The European Commission is at it again, trying to outdo itself in the online age verification game. On November 11, it proposed the Digital Fairness Act (DFA), yet another consumer protection regulation that is also an online age verification law.
Once again, the European Commission (EC) would like to reinvent the wheel, instead of properly explaining how it intends to make its previous, similar initiatives work. The proposal comes on top of the Digital Services Act (DSA), the proposed EU KIDS Act, and the DSA guidelines.
The new proposal, however, has a much wider reach than the previous ones. While the DSA and the proposed KIDS Act cover only certain online services, the DFA applies to any “trader” – and that is defined as anyone acting for their “trade, business, craft or profession.”
The rules the DFA builds on apply to “any trader targeting consumers in the EU, including when these traders are established outside the EU,” the proposal says.
On ads, “The DFA will extend these bans to all websites and apps,” the Commission said.
The DFA is a regulation, meaning that it will be directly applicable in all EU countries, and will not need to be transposed into national law.
The new proposal, the DFA, speaks of “objective indicators” to determine if a product is directed at minors, or if a company is aware with “reasonable certainty that the product is used by minors.”
To determine this, companies can use age ratings given by themselves, third parties such as PEGI, or those that will be introduced by the KIDS Act.
Another indicator is the marketing that appeals to children, such as “the characters (including celebrities or influencers), themes, animations, or the type of music or language used.”
Customer accounts are also a way for companies to determine with “reasonable certainty” that a user is a minor. And if a company has an account that belongs to a minor, it should switch off certain features.
Age checks that are required under other laws, such as the KIDS Act and the DSA guidelines, can also be used as an “objective indicator.”
However, the regulation says it should not lead traders to “maintain, acquire or process more personal data than traders already have.”
That is a pretty empty statement, given that the data traders already hold is exactly what they are being told to analyze to assess the age of their users. And the punishment is in not knowing.
This is the same problem that plagues all other EU age verification initiatives: the promise that no additional data will be collected is unrealistic, since the end goal is to make sure that companies know the age of every single user.
If they don’t, they risk fines of up to 6% of their global turnover. The Commission has the power to impose this penalty itself in some cases, while in others, national authorities must make sure fines reach at least 4% of a company’s turnover in their country.
The features that will have to be “switched off” under the new proposal are several. If a product is “directed at minors” – or if a company is aware with “reasonable certainty” that it is used by minors – then paid-for virtual currencies must be “disabled by default for minors” and “can only be activated upon parent or guardian approval.”
Companies that are already under the KIDS Act can use the tools that law provides for parents and guardians.
Paid loot boxes and other variable reward systems are not allowed to be offered to minors – but there’s an exception for “providers of online social networking services or video-sharing platform services and of AI companions and of general conversational chatbots” – these are already covered by the KIDS Act.
“Pay-to-progress or pay-to-win mechanisms that can be acquired” with money or paid-for virtual currencies are banned for minors.
Personalized ads based on profiling are not allowed if the trader “is aware with reasonable certainty that the consumer is a minor” – unless the company is already covered by the DSA’s rules.
Personalized prices based on profiling are not allowed if they are “reasonably likely to cause harm to the consumer” and the trader is aware with “reasonable certainty that the consumer is a minor” or that “the consumer is vulnerable due to their age, credulity, disability, or any specific misfortune or circumstance of such gravity as to impair the consumer’s judgment.”
A minor here is anyone under 18.
The KIDS Act, on the other hand, has the goal of forcing platforms to check the age of every single user, using a state-certified tool. The EU digital identity wallet is considered as one of the tools that can be used for this purpose.
The KIDS Act would make platforms disable accounts whose age “cannot be established” – and treat adults who refuse the check as children.
Last week, the Commission froze national laws in Austria and Flanders that would have introduced under-15 rules, to make sure its own scheme comes first.
Spokesperson Thomas Regnier explained that “we will not fragment our internal market.”
The DSA guidelines call self-declared age “unreliable” and point to “facial analysis or behaviour patterns” or “official IDs or trusted digital credentials, such as the upcoming EU Digital Identity Wallet.”
In other words, the same scheme.
The DFA proposal now has to be adopted by the European Parliament and EU Council.
In the meantime, the European Games Developer Federation and Video Games Europe said in a statement that the proposal is “unworkable, unjustified and disproportionate” and that it “in practice would force many games to refuse access to any under 18s at all.”
The groups added, “The text treats games rated below PEGI 18 as directed at children. Age ratings indicate suitability, not target audience.”
Felix Falk of game – the German Games Industry Association – said that every game rated below 18 would automatically count as a service aimed at children.
“This patronises parents and children alike,” Falk said.
UK games body Ukie also reacted, warning that the proposal would undermine parental agency “by placing blanket restrictions on certain features.”
BusinessEurope’s Director General Markus J Beyrer said the act “risks introducing unnecessary obligations and overlapping requirements that undermine legal certainty.”
EC Commissioner Michael McGrath, however, is of a different opinion. “We are not making it harder to do business, we are making it harder to do business unfairly,” he said.
The only thing that is certain at this point is that the EU is making it very hard for its citizens to protect their privacy and have any semblance of anonymity online.
