The EU KIDS Act Could Put Young Gamers' Privacy at Risk

Konstantin Levinzon is co-founder of Planet VPN. Planet VPN's commercial activities relate directly to the issues discussed in this article.

The European Union is right to take children's online safety seriously. The European Commission's proposed EU KIDS Act aims to strengthen protections for children using digital services, including social media, online gaming platforms and AI chatbots.

But concerns remain about how age verification will work in practice. While the EU is proposing privacy-preserving solutions, some verification methods may still involve processing identity documents or facial images. These systems need clear safeguards to ensure sensitive information is not unnecessarily collected or retained, particularly when third-party providers are involved.

Many multiplayer gaming platforms already handle account details, voice communications, friend lists and in-game purchases. Adding sensitive identity information could increase the potential harm if their systems were compromised.

The privacy problem behind age verification

The EU KIDS Act proposal, published Sept. 17, includes restrictions on independent social media accounts for children younger than 15 and broader protections for digital services, including online gaming.

For gaming platforms, the proposal introduces stronger requirements related to privacy, safety and age assurance. This raises questions about how developers will verify players' ages while limiting the personal information they collect and retain.

Collecting sensitive personal information creates an ongoing responsibility to protect it against potential breaches and misuse.

A multiplayer platform, for example, might ask young players to submit identification documents to access certain features. It may only need confirmation that a player meets an age threshold, yet the verification process could involve names, photographs, dates of birth and other personal details.

Where age checks involve biometric identification, the risks can be particularly serious. A compromised password can be changed, but the physical characteristics used to identify someone cannot be replaced in the same way.

There is already evidence of how these risks can emerge. In October 2025, Discord disclosed a security incident involving a third-party customer support provider. The company identified approximately 70,000 users whose government ID photographs may have been exposed. These documents had been used to review age-related appeals.

The breach involved Discord's third-party customer support provider, not its main platform. There was no confirmation that children were affected, but the incident raised concerns about how government ID photographs are stored and protected, particularly when external companies handle them.

European regulators have also recognized the need to limit these risks. In its 2025 statement on age assurance, the European Data Protection Board sets out principles for protecting personal information during age verification, including data minimization and proportionality.

These are sensible principles, but they need to work in practice across a gaming industry where platforms vary considerably in size, resources and functionality.

How the EU and gaming developers can get age verification right

There are ways to establish whether someone meets an age requirement without requiring them to reveal their identity to every service they use.

The European Commission has developed a privacy-preserving age-verification approach intended to let users demonstrate that they meet an age threshold without disclosing unnecessary personal information.

This is a positive development. The real test will be whether those protections hold up across the entire verification process, especially when checks are handled by different providers, each with its own security . Those providers must process information securely, limit how long it is stored and avoid using it for unrelated purposes.

Moving age verification to a third-party provider does not automatically solve the problem. If that provider handles sensitive information for several platforms, a single security incident could potentially affect users across multiple services.

Companies should think carefully about the personal information they collect and store. If they do not need that information, there's little reason to retain it, particularly when doing so could put users at greater risk in the event of a breach.

The EU should establish clear, enforceable standards for verification providers.. Where age checks are required, developers should be able to verify eligibility without unnecessarily retaining identity documents or biometric information.

To address these risks, the EU and gaming developers should take several practical steps.

• Limit the information collected. Age-assurance systems should process only the information needed to confirm eligibility. Identity documents and biometric information should not be retained longer than necessary.
• Require independent security assessments. Verification providers should be able to demonstrate that their systems adequately protect sensitive information, with regular assessments to identify and address potential vulnerabilities.
• Make verification accessible to smaller studios. Major developers may have the resources to manage complex compliance requirements, but independent studios need affordable, trusted solutions that do not require them to build their own identity databases.
• Match requirements to the risks involved. A large multiplayer game with open voice chat and in-game purchases presents different challenges from a smaller title with limited social features. Age-assurance measures should reflect those differences.

Age checks have a role to play, but developers should also focus on making their platforms safer in ways that do not require additional personal information.

Why action is needed before the rules are finalized

The EU KIDS Act is still a proposal, giving regulators and gaming developers time to address these concerns before the requirements are finalized.

Policymakers should establish clear safeguards for age-verification providers, while developers should review their existing data practices and assess the security of any third-party services they intend to use. There also needs to be clear accountability for how sensitive information is protected, stored and deleted.

A system intended to protect children could create new stores of sensitive information that cybercriminals may target. Stricter identity checks do not automatically mean safer online experiences. If a child is asked to provide personal information to access a game or communicate with friends, there should be a clear reason for collecting it and safeguards to prevent its misuse.

The EU could set an example for other countries by showing how age verification can work without putting personal information at unnecessary risk. This will depend on how well regulators and gaming platforms apply the privacy protections already being proposed.

If a platform cannot verify someone's age without collecting or storing unnecessary identity information, its approach needs to be reconsidered.