The panel met three times between March and June 2026 and issued 14 recommendations. Its headline call: a harmonized EU-wide access restriction on social media for children under 13, underpinned by effective age assurance systems to verify age and support safety-by-design approaches for minors, as reported by Biometric Update.

It builds on groundwork already laid. In late April 2026, the Commission published a separate, non-binding Recommendation establishing a common EU approach to age verification technologies. Softer in legal force but significant in signal, it put member states on notice about how Brussels expects national measures to be designed, according to the Future of Privacy Forum. Today's panel report adds scientific and policy authority behind that technical groundwork.

Worth keeping separate in your mind: the April Recommendation is non-binding. The panel report is a set of recommendations to EU leaders. Neither automatically creates binding obligations on platforms. What exists now is a proposal architecture. What would need to happen next is member-state adoption, legislative follow-through, and enforcement coordination across the DSA, GDPR, and AI Act. That gap is real and the article returns to it.

The political pressure is coming from multiple directions. Heads of state in France and Denmark have publicly called for a Europe-wide ban on social media for under-15s, while Germany, Greece, and Spain are running their own age verification pilots, per the Electronic Frontier Foundation. Brussels is racing to produce a coherent framework before member states build an incompatible patchwork.

Public sentiment is firmly behind intervention. A Eurobarometer survey released alongside today's report found 63% of Europeans support age minimums for social media, while just 13% think oversight should rest with parents and schools alone. Cyberbullying tops the list of concerns at 71%, followed by grooming and sexual exploitation at 70%, exposure to harmful content at 69%, and addictive platform design at 60%.

The under-13 restriction is the panel's primary call, but not the whole picture. The report also recommends digital literacy programs, stronger complaint mechanisms for minors, and direct inclusion of children in co-designing safety policies. Age gating is positioned as one layer within a broader accountability framework, according to Biometric Update.

Children's own perspectives are part of the evidentiary record here. The EU Kids Online network surveyed 29,169 children aged 9-16 across 19 European countries between April 2025 and April 2026, capturing their experiences of online harm, social media use patterns, and views on age-based restrictions, per LSE/EU Kids Online. Policymakers drawing on this dataset have more direct child-sourced evidence than any previous EU policy cycle on the topic.

Academic research reinforces a key limitation of access restrictions on their own. A 2024 umbrella review in Childhood and Adolescent Behavior argued that risk mitigation should shift responsibility from adolescents and families onto platforms themselves, targeting their engagement design and governance choices rather than just their age checks. A separate scoping review in PMC put it plainly: "age verification is no substitute for privacy protections and increased user transparency and control."

The panel calls for deeper regulatory coordination across the DSA, GDPR, and AI Act, acknowledging that child safety rules now span frameworks with different regulators and no clear enforcement hierarchy. It explicitly flags that additional resources and restructuring may be needed before enforcement can work at all, according to Biometric Update.

The Commission's April 2026 Recommendation marks a deliberate shift toward age verification specifically, moving away from self-declaration and estimation methods that DSA enforcement has exposed as inadequate, on the grounds that verification carries a higher degree of accuracy, according to the Future of Privacy Forum.

One distinction matters here. The Recommendation emphasizes verification; the panel report does not prohibit estimation but sets stringent conditions on both, requiring any method to be proportionate and uphold minimum standards for fundamental rights, per Biometric Update. Related but not identical positions.

In concrete terms, what a platform would receive under a compliant EU age check is deliberately minimal: a true-or-false response confirming whether the user meets the age threshold, with no additional personal data passed through. The check is performed by a certified third-party provider against a trusted attestation; the platform itself does not see the underlying identity. Zero-knowledge proofs are cited by both the panel and the Commission as a technology capable of confirming age without exposing who the user is, per Biometric Update and the Future of Privacy Forum.

What is ruled out explicitly: processing identity documents or biometric data for the purpose of age estimation. Facial-scanning tools designed to guess a user's age from appearance do not meet the standard, according to Biometric Update.

To operationalize the system, the Commission plans to publish a technical blueprint, an open-source mobile app that member states can adapt, and a certified list of EU-based trusted providers whose solutions meet defined criteria for accuracy, reliability, strongness, non-intrusiveness, and non-discrimination, per the Future of Privacy Forum. The EU Digital Identity Wallet, which member states must make available by end of 2026 though it remains voluntary for citizens, is positioned as a potential delivery mechanism for age attestations.

The central problem is definitional. There is no single agreed age of a "minor" across EU law. The Commission's Recommendation defines a minor as anyone under 18, but member state thresholds for social media restrictions currently range from 13 to 18, according to the Future of Privacy Forum. A platform operating across the EU may therefore face different compliance cutoffs in different countries, different certified providers, and different enforcement timelines in each jurisdiction. Not a unified system so much as a layered compliance burden with a harmonization label attached.

GDPR adds a further complication the April Recommendation does not resolve. Under Article 8(1), processing personal data in connection with information society services is lawful for users aged 16 and above; member states may lower that floor to 13 but no further. This constraint sits alongside, and sometimes conflicts with, the access restriction framework, per the Future of Privacy Forum.

The procedural constraints are binding even when the policy intent is clear. Any member state introducing its own technical access restriction must notify the Commission before adoption, triggering a minimum three-month standstill and intergovernmental review. A government that skips this step risks having its measure ruled unenforceable against individuals in domestic courts, per the Future of Privacy Forum. The standstill mechanism is Brussels's main lever for preventing fragmentation. It is a procedural brake, not a guarantee of alignment.

The deeper risk is that legal complexity becomes the path of least resistance for delay. With the DSA, GDPR, AI Act, and national laws all touching child safety simultaneously, the panel calls for better inter-authority coordination and acknowledges that regulators may need more resources and restructuring to enforce what already exists, let alone a new layer of age verification obligations, per Biometric Update.

Today's panel report is the clearest policy recommendation to emerge from Brussels on child online safety, and the enforcement record that preceded it, preliminary breach findings against Meta and an open Snapchat investigation earlier this year, is what drove the urgency, per Biometric Update and the Future of Privacy Forum.

The architecture being proposed, true-or-false age responses from certified third parties, zero-knowledge proofs, no biometric estimation, is specifically designed to raise enforcement standards without normalizing identity surveillance. Whether it can deliver that in practice, across 27 member states with divergent age definitions and overlapping legal frameworks, is the open question.

Three signals will define the gap between what is proposed today and what platforms are actually required to implement: publication of the Commission's technical blueprint and certified provider list; member state notification filings, which will show whether governments are aligning with Brussels or pursuing incompatible national paths; and whether the EU Digital Identity Wallet, voluntary for citizens but required to be available by end of 2026, integrates meaningfully with mandatory platform compliance. The answer to that last question will determine whether this framework functions as a unified system or fractures into exactly the patchwork it was designed to prevent.