The EU has written "daily streaks" and "infinite scroll" straight into its prohibition list

In one line: On 17 September 2026, the European Commission proposed the KIDS Act, bringing games inside "safety by design" obligations and naming four designs it bans for minors — including "streak" mechanics that punish a child for not returning daily, and infinite scrolling. Both are standard live-ops retention tools. The bigger shift is that the burden of proof reverses: platforms must fund independent audits to prove their designs are safe.

Terminology follows references/glossary.md.

What the draft actually says

Start with the verifiable provisions — they define the blast radius.

The age staircase:

Note the scope boundary: this staircase applies only to social networking and video-sharing services — not to games.

What actually hits games is the other half — "safety by design." The obligations attach to "the services children use most": social platforms, video platforms, games, AI chatbots and app stores. For minors, the prohibited designs are named one by one:

• Endless autoplay and infinite scrolling without real breaks
• Notifications designed to pull the child back, unrelated to anything the child did
• Rewards for posting or streaming to mass audiences
• "Streak" mechanics that penalise a child for not returning every day
• Services must also provide effective time limits and usage breaks, designed to protect children's sleep and school time

Recommender systems: for minors, recommenders must optimise for safety, quality and mental health — not engagement. Specifically: what the child actively chose to follow comes first; tracking-based personalisation is off by default; no data from outside the service may be used; no "rabbit holes"; plus an easy feed reset and at least one option without profiling.

Contact from strangers: nobody can message a child without pre-approval; children do not appear in contact suggestions; they can't be added to groups without agreement; they can block anyone anonymously; their content is visible only to accepted contacts; contact details are never disclosed; others cannot download or screenshot their content; minors cannot livestream by default.

AI chatbots and "AI companions": no designs that simulate human relationships in ways likely to create emotional dependency; by default they may not carry a child's earlier conversations into later ones; they must be tested for risks to children before launch and monitored after; under-13s may use them only through parental controls. If a chatbot is built into a platform — it may not switch on automatically, may not be pushed at children, and must be easy to turn off.

The dedicated games and app stores clause (short in the original, heavy in effect):

"Games must also be safe by design. App stores must age-rate every app, including videogames, with a published methodology, they must not let children access or buy apps inappropriate for their age, and must carry the EU age verification app."

Existing accounts: within six months of the rules applying, platforms must check whether existing account holders are under 15 and disable the accounts of those who are — or whose age cannot be established.

How age is verified: platforms don't check documents or learn who you are. Verification runs through certified solutions independent of the platforms — a free EU age verification app and, in time, the European Digital Identity Wallet. These tools tell the platform one thing only — whether the user is above or below an age — and the law requires zero-knowledge proof technology that cannot identify, locate, track or profile anyone.

Why "naming specific mechanics" is the real change

Read only the age thresholds and this looks like another round of the familiar minors-protection debate. What changed is the legislative technique.

The previous generation governed outcomes: disclose drop rates, don't induce minors to spend, honour refunds. The defining feature of that approach is that proving a violation requires proving harm. Harms like "excessive use" are extremely hard to attribute to any single design decision, so enforcement was structurally soft.

The KIDS Act governs design, and writes the mechanic names into the text. The consequence: a regulator no longer has to argue that your streak mechanic harmed a particular child. They check whether you used a named mechanic. Violation shifts from causal proof to feature matching.

Paired with that is the reversal of the burden of proof — commercially the heaviest provision in the draft:

• Platforms with 45 million or more monthly active users in the EU cannot simply declare themselves safe
• Before coming into contact with children, they must submit a detailed compliance plan covering every obligation
• That plan is checked by independent auditors, paid for by the platform; the Commission can reject an auditor for lack of independence
• Fines reach 6% of total worldwide annual turnover
• Expedited procedure: preliminary findings within 30 days, final decision targeted within 90

(Established mechanism: allocation of the burden of proof in regulatory design — shifting proof costs from regulator to regulated is the standard technique that makes hard-to-prove harms enforceable. Framing this as "outcome regulation moving to design regulation" is this card's inference.)

