A Safer Internet Should Not Come with Democratic Shortcuts

This year’s State of the European Union address by European Commission President Ursula von der Leyen drew a bated breath for many in the digital rights community, as we awaited the announcement of the EU Kids Act, new legislation aimed at creating a safer online environment for minors.

The online space offers young people the chance for connection and exploration, but it also exposes them to significant risks of online harassment and discrimination, among other recognized harms. The proposal is a response to wide-reaching calls from Member States and the general public for more action to address these well-documented online harms, but the devil will be in the details.

As a new edition to the EU's digital rulebook, the proposal also arrives amidst growing institutional pushback against, and in some cases dismantling of, fundamental rights protections in some of the EU’s defining digital rules.

A worrying democratic backsliding on key digital files

The ink was barely dry on the EU AI Act before the AI omnibus was introduced and pushed through the legislative process under an expedited procedure. The projected ‘tension’ between enforcing risk-based rules and championing innovation placed key fundamental rights protections first on the chopping block.

Civil society organizations successfully pushed back on the worst proposed changes, but many aspects were still watered down. The central pillar of data protection rules — the General Data Protection Regulation (GDPR) — risks having key provisions on personal data be undermined through changes on how highly technical concepts such as pseudonymization should be interpreted and a wider mandate for AI-related data processing.

Most publicly, the European Parliament President enacted an urgent procedure to pass a vote on the lapsed e-privacy derogation, commonly known as Chat Control. The Parliament had previously voted down the framework twice because of the prevailing rights concerns many civil society groups have raised. This wave of procedural backsliding has led many to hold a pessimistic view of when and how best public interest advocates can continue to push to ensure that the EU’s evolving digital rules uphold our fundamental rights.

The concern is that, despite this welcome step forward in addressing online safety for minors, this new proposal falls into the same pattern of EU tech policies being shaped outside democratic due process. Amid the European Commission’s push for simplification of digital rules, procedural mechanisms to ensure transparent and multi-stakeholder engagement in policymaking are being undermined, and the adoption of the Act is no different.

Although debate on child safety online has been ongoing for months, and several member states have taken matters into their own hands by introducing a swathe of social media ban laws, it can be argued that the Commission had little choice but to propose the new KIDS Act.

The Commission President took the diligent step of establishing a special panel to develop a report with recommendations for EU action, informed by notable experts in the field. Despite many of the nuanced recommendations of the report being embedded throughout the proposal, this does not negate the lack of impact assessment and stakeholder consultation, which are essential requirements of the Better Regulation process.

Furthermore, the constitutional court's striking down of a similar law in France should have reinforced the need for diligent assessment and stakeholder engagement, not justified sidestepping these procedures.

This is all the more necessary given that the proposal explicitly aims to turn the Digital Services Act’s Article 28 Guidelines into ‘hard law’ through this new law, only strengthening the argument that the extensive consultation process that led to the development of the guidelines should have been mirrored in the knowledge that these non-binding measures are to become binding legal obligations. This embrace of procedural sidestepping is all the more concerning given the wide-ranging fundamental rights implications of the proposal.

Good intentions, but fundamental rights must be balanced

For many civil society groups, the proposal has caused mixed reactions. On the surface, the fact that the European Commission is not proposing a blanket social media ban is appreciated. As conveyed by the UN High Commissioner for Human Rights, bans and age restrictions are blunt legislative tools that fail to address the core issue of platform safety.

The proposal, which is highly complex, incorporates safety-by-design measures that many advocates have suggested as a more meaningful approach to addressing the online harms that not only young people, but all users and democracy at large, continue to face. Still, the draft proposal includes far-reaching age verification and age assurance requirements which undermine this more measured approach.

Advocates have long stressed the concerns for many existing age assurance tools, outlining a more privacy-preserving approach for lawmakers to consider. At the heart of the European Commission’s proposal is a reliance on the EU’s age verification scheme, with zero-knowledge proof presented as the privacy-preserving gold standard.

Experts have consistently highlighted, however, that zero-knowledge proof is not a silver-bullet solution and has its limitations. The proposal also envisages parental oversight via an app, which itself will require confirmation of guardianship, thereby adding another layer of ID verification for parents.

From a free expression perspective, there are questions as to whether the proposal respects the right to free expression and access to information for children under the age of 13, which are rights they maintain and should still safely enjoy. This runs alongside wider free expression concerns about an age-gated internet, especially for users from marginalized communities. For teens aged 13-15, ‘mini’ accounts with limited features are available, but parents can monitor account activity. Whether teens can freely enjoy these rights under the premise of parental monitoring is also a concern. Whether parents generally support this approach, given their preference for more personal choice, remains to be seen.

In short, the solution on the table, despite having some welcome aspects, may unintentionally undermine the fundamental rights of not only children, but all online users. Given this, concerns about legislative shortcuts and expedited procedures, where opportunities for public debate and expert consultation are reduced, are simply unacceptable; the issues this law aims to address and its potential impact are simply far too important.

Getting the process right: democratic oversight must come first

As this law moves forward, public consultation and democratic scrutiny will need to be forefront. Children and young people, expert civil society and public interest technologists must be extensively consulted if this law is going to land where we hope it eventually will; as a complementary framework to laws like the Digital Services Act and the upcoming Digital Fairness Act, that truly protects all communities online.

Strengthening measures to ensure platforms meaningfully mitigate the harms they have thus far failed to address, while respecting the privacy and expression rights of children and all users, is critical. As the Commission President said, “Europe has the power to act, and it is we who decide our rules.” The EU also has an obligation to establish these rules through an open, democratic process, informed by relevant expertise.