Opposing Interest

Effective scrutiny requires a constituency with both the incentive and the standing to provide it. Here the only well-resourced opponents are the platforms themselves, whose participation in the debate is discounted in advance as self-interested. Adult users bear a small individual cost each and are therefore rationally inattentive; adolescents, whose rights are most directly restricted, are formally excluded from the political process. The result is not suppression of dissent but a structural shortage of it.

6.3 The German Case as an Illustration

Germany exhibits the pattern in unusually clear form. A CDU party conference motion in February 2026 called for a statutory limit of fourteen with mandatory verification; an expert commission reported in June 2026 with fifty-six recommendations; Federal Minister Karin Prien endorsed a minimum age of thirteen with effective verification and graduated protection to eighteen, with a policy framework due in October 2026. Across ministries, the opposition, the education ministers' conference, the Ethics Council and the statutory health insurers, the debate concerned the calibration of the instrument. The prior question — whether the allocation of this decision to the state rather than the household is itself justified — received no comparable institutional advocate. The expert commission itself noted that an age threshold necessarily entails verifying the age of all users, a point that largely disappeared in subsequent political communication.

6.4 Comparative Institutional Design

The contrast with the United States is not one of legislative appetite. American states have legislated at least as aggressively: Arkansas, Ohio, Louisiana, Nebraska, Virginia, Mississippi, Texas and California have all enacted or advanced verification or parental-consent requirements. The difference lies in the existence of a binding constitutional veto point. Federal courts have blocked or invalidated the Arkansas, Ohio, Louisiana and Nebraska statutes; a Virginia court held in February 2026 that a one-hour daily limit for under-sixteens was simultaneously over- and under-inclusive and failed the least-restrictive-means requirement. The American doctrinal position is not uniform — the Supreme Court permitted age verification for adult content in Free Speech Coalition v. Paxton (2025), and an appellate court allowed a Texas app-store statute to take effect in June 2026 — but the default is that the state must justify the restriction to the citizen.

Europe possesses an equivalent mechanism, as the French Conseil constitutionnel demonstrated in August 2026 by striking down the under-fifteen ban adopted the previous month. The mechanism exists; it simply operates later, less predictably, and after the political consensus has already consolidated. That is a difference in the sequencing of scrutiny, and sequencing determines which errors a system tends to make.

7. The Strongest Counter-Position

The case for the Kids Act deserves to be stated at full strength, and three of its arguments are substantial.

• The precautionary argument. Where potential harm is serious and partly irreversible, and where the affected population cannot consent meaningfully, decision-theoretic caution may justify acting before causal identification is complete. Regulatory history offers supporting precedents, including tobacco and leaded petrol, in which early action on ambiguous evidence proved retrospectively correct.
• The collective-action argument. An individual household that restricts access imposes social isolation on its own child while leaving the equilibrium unchanged. A binding universal rule is precisely the coordination device that no family can produce unilaterally, and this is a textbook justification for state intervention.
• The asymmetry-of-power argument. A thirteen-year-old is not a symmetrical counterparty to a system optimised by well-funded engineering teams for maximum engagement. Consumer law routinely intervenes where contracting capacity is unequal, and minimum ages already govern alcohol, driving and employment without attracting the charge of authoritarianism.

These arguments are serious. Two rebuttals nonetheless remain. The first is that the analogies imported from alcohol and driving are imperfect in a legally decisive respect: those restrictions do not require the entire adult population to identify itself before exercising an unrelated right. The second is that precaution does not select the instrument. Accepting that action is warranted says nothing about whether the correct action is population-scale verification rather than device-level controls, school-level restrictions on handset use, liability rules attached to algorithmic amplification of specified content categories, mandated research access to platform data, or enforcement of obligations that already exist under the Digital Services Act. These alternatives are testable, incrementally reversible, and do not require the construction of an identity layer over the whole internet.

8. Conclusion

The Kids Act will probably be adopted in some form. Its political economy is close to ideal: the benefits are attributed to legislators, the costs are borne by dispersed and disorganised parties, and the small number of organised opponents can be dismissed as interested.

The analytical conclusion is narrower than the polemical one, and more robust for it. The evidence that adolescents are harmed on average is real but small and contested. The evidence that a statutory age limit reduces exposure is, on the only direct test available, absent. The measurement technology required to enforce the thresholds operates at a precision comparable to the width of the thresholds themselves. No estimate of aggregate cost exists. Under these conditions, the responsible position is not that nothing should be done, but that what is done should be designed to generate evidence about its own effects, should be reversible, and should not impose a permanent identification requirement on the population as a by-product of a measure addressed to a minority of it.

The deeper issue concerns defaults. The Kids Act is, in substance, a regulation about default settings: it recognises correctly that defaults, rather than formal choices, determine behaviour at scale. The same insight applies to the institution writing it. A polity whose default is that contested decisions are allocated to the state will accumulate such allocations, each one individually defensible and none of them individually decisive. Whether that default is the right one is a question worth asking explicitly, because by construction it is never raised by any single measure.

Sources

• Orben, A. and Przybylski, A. K. (2019), multiverse analysis of adolescent well-being and digital technology use; subsequent Bayesian reanalysis of the UK Millennium Cohort Study data.
• Twenge, J., Haidt, J. et al., critiques of aggregated null findings, including the 2026 commentary on Vuorre and Przybylski.
• Barnes, C. et al. (2026), 'Assessing early effects of Australia's Social Media Minimum Age Act on adolescents' social media use', BMJ, 24 June 2026; associated Science Media Centre expert reaction.
• Australian eSafety Commissioner, compliance data, March 2026; Molly Rose Foundation research briefing, April 2026; Sunstein, C. and Duckworth, A. et al., 'Why Bans Fail', working paper, April 2026.
• US National Institute of Standards and Technology, Face Analysis Technology Evaluation: Age Estimation and Verification, 2024-2026 releases.
• European Commission, State of the Union address and draft Kids Act proposal, 16-17 September 2026.
• NetChoice litigation: Griffin (Arkansas), Yost (Ohio), Murrill (Louisiana), Hilgers (Nebraska), Jones (Virginia); Free Speech Coalition v. Paxton, 145 S. Ct. 2291 (2025).
• Library of Congress Global Legal Monitor, German expert commission on digital safety for children and young people, July 2026.

Written by Andrew Yarahmadi, founder of Goinenglish, Stuttgart. You are welcome to use this case study in class with a reference to www.goinenglish.de.