In other words: compliance cost moves from "legal fees if you're sued" to "standing audit and documentation cost." That lands very differently on a small studio than on a company that can afford lawyers.

Why this collides head-on with game live ops

At least four provisions land on standard live-ops tooling:

1. Daily streaks (连续签到). "Log in N days in a row" is close to universal in Chinese mobile games, and the punitive design — resetting progress when the streak breaks — is precisely the mechanism that makes it work (see sunk cost and loss aversion in frameworks.md). The draft bans the "penalise a child for not returning every day" form. This isn't a question of softening it; the mechanism itself is named.
2. Push re-engagement. Listing "notifications unrelated to anything the child did" as prohibited directly constrains the most common winback tool.
3. Rewards for posting or streaming. Any UGC incentive, creator programme or KOL task system that pays out on post volume or view counts falls inside the ban.
4. Infinite scroll and autoplay. In-game feeds — event hubs, store recommendations, community streams — that load without end for minors are in scope too.

Add "no spending traps" and safe settings by default, and the practical requirement is: the version for minors must be a separate design, not a "gentler setting" on the main build.

One easily missed knock-on effect: the chatbot clause states that a chatbot built into a game may not switch on automatically, may not be pushed at children, and must be easy to turn off. A lot of products have spent two years adding AI companions and NPC dialogue — this changes the launch shape of those features.

How to use this mechanism

When your product ships in the EU (or has minor users), build a checklist of the named mechanics and compare your design against it line by line, rather than waiting for a regulator to ask — because the new framework requires you to prove safety yourself, and self-certification starts with knowing which named mechanics you use.

Three transfer judgements:

• This is not EU-specific. Age verification, personalisation off by default, and restrictions on compulsive design are different national implementations of the same regulatory consensus. Doing the design checklist once against the strictest standard is cheaper than adapting region by region.
• Don't count on age gates to solve it. The draft is explicit: self-declared age does not count, and existing accounts whose age cannot be established must be disabled. "The user typed 18" is no longer a valid defence under this generation of regulation.
• The real workload is auditability. You need to be able to show which mechanics are off for minors, what the defaults are, how time limits take effect, and whether verification is zero-knowledge. That's documentation and instrumentation work, not gameplay work — and it decides whether you can be in the market at all.

Three things you can do tomorrow

1. Build a checklist of named mechanics and mark which ones your product uses. Four items: punitive daily streaks, re-engagement notifications unrelated to user action, rewards conditioned on posting or streaming, infinite scroll or autoplay. Annotate each with "enabled for minors?" — most teams currently have that column blank.

1. Answer one question: can you prove an account's age today? If the birthday they typed at signup is all you have, then under the existing-account provisions you can neither confirm nor keep that cohort within six months. That's an infrastructure problem that needs to be on the roadmap now.

1. Check the default state of any in-game AI chat or AI companion feature. If it switches on when you enter the game, the draft requires default-off, explicit opt-in, one-tap disable. Changing it now is a product decision; changing it after entry into force is a compliance incident.

Appendix

Source list

• The KIDS Act explained — official primary document (European Commission FAQ), updated 2026-09-17. Source of most provisions here: the three-band age staircase, the four banned designs, recommender clauses, stranger-contact clauses, AI companion clauses, the games and app stores clause, the six-month existing-account deadline, the zero-knowledge proof requirement, the reversed burden of proof, auditor costs borne by platforms, the 6% fine cap, the 30/90-day expedited procedure, and the fact that video games which are not online platforms are supervised by national authorities
• EU KIDS Act to restrict social media platforms' access to children in the EU — official primary document (European Commission press release), 2026-09-17. Used to confirm the date of adoption and publication
• Draft of new EU law proposes sweeping restrictions on online games — law firm analysis (author Dr Andreas Lober), 2026-09-17. The article body was not retrieved this run (only the title rendered); this card uses one judgement from its search abstract: that the definition is "extremely broad" and could cover everything from Roblox to the multiplayer mode of a disc-based game. That is law-firm opinion, not an official position.

