AustriaDraft Law on a Minimum Age for Social Media Platforms
Gesetzesentwurf Mindestalter Soziale Medien, Begutachtung 27 Juli 2026
A published draft that has not reached a legislature, dated , as of .
A social media and minors rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
Where it has got to
The text described here is Ministerialentwurf 132/ME, XXVIII. GP (Gesetzestext zur Begutachtung). That print is 132/ME XXVIII. GP, published .
Locally, this stage is Begutachtungsverfahren (Ministerialentwurf 132/ME, XXVIII. GP).
The stage above is recorded at www.parlament.gv.at.
The Begutachtungsfrist (public comment period) ended on , and the statements were transmitted to the Federal Ministry on . The Parliament's record for 132/ME lists no Regierungsvorlage submitted to the Nationalrat, so the draft has not been introduced as a bill.
What it requires
- Applies to platforms aimed at or reasonably likely to be used by children that use at least one addictive design feature: a recommendation feed weighted toward strangers' content, infinite scroll or autoplay, a continuous-use reward system, or a push notification meant to draw a user back. Messaging services are excluded.
- Prevent a user under 14 from opening or keeping an account; you may still offer a separate child-appropriate area.no control in the NIST Privacy Framework
- Verify age once, at account creation, with a zero-knowledge-proof, double-blind design: the age-attestation provider learns nothing about where or when its attestation is used, and you receive only a true-or-false answer on whether the 14-year threshold is met, with no name, birth date or other identifying data.NIST Privacy FrameworkCT.DP-P5
- You may use ID Austria, the state digital-identity system, to verify age, but it is one available method among others and not a mandatory one.
- Have the age verification the draft requires in place by at the latest; the draft sets as the day its provisions take effect.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.DP-P5Attribute references are substituted for attribute values.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalty structure
As proposed, the cap applies to very large platforms.
- Rule
- Turnover pct only
- As of
- Currency
- EUR
- Turnover percentage cap
- 6
Who enforces it
Enforcement body
KommAustria (Kommunikationsbehörde Austria, the communications authority), which under the draft reviews and enforces the age verification, with the RTR-GmbH supporting it.
Settledness
- As of
- Open questions
- Can a video-sharing platform that uses none of the five functions listed in § 54e Abs. 3 Z 5 lit. a to e of the draft still be bound to block users under 14, given that the draft says protection is 'jedenfalls' not assured where one of them is used?
- What makes an age-verification method 'gleichwertig' to the identity-checking standard of § 6 FM-GwG and the Online-IDV in § 54e Abs. 3b of the draft, when Abs. 3a also requires a method that is among the most data-sparing available?
What it reaches
Age threshold
14
Covered services
Platforms using algorithm-driven, addictive design features aimed at or reasonably likely to be used by children, such as TikTok, Instagram, YouTube, and Snapchat; messaging services such as WhatsApp are excluded.
How the hook was established
express
What makes it apply
Market targeting
Verification methods
Digital ID, Third party service
What it makes you log
Log retention
- As of
- Basis
- Unspecified
- Prohibits retaining
- A central usage log of age-proof presentations (zentrale Nutzungsprotokollierung)
Logging duty
The draft requires the provider of an age verification method to document that the method meets its design requirements. It requires no log of individual checks, and it lists exclusion of central usage logging among those requirements.
- Kind
- Implicit
- As of
- Provision
- Draft AMD-G Section 54e(3a), as proposed
- Trigger
- age_assurance
What this law does
The draft provides that a platform that uses at least one of a defined set of addictive design features, a recommendation feed weighted toward strangers' content, infinite scroll or autoplay, a continuous-use reward system, or a push notification meant to draw a user back, must prevent a user under 14 from opening or keeping an account, while remaining free to offer a separate child-appropriate area.
Under the draft, age verification runs once at account creation, using a zero-knowledge-proof, double-blind design under which the age-attestation provider learns nothing about where or when its attestation is used, the platform receives only a true-or-false answer on whether the 14-year threshold is met, and no name, birth date, or other identifying data passes to the platform.
Under the draft, ID Austria, the state digital-identity system, is one available verification method among others, not a mandatory one. Under the draft, very large platforms face a fine of up to 6 percent of worldwide annual turnover for a violation. Under the draft's own text, its provisions take effect on , and platform providers must meet the age-verification requirements by at the latest.
The draft's new penalty offences, its 6 percent fine for very large platforms and its measures against providers from other member states apply only to facts that occur after .
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .