Serves under-18s, in the European Union

Regulation (EU) 2022/2065, Article 37, supplemented by Commission Delegated Regulation (EU) 2024/436 · Read the law's page

• If you are a Commission-designated very large online platform or very large online search engine, commission an independent audit, at your own expense and at least once a year, of your compliance with Chapter III's due diligence obligations, including the systemic-risk mitigation measures for generated and manipulated content, and with any codes of conduct or crisis protocols you have joined.
• Select an auditing organisation that is independent of you and free of conflicts of interest: it must not have supplied you or a legal person connected to you non-audit services related to the matters audited in the twelve months before the audit began, must have committed not to supply them in the twelve months after it is completed, must not have audited you for more than ten consecutive years, and must not be paid on a result-contingent basis.
• Cooperate with the auditing organisation: give it access to the data, premises, and personnel it needs, and do not hamper, unduly influence, or undermine the audit.
• Where the audit report is not positive, adopt an audit implementation report within one month of receiving the operational recommendations, describing the measures you took, or explaining why you did not and what you did instead (Article 37(6)).
• Transmit the audit report and the audit implementation report to your Digital Services Coordinator of establishment and the Commission without undue delay, and make them public, with confidential information removed where necessary, within three months of receiving the audit report.

Regulation (EU) 2022/2065, Arts. 34-36 · Read the law's page

• If the Commission designates your online platform or online search engine as a very large online platform or very large online search engine under Article 33(4), the duties below apply to you from four months after it notifies you of the decision (Article 33(6)).
• Diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of your service and its related systems, including algorithmic systems, or from the use made of your services. Carry out the assessment by the date from which the obligations apply to you, at least once every year thereafter, and in any event before deploying functionalities that are likely to have a critical impact on the risks identified.
• Make the assessment specific to your services and proportionate to the systemic risks, taking into consideration their severity and probability. Include the dissemination of illegal content through your services; any actual or foreseeable negative effects for the exercise of fundamental rights; any actual or foreseeable negative effects on civic discourse and electoral processes, and public security; and any actual or foreseeable negative effects in relation to gender-based violence, the protection of public health and minors and serious negative consequences to a person's physical and mental well-being.
• Take into account, in particular, whether and how the design of your recommender systems and any other relevant algorithmic system, your content moderation systems, your applicable terms and conditions and their enforcement, your systems for selecting and presenting advertisements, and your data related practices influence those risks. Also analyse whether and how intentional manipulation of your service, including inauthentic use or automated exploitation, and the amplification and potentially rapid and wide dissemination of illegal content and of information incompatible with your terms and conditions, influence them, taking into account specific regional or linguistic aspects.
• Preserve the supporting documents of each risk assessment for at least three years after it is performed and, upon request, communicate them to the Commission and to the Digital Services Coordinator of establishment.
• Put in place reasonable, proportionate and effective mitigation measures, tailored to the specific systemic risks identified under Article 34, with particular consideration to the impacts of such measures on fundamental rights. The measures may include adapting the design, features or functioning of your services, your terms and conditions and their enforcement, your content moderation processes, your algorithmic, recommender and advertising systems and your internal processes; cooperating with trusted flaggers and implementing the decisions of out-of-court dispute settlement bodies; cooperating with other providers through the codes of conduct and the crisis protocols; awareness-raising measures; and targeted measures to protect the rights of the child, including age verification and parental control tools.
• If the Commission adopts a crisis decision under Article 36 addressed to you, assess whether and to what extent the functioning and use of your services significantly contribute to the serious threat, identify and apply specific, effective and proportionate measures to prevent, eliminate or limit that contribution, and report to the Commission by the date or at the regular intervals the decision specifies.