⚠️ Important: this card describes a proposal, not law in force. Under the ordinary EU legislative procedure it must still pass the European Parliament and Council, and provisions may be amended, weakened or removed in the final text.

Evidence and sources

• Source type: official primary document (European Commission). The strongest source type in this library — it is the legislator's own explanation of the text, not commentary on it.
• Evidence tier A, confidence medium-high: provisions can be checked directly against the official pages; the deduction reflects the draft status itself.
• Measurement definitions:
• The "at most one hour" daily limit belongs to the 13–14 guardian-supervised account band, not a blanket limit on all minors — don't over-read it
• The age rules apply only to social networking and video-sharing services; games are not covered by the age rules but by the safety-by-design obligations. These two halves have different scope, and conflating them is the easiest mistake to make here
• Regulatory split for video games: those that are online platforms fall under direct Commission supervision; video games that are not online platforms are supervised by national authorities designated by Member States. This means enforcement may differ between member states for the same game
• The 6% fine cap and the 30/90-day expedited procedure are described in the official FAQ in connection with services and systems supervised by the Commission (very large platforms and AI chatbots); whether the enforcement mechanism and penalties are identical for games that are not online platforms could not be confirmed
• This card's synthesis ("outcome regulation moving to design regulation"; compliance cost shifting from litigation to audit) is this card's inference — the official text does not use these terms
• The observation about the in-game chatbot clause follows the official wording ("Built into a platform or game, a chatbot may not switch on automatically, may not be pushed at children, and must be easy to turn off"); extending that to imply a change in launch shape for in-game AI features is this card's inference

Scope and limits

• Geography: EU only. But the same regulatory consensus (age verification, privacy by default, limits on compulsive design) is landing in different forms in the UK, Australia and several US states — the mechanism direction is comparable, the provisions are not interchangeable.
• Product type: impact scales with "do you have minor users" and "do you sell in the EU." A strictly adult-oriented product not distributed in the EU is largely unaffected; products with UGC, social features, chat, livestreaming or daily streaks are most exposed.
• Timing: draft stage. There is still substantial distance to entry into force and compliance deadlines, so this is design contingency work, not emergency remediation.
• Industry stage: for large publishers with legal teams this is process; for small studios it is a capability problem (integrating age verification, compliance documentation, audit readiness).

What would falsify this

1. If the final legislative text removes games from the safety-by-design scope, or deletes streaks from the prohibited list → this card's impact assessment for the games industry must be revised down across the board
2. If the European Parliament or Council substantially weakens the reversed burden of proof (for example dropping mandatory independent audits) → the core inference that "compliance cost becomes standing audit cost" fails
3. If the official definition of "streak mechanics that penalise a child for not returning every day" turns out to be very narrow (for example covering only forfeiting rewards already earned, not resetting progress) → the impact on standard daily-streak design needs re-assessment

The weakest link in the chain: mapping named mechanics directly onto standard Chinese-market practice. The provisions are written for products in the European market, and no enforcement cases yet define the boundaries of "streak" or "rewards for posting." This card's estimate rests on comparing mechanic shapes, not on legal interpretation.

What data would settle it: the final text; enforcement guidance from the Commission or member-state authorities; the first enforcement cases (typically years away).

Unverified

• The final legislative text's scope for games
• Whether penalties for games supervised by member states match those for very large platforms
• The precise boundary of the "streak" provision (does a streak reset count as a penalty?)
• Whether the six-month existing-account check applies to games (not social platforms) as well
• What "app stores must publish their age-rating methodology" adds on top of the existing IARC / PEGI systems
• The timetable for adoption and the compliance grace period