Europe’s Social Media Age Restrictions Are Also an Identity Management Challenge

On September 17, 2026, the European Commission presented its EU KIDS Act proposal, which would prohibit children under the age of 13 from holding social media accounts, permit restricted or supervised access for children aged 13–14, and establish 15 as the minimum age for independent account ownership. Importantly, this is still a legislative proposal, not yet binding EU law.

In parallel, the European Commission has already developed a privacy-preserving age verification architecture designed to allow users to prove that they meet a specific age threshold without disclosing their name, exact age, date of birth, or other personal information unnecessary for that purpose. This approach is aligned with the European Digital Identity Wallet (EUDI Wallet) ecosystem.

Zero-Knowledge Proof (ZKP) is a cryptographic method that makes it possible to prove the validity of a statement without revealing the underlying confidential information. In this context, anonymous credentials can demonstrate that a particular attribute meets a requirement, such as:

“The user is at least 15 years old.”

However, this solves only one part of the problem.

The real challenge is how to enforce age restrictions consistently and effectively across multiple platforms, while preventing circumvention without creating a centralized database of children’s identities.

This is where Privacy-Preserving Record Linkage (PPRL) and multi-party Data Clean Room (DCR) infrastructure can provide complementary capabilities.

A DCR is not necessary at the ZKP verification stage. However, it becomes relevant when data held by multiple independent data controllers or data holders must subsequently be compared or jointly analyzed, without requiring any party to disclose raw personal data to another.

PPRL (Privacy-Preserving Record Linkage) makes it possible to establish whether protected records refer to the same entity without exposing the individual's identity:

“These two protected records belong to the same person, without revealing who that person is.”

Naturally, PPRL/DCR can link records only when the participating parties possess a suitable common identifier, such as an identity document number stored as a keyed hash under a controlled cryptographic protocol.

A PPRL-enabled Data Clean Room (DCR) is a data collaboration platform that allows authorized computations involving multiple data controllers or data holders without requiring them to consolidate or exchange their underlying personal data repositories.

The DCR does not perform real-time age verification or parental consent validation. These are registration-time functions handled by the EU age verification application and the EUDI Wallet ecosystem under the proposed EU KIDS Act framework.

Instead, the DCR provides a complementary layer for retrospective, batch-based verification and auditing.

In other words, users undergo anonymous, ZKP-based verification through the EUDI Wallet at login or registration, while the DCR can subsequently serve as an independent auditing and validation layer.

This technology can support cross-platform age assurance, verification of parental or guardian consent, detection of attempts to circumvent age restrictions, and measurement of regulatory compliance, while respecting the principles of data minimization and purpose limitation.

The DCR can also facilitate the retrospective review of existing accounts. Under the proposed EU KIDS Act, existing accounts would need to be checked within six months of the legislation entering into force to determine whether their holders are under the age of 15. A DCR could support this process, alongside regulatory compliance measurement and comprehensive sample-based audits.

In every case, the DCR relies on a unique identifier that is already lawfully available, such as one established through a rigorously verified account (KYC), an official registry, or an appropriate consent-based process. This identifier provides the basis for linking customer records maintained by different participating organizations.

Proposed Solution Models

1. Cross-Platform Age Assurance & Circumvention Detection

This solution would determine whether protected records appearing on different platforms relate to the same individual. It would also enable retrospective detection of repeated registrations or attempts to circumvent age restrictions, without establishing a shared identity database.

For example, a child may register on several social media platforms using different telephone numbers, email addresses, or account credentials. Individually, the platforms may be unable to determine that these accounts belong to the same natural person.

Privacy-preserving record linkage can help identify such relationships where sufficient, lawfully available matching information exists, without requiring the platforms to exchange identifiable user records.

2. Regulatory Compliance Measurement

This model enables statistical and compliance-oriented analyses through which platforms, identity providers, and regulatory authorities can jointly assess the effectiveness of age verification mechanisms without exposing the identities of individual child users.

It can help answer questions such as:

“What proportion of accounts classified as adult users by a platform actually belong to individuals who do not meet the applicable age threshold, according to a trusted age verification source?”

Such analysis could support independent audits, risk assessments, regulatory supervision, and evidence-based evaluations of the effectiveness of age assurance systems.

The Objective: Privacy-Preserving Interoperability, Not Centralized Identification

The goal is not to establish yet another centralized identity infrastructure.

The objective is to create a privacy-preserving interoperability layer that enables meaningful enforcement of age restrictions while ensuring that social media platforms learn as little as possible about the identities of the children concerned.

Identity without identification.

#Harveys #DataCleanRoom #DataCleanLab #PPRL #DCR #ZKP #PETs #AgeAssurance #AgeVerification #EUDIWallet #DigitalIdentity #GDPR #DataProtection #PrivacyByDesign #ChildSafety