Regulation (EU) 2022/2065, Arts. 11-15 · Read the law's page

• Designate a single point of contact for Member States' authorities, the Commission and the Board, so that they can communicate with you directly and by electronic means, and make public the information needed to identify and reach it. Keep that information easily accessible and up to date, and state the official languages of the Member States that can be used to communicate with it, in addition to a language broadly understood by the largest possible number of Union citizens. They must include at least one official language of the Member State of your main establishment or of the place where your legal representative resides or is established.
• Designate a single point of contact for the recipients of your service that lets them communicate with you directly and rapidly, by electronic means and in a user-friendly manner. Let recipients choose the means of communication, which must not rely solely on automated tools, and make public the information they need to identify and reach it, easily accessible and kept up to date.
• If you have no establishment in the Union but offer services in the Union, designate in writing a legal or natural person as your legal representative in one of the Member States where you offer your services. Mandate the representative to be addressed, in addition to or instead of you, by the competent authorities, the Commission and the Board on all issues necessary for the receipt of, compliance with and enforcement of decisions under the Regulation, and give it the necessary powers and sufficient resources.
• If you have no establishment in the Union, notify the name, postal address, email address and telephone number of your legal representative to the Digital Services Coordinator of the Member State where it resides or is established, and keep that information publicly available, easily accessible, accurate and up to date. Designating a legal representative does not make you established in the Union.
• Include in your terms and conditions information on any restrictions you impose on the use of your service in respect of information provided by recipients, including the policies, procedures, measures and tools you use for content moderation (algorithmic decision-making and human review) and the rules of procedure of your internal complaint handling system. Set it out in clear, plain, intelligible, user-friendly and unambiguous language, and make it publicly available in an easily accessible and machine-readable format.
• Inform recipients of the service of any significant change to your terms and conditions.
• If your service is primarily directed at minors or predominantly used by them, explain the conditions for, and any restrictions on, the use of the service in a way that minors can understand.
• Apply and enforce the restrictions in your terms and conditions in a diligent, objective and proportionate manner, with due regard to the rights and legitimate interests of all parties involved, including the fundamental rights of the recipients of the service, such as the freedom of expression and the freedom and pluralism of the media.
• If you are a very large online platform or very large online search engine, give recipients a concise, easily accessible and machine-readable summary of your terms and conditions, including the available remedies and redress mechanisms, in clear and unambiguous language, and publish your terms and conditions in the official languages of all the Member States in which you offer your services.
• Publish, at least once a year, in a machine-readable format and in an easily accessible manner, clear and easily comprehensible reports on any content moderation you engaged in during the relevant period.
• Include in each report, as applicable: the orders received from Member States' authorities, including orders under Articles 9 and 10, by type of illegal content and issuing Member State, with the median time to inform the authority and give effect; if you provide hosting, the notices submitted under Article 16 by type of alleged illegal content, those from trusted flaggers, the action taken and whether it rested on the law or your terms and conditions, the notices processed by automated means and the median time to act; meaningful information on content moderation at your own initiative, including automated tools and the training and assistance given to moderators; the complaints received through your internal complaint-handling systems, the decisions taken, the median time to decide and the instances where decisions were reversed; and any use of automated means for content moderation, with its purposes, indicators of accuracy, possible rate of error and safeguards.
• You are not required to publish the reports in Article 15(1) if you qualify as a micro or small enterprise as defined in Recommendation 2003/361/EC and are not a very large online platform.

Regulation (EU) 2024/900, Arts. 18-19 · Read the law's page

• If you are a controller and use targeting techniques or ad-delivery techniques that involve the processing of personal data in online political advertising, process the data only if you collected it from the data subject (Article 18(1)(a)).
• Process the data for those techniques only if the data subject has given explicit consent, within the meaning of Regulations (EU) 2016/679 and (EU) 2018/1725, to the processing of personal data separately for the purpose of political advertising (Article 18(1)(b)).
• Do not let those techniques involve profiling, as defined in Article 4, point 4, of Regulation (EU) 2016/679, using the special categories of personal data referred to in Article 9(1) of that Regulation (Article 18(1)(c)).
• Do not use targeting techniques or ad-delivery techniques in political advertising that involve the processing of the personal data of a data subject whom you know with reasonable certainty to be at least one year under the voting age established by national rules; you are not obliged to process additional personal data to assess whether the data subject is one year under the voting age (Article 18(2)).
• Article 18 does not apply to communications of a political party, foundation, association or other non-profit body to its members and former members, or to communications such as newsletters linked to its political activities, as long as they are solely based on subscription data and strictly limited to members, former members or subscribers, are based on personal data provided by them, and do not involve processing personal data to target or otherwise further select the recipients and the messages they receive (Article 18(3)).
• Do not ask a data subject to consent if he or she has already indicated by automated means that he or she does not consent to data processing for political advertising purposes, unless the request is justified by a substantial change of circumstances, and offer a data subject who does not consent an equivalent alternative for using the online service without receiving political advertising (Article 18(4)).
• Adopt, implement and make publicly available an internal policy describing clearly and in plain language how such techniques are used, and retain it for seven years from the last use of the techniques (Article 19(1)(a)).
• Keep records on the use of such techniques and the relevant mechanisms and parameters used (Article 19(1)(b)).
• Provide, together with the indication that the advertisement is political, the additional information that lets the individual understand the logic involved and the main parameters of the techniques used, including whether an artificial intelligence system has been used to target or deliver the advertisement and any additional analytical techniques, with the elements listed in Article 19(1)(c), points (i) to (vi): the specific groups of recipients targeted and the parameters used to determine them, the categories of personal data used, the targeting goals, mechanisms and logic including the inclusion and exclusion parameters and the reasons for choosing them, meaningful information on the use of artificial intelligence systems, the period of dissemination and the number of individuals reached, and a link to or clear indication of where the policy can be retrieved (Article 19(1)(c)).
• Prepare an internal annual risk assessment of the use of targeting techniques or ad-delivery techniques on fundamental rights and freedoms, and make its results publicly available (Article 19(1)(d)).
• Provide, together with the political advertisement unless it is included in the transparency notice required under Article 12(1), a reference to effective means to support individuals in exercising their rights under Regulations (EU) 2016/679 or (EU) 2018/1725, in particular their rights to amend personal data or withdraw consent, including a link to an interface for exercising those rights (Article 19(1)(e)).
• Where you are not the political advertising publisher, ensure that the information in Article 19(1), points (c) and (e), is communicated to the publisher in a timely and accurate manner, by a standardized automated process where technically possible (Article 19(2)); present the information in Article 19 in a format that is easily accessible and, where technically feasible, machine-readable, clearly visible and user-friendly, in plain language (Article 19(4)).
• If you provide political advertising services, transmit to the controllers, as necessary, the information they need to comply with Article 19(1) and (2) (Article 19(3)).

