The European Union's commitment to safeguarding children online is warranted, and the forthcoming EU KIDS Act represents an effort to reinforce protections across digital services ranging from social media to gaming platforms and AI systems. However, significant questions persist about the practical implementation of age verification—particularly regarding how platforms will confirm users' ages while minimizing the collection of sensitive personal data.

The Commission has proposed privacy-conscious verification approaches, yet certain methods may still demand the processing of identity documents or facial recognition technology. These mechanisms require robust protections to prevent unnecessary gathering or storage of sensitive information, especially when third-party vendors become involved in the verification chain.

Gaming services already maintain substantial quantities of user data—account credentials, voice recordings, contact networks and transaction histories. Introducing sensitive identity information into these systems amplifies the consequences of a potential security breach.

The privacy challenge of age verification

Published on September 17, the EU KIDS Act proposal restricts independent social media accounts for children under 15 and establishes broader safeguards for digital services, including gaming environments. For gaming platforms specifically, the proposal mandates stricter controls around privacy, safety and age assurance—raising fundamental questions about how developers can authenticate player ages while limiting personal data collection and retention.

The act of gathering sensitive personal information creates an ongoing obligation to defend it against theft and unauthorized use. A gaming platform might require young players to upload identification documents to unlock particular features, even though the verification process only needs to confirm age eligibility—yet the verification workflow could still capture names, photographs, birth dates and additional personal details.

Biometric verification introduces heightened dangers. While a compromised password can be reset, the biological markers used for identification cannot be regenerated in the same manner.

Recent incidents illustrate these vulnerabilities. In October 2025, Discord reported a security breach affecting a third-party customer support vendor. Approximately 70,000 users faced potential exposure of government ID photographs that had been submitted for age-related review requests. Although the breach occurred within Discord's vendor network rather than its core infrastructure, and no confirmation emerged that minors were affected, the incident underscored the dangers inherent in storing and managing government-issued identification materials, particularly when external organizations maintain custody of them.

European regulatory bodies have acknowledged these dangers. The European Data Protection Board's 2025 statement on age assurance outlines principles for safeguarding personal information during verification, emphasizing data minimization and proportionality. While these principles are sound, their real-world application across a fragmented gaming sector—where platforms differ substantially in scale, technical capacity and feature sets—remains uncertain.

How the EU and gaming developers can get age verification right

Methods exist to establish age eligibility without requiring individuals to disclose their identities to every service they encounter. The European Commission has created a privacy-respecting age-verification framework designed to permit users to demonstrate age compliance without revealing extraneous personal details.

This represents progress. The genuine challenge lies in ensuring these safeguards function reliably throughout the entire verification workflow, particularly when multiple vendors participate in the process, each operating under distinct security protocols. Participating vendors must handle information with care, restrict storage duration and refrain from applying data to unrelated functions.

Outsourcing age verification to external providers does not inherently eliminate the problem. If a single vendor processes sensitive information across numerous platforms, one security incident could potentially compromise users across multiple services simultaneously.

Platforms must deliberate carefully about what personal information they collect and maintain. When information is not essential, retention becomes difficult to justify—particularly when storage heightens exposure during a breach scenario.

The EU should institute transparent, binding standards governing verification vendors. Where age confirmation is mandated, developers should authenticate eligibility without unnecessarily preserving identity documents or biometric data.

Addressing these challenges requires coordinated steps from both regulators and the gaming industry:

  • Restrict data collection. Age-assurance mechanisms should gather exclusively the information required to confirm eligibility. Identity documents and biometric materials should not remain stored beyond the minimum necessary period.
  • Mandate independent security reviews. Verification vendors should demonstrate adequate protection of sensitive information through regular audits designed to uncover and remediate potential weaknesses.
  • Ensure verification accessibility for smaller developers. While major studios may possess resources for managing intricate compliance obligations, independent developers require cost-effective, dependable solutions that do not necessitate constructing proprietary identity databases.
  • Scale requirements to actual risk levels. A large multiplayer title featuring open voice communication and in-game commerce presents distinct challenges compared to a smaller game with restricted social functionality. Age-assurance measures should account for these variations.

Age verification serves a legitimate function, yet platforms should simultaneously prioritize safety improvements that do not demand supplementary personal information collection.

Why action is needed before the rules are finalized

The EU KIDS Act remains in proposal form, providing regulators and gaming developers with an opportunity to resolve these concerns before requirements take effect. Policymakers must establish explicit protections for age-verification vendors, while developers should audit their current data management practices and evaluate the security posture of any external services they plan to engage. Accountability mechanisms must exist for how sensitive information is safeguarded, archived and destroyed.

A framework ostensibly designed to protect children could inadvertently establish new repositories of sensitive information attractive to malicious actors. Heightened identity verification does not automatically translate to safer digital experiences. When children must furnish personal information to participate in a game or maintain friendships, the justification for collection must be explicit and accompanied by concrete safeguards against misuse.

The EU has an opportunity to establish a global standard by demonstrating that age verification can function without exposing personal information to unnecessary jeopardy. Success hinges on how thoroughly regulators and gaming platforms implement the privacy protections currently under discussion. If a platform cannot authenticate age without gathering or preserving extraneous identity information, its methodology warrants reconsideration.