COM(2026) 681 final · Read the law's page

• A provider of an online social networking service or video-sharing platform service would have to stop a person below the age of 15 from creating an account or using one, where the service poses a risk to the privacy, safety or security of a minor below that age; the proposal defines that risk by listed features, such as live streaming to an indeterminate audience, contact with people outside a user's existing connections, or a recommender system based on profiling.
• A provider that lets a guardian set up a limited account for a minor above 13 and below 15 would have to keep the tools for guardians always activated, let the guardian set a daily time limit of no more than one hour, and let the guardian pre-approve new contacts and cap the number of contacts.
• Within six months after the Regulation applies, a provider would have to establish whether holders of existing accounts are below 15, and disable the accounts of those established to be below 15 or whose age cannot be established.
• A provider bound by the minimum age would have to verify age exclusively through an EU age verification solution using an EU proof of age attestation, provided by a third party and certified under the EU Age Verification Scheme.
• A provider of an online social networking service, video-sharing platform service, online game, AI companion, general conversational chatbot or software application store would have to ensure a high level of privacy, safety and security of minors and design its service by default to the Chapter III requirements, departing from them only after establishing through age assurance that the user is an adult.
• A provider of a software application store would have to put in place an age-rating system for each application it offers, and would have to stop minors from accessing or buying applications that are inappropriate for their age under that system.
• A provider of an operating system that has obtained a user's age signal would have to enable sharing of that signal with in-scope providers, after obtaining the user's consent, when they need it to comply.
• A provider of an AI companion or general conversational chatbot would have to put in place proportionate and effective measures to protect minors, including enabling access for minors below 13 only through the tools for guardians.
• A provider using age assurance would have to use a solution that does not identify, locate, track or profile the person, and would have to process no more personal data than strictly necessary to assess whether the age threshold is met.
• A provider of an online social networking service or video-sharing platform service that is a designated very large online platform would have to notify the Commission of a compliance plan within four months of its designation, or within 30 days after the Regulation applies if already designated, and have the plan audited by independent auditors at its own expense.
• A provider would have to refrain from any behaviour, contractual, commercial or technical, that undermines compliance, and from using behavioural techniques or interface design to do so.

Directive (EU) 2024/2853 · Read the law's page

• The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
• If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
• Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
• If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
• Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
• Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).

Regulation (EU) 2025/2509, Article 25(2), point (c) · Read the law's page

• This duty takes effect on 1 August 2030 (Article 59).
• If you are a manufacturer of a toy that falls within the scope of Regulation (EU) 2024/1689, Regulation (EU) 2024/2847 or Directive 2014/53/EU, take account of the particular vulnerabilities of children in relation to the intended use of the toy when your safety assessment assesses and addresses its hazards, and include that assessment in the technical documentation (Article 25(2), point (c), and Article 25(